summaryrefslogtreecommitdiffstats
path: root/src/responder/nss/nsssrv_cmd.c
Commit message (Collapse)AuthorAgeFilesLines
* nss: Use negcache for getbysid requestsJakub Hrozek2015-04-241-0/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Reset negcache after checking domainsJakub Hrozek2015-04-091-0/+24
| | | | | | | | The NSS responder periodically re-checks subdomains. We need to reset the negative cache each time the check finishes to allow the negative cache to contain entries from different domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Fix a few typos in commentsPavel Reichl2015-03-261-4/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-171-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-121-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* RESPONDERS: Warn to syslog about colliding objectsLukas Slebodnik2015-02-181-0/+14
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2203 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* fill_id() fix LE/BE issue with wrong data typeSumit Bose2015-01-301-4/+6
| | | | | | Related to https://fedorahosted.org/sssd/ticket/1588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: fix SID lookupsSumit Bose2015-01-231-1/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: Add original DN and memberOf to origbyname requestSumit Bose2015-01-201-0/+4
| | | | | | | | | IPA HBAC evaluation relies on the original values for DN and memberOf attributes. Resolves https://fedorahosted.org/sssd/ticket/2560 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: refactor fill_orig()Sumit Bose2015-01-201-67/+66
| | | | | | The two loops in fill_orig were almost identical. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: make fill_orig() multi-value awareSumit Bose2015-01-201-20/+68
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: sysdb_search_object_by_sid returns ENOENTPavel Reichl2014-12-171-13/+12
| | | | | | | | | | | | sysdb_search_object_by_sid returns ENOENT if no results are found. Part od solution for: https://fedorahosted.org/sssd/ticket/1991 Fixes: https://fedorahosted.org/sssd/ticket/2520 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: nss_cmd_getbysid_search return ENOENTPavel Reichl2014-12-171-8/+8
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Fix warning enumerated type mixed with another typeLukas Slebodnik2014-11-101-3/+3
| | | | | | | | | | src/responder/nss/nsssrv_cmd.c:688: mixed_enum_type: enumerated type mixed with another type "enum sss_dp_acct_type" was mixed with type "int". ANSI C is not very strict in this. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Add ssh pubkey to origbyname requestSumit Bose2014-11-051-0/+2
| | | | | | | | | Since the IPA clients expects that the extdom plugin delivers the default view data for a given user this patch adds the public SSH key to the list of returned attributes of the getorigbyname request so that it can be send back to the clients. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb_add_overrides_to_object: add new parameter and multi-value supportSumit Bose2014-11-051-1/+1
| | | | | | | | | | With the new parameter an attribute list other than the default one can be used. Override attributes with multiple values (e.g. SSH public keys) are now supported as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: return user_attributes in origbyname requestSumit Bose2014-11-051-30/+90
| | | | | | | | | | | | | To allow IPA clients to offer special attributes of AD users form trusted domain the extdom plugin on the IPA server must send them to the clients. The extdom plugin already uses sss_nss_getorigbyname() to get attributes like the SID and the user principal name. This patch adds the attributes given by the NSS/IFP user_attributes option to the list of attributes returned by sss_nss_getorigbyname(). Fixes https://fedorahosted.org/sssd/ticket/2464 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: disable midpoint refresh for netgroupsPavel Reichl2014-11-041-14/+43
| | | | | | | | | | Disable midpoint refresh for netgroups if periodical refresh of expired netgroups is enabled (refresh_expired_interval) Resolves: https://fedorahosted.org/sssd/ticket/2102 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: group enumeration fixSumit Bose2014-10-271-0/+3
| | | | | | | | | | The view/override patches introduced and issue with group enumeration where all groups are returned with the same name. This patch should fix it. Fixes: https://fedorahosted.org/sssd/ticket/2475 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Possibility to use any shells in 'allowed_shells'Denis Kutin2014-10-221-6/+13
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2219 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: make enumeration requests aware of viewsSumit Bose2014-10-201-6/+8
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sid2name: return name without views appliedSumit Bose2014-10-201-2/+22
| | | | | | | Make sure that the original name of an object without any overrides applied is returned by sid2name requests. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support for getgr* requestsSumit Bose2014-10-201-13/+50
| | | | | | | | Make group lookups view and override aware. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support to initgroups requestSumit Bose2014-10-201-14/+37
| | | | | | | | Make sysdb request view and override aware. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support for getpwnam/getpwuid requestsSumit Bose2014-10-201-16/+62
| | | | | | | | | For user lookups view and override aware calls to search the cache and read attribute values are used. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add SSS_NSS_GETORIGBYNAME requestSumit Bose2014-10-141-2/+89
| | | | | | | | | | | | | | | This patch adds a new request to the nss responder which follows the same flow as a SSS_NSSGETSIDBYNAME request but returns more data than just the SID. The data is returned as pairs of \0-terminated strings where the first string is the sysdb attribute name and the second the corresponding value. The main use case is on the FreeIPA server to make additional user and group data available to the extdom plugin which then send this data to SSSD running on FreeIPA clients. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: UPN as a template expansion for homedir mappingsPavel Reichl2014-10-121-0/+3
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2340 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-051-1/+2
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-011-7/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-011-9/+10
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
* Make the space override responder-agnosticJakub Hrozek2014-08-131-7/+12
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 In order to make the override_space option usable by other responders, we need to move the override_space option to the generic responder structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Only replace space with the specified substitutionJakub Hrozek2014-08-131-21/+16
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 - make sss_replace_whitespaces only replace space (' ') not any whitespace - make sss_replace_whitespaces only replace a single char, not the whole string - rename CONFDB_NSS_OVERRIDE_DEFAULT_WHITESPACE to CONFDB_NSS_OVERRIDE_DEFAULT_SPACE - rename the override_default_whitespace option to override_space - rename sss_replace_whitespaces() to sss_replace_space() - rename sss_reverse_replace_whitespaces() to sss_reverse_replace_space() - rename nctx->override_default_wsp_str to nctx->override_space - make the return value of sss_replace_space non-const to avoid freeing the result without compilation warnings Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* case_sensitivity = preservingMichal Zidek2014-07-291-2/+2
| | | | | | | | | | | If case_sensitivity is set to 'preserving', getXXnam returns name attribute in the same format as stored in LDAP. Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Replace spaces with specified string in names.Lukas Slebodnik2014-07-281-1/+61
| | | | | | | | | | | | This patch add possibility to replace whitespace in user and group names with a specified string. With string "-", sssd will return the same result as winbind enabled option "winbind normalize names" Resolves: https://fedorahosted.org/sssd/ticket/1854 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-021-2/+9
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-021-11/+18
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* refactor calls of sss_parse_namePavel Reichl2014-03-181-2/+1
| | | | | | | sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-74/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-283/+283
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* NSS: Fix DEBUG formatting of cmdctx->idJakub Hrozek2014-02-111-26/+26
| | | | | | | Sometimes a UID/GID value was printed using the %d format specifier which caused overflows for very large values of ID. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responder: Use SAFEALIGN macros where appropriate.Michal Zidek2014-02-051-36/+44
| | | | https://fedorahosted.org/sssd/ticket/1359
* Revert "NSS: add support for subdomain_homedir"Pavel Reichl2014-02-051-8/+0
| | | | This reverts commit 1dc7694a1cbc62b0d7e23cc1369579e5ce0071e8.
* NSS: add support for subdomain_homedirPavel Reichl2014-01-151-0/+8
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2169
* NSS: Use plain user name when expanding homedirJakub Hrozek2014-01-151-1/+12
|
* NSS: Don't use printf(3) on user provided strings.Stef Walter2014-01-121-87/+45
| | | | | | | | | | | | | | | | | | | | This also fixes several corner cases and crashers. It's not prudent to pass user input to (even admin) input as a format string to printf, and various distros now check for this. This can cause accessing memory incorrectly, and various also various libc abort()'s. In addition various assumptions were made about full_name_format that aren't necessarily the case if the user uses a more complex format. Use safe-printf.c implementation for formatting full_name_format. Adapt the NSS resolver so it doesn't barf on formatted strings that are shorter than expected given a full_name_format. Tests added and updated appropriately.
* NSS: Compare bool with false, not 0Jakub Hrozek2013-12-091-2/+2
|
* nss: check for Well-Known SIDs in SID based requestsSumit Bose2013-11-151-0/+134
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)Michal Zidek2013-11-151-1/+1
|
generated by cgit (git 2.34.1) at 2024-06-08 23:06:24 +0000