summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
* NSS: Fix warning enumerated type mixed with another typeLukas Slebodnik2014-11-102-4/+4
| | | | | | | | | | src/responder/nss/nsssrv_cmd.c:688: mixed_enum_type: enumerated type mixed with another type "enum sss_dp_acct_type" was mixed with type "int". ANSI C is not very strict in this. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Add ssh pubkey to origbyname requestSumit Bose2014-11-051-0/+2
| | | | | | | | | Since the IPA clients expects that the extdom plugin delivers the default view data for a given user this patch adds the public SSH key to the list of returned attributes of the getorigbyname request so that it can be send back to the clients. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Views: apply user SSH public key overrideSumit Bose2014-11-051-29/+94
| | | | | | | | | | | | | With this patch the SSH public key override attribute is read from the FreeIPA server and saved in the cache with the other override data. Since it is possible to have multiple public SSH keys this override value does not replace any other data but will be added to existing values. Fixes https://fedorahosted.org/sssd/ticket/2454 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb_add_overrides_to_object: add new parameter and multi-value supportSumit Bose2014-11-051-1/+1
| | | | | | | | | | With the new parameter an attribute list other than the default one can be used. Override attributes with multiple values (e.g. SSH public keys) are now supported as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: return user_attributes in origbyname requestSumit Bose2014-11-051-30/+90
| | | | | | | | | | | | | To allow IPA clients to offer special attributes of AD users form trusted domain the extdom plugin on the IPA server must send them to the clients. The extdom plugin already uses sss_nss_getorigbyname() to get attributes like the SID and the user principal name. This patch adds the attributes given by the NSS/IFP user_attributes option to the list of attributes returned by sss_nss_getorigbyname(). Fixes https://fedorahosted.org/sssd/ticket/2464 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: parse user_attributes optionSumit Bose2014-11-052-0/+22
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add parse_attr_list_ex() helper functionSumit Bose2014-11-054-116/+157
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: disable midpoint refresh for netgroupsPavel Reichl2014-11-041-14/+43
| | | | | | | | | | Disable midpoint refresh for netgroups if periodical refresh of expired netgroups is enabled (refresh_expired_interval) Resolves: https://fedorahosted.org/sssd/ticket/2102 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix typo in debug messageSumit Bose2014-10-301-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: preserve service name in getsrv callMichal Zidek2014-10-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | About case_sensitive=preserving and services. The name of the service can be preserved in result of 'getent service'. However we should still lowercase the protocol and service aliases because they serve as keys in some queries to sysdb. The lowercasing is done by the provider already. If we did not do that, we would lose case insesnsitivity. With this patch the responder preserves the case of service name and protocol, to match the case that is stored in the sysdb (however the protocol is already lowercased by provider, so it was done only for consistent use of the case_sensitive=preserve option in the responders and only the case of name is the same as in ldap). Fixes: https://fedorahosted.org/sssd/ticket/2460 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Set default value for umaskPavel Reichl2014-10-298-0/+18
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Don't hard-code umask value in utility functionPavel Reichl2014-10-291-4/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: refactor create_pipe_fd()Pavel Reichl2014-10-272-10/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2470 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: group enumeration fixSumit Bose2014-10-271-0/+3
| | | | | | | | | | The view/override patches introduced and issue with group enumeration where all groups are returned with the same name. This patch should fix it. Fixes: https://fedorahosted.org/sssd/ticket/2475 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Possibility to use any shells in 'allowed_shells'Denis Kutin2014-10-221-6/+13
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2219 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SSH: Run the ssh responder as the SSSD userJakub Hrozek2014-10-221-1/+2
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SUDO: Run the sudo responder as the SSSD userJakub Hrozek2014-10-221-1/+1
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAC: Run the pac responder as the SSSD userJakub Hrozek2014-10-221-1/+2
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AUTOFS: Run the autofs responder as the SSSD userJakub Hrozek2014-10-221-1/+1
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAM: Run pam responder as nonrootMichal Zidek2014-10-221-1/+1
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAM: Create pipe file descriptors before privileges are droppedMichal Zidek2014-10-221-4/+26
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responders: Do not initialize pipe fd if already presentMichal Zidek2014-10-229-14/+24
| | | | | | | | Allow to skip initialization of pipe file descriptor if the responder context already has one. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responder_common: Create fd for pipe in helperMichal Zidek2014-10-222-72/+65
| | | | | | | | Move creating of file descriptor for pipes into helper function and make this function public. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* NSS: Run as a user specified by monitorJakub Hrozek2014-10-221-1/+2
| | | | | | | | | Adds the NSS responder to the list of services known to work as a non-root user and becomes the specified user after starting the NSS responder. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Add a function to convert id_t from a number or a nameJakub Hrozek2014-10-222-12/+7
| | | | | | | | | | | | We need a custom function that would convert a numeric or string input into uid_t. The function will be used to drop privileges in servers and also in the PAC and IFP responders. Includes a unit test to test all code that changed as well as a fix for a misnamed attribute in the csv_to_uid_list function synopsis. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SSSD: Add the options to specify a UID and GID to run asJakub Hrozek2014-10-207-7/+31
| | | | | | | | | Adds new command line options --uid and --gid to all SSSD servers, making it possible to switch to another user ID if needed. So far all code still runs as root. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sudo: support viewsPavel Březina2014-10-201-3/+11
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: support viewsPavel Březina2014-10-201-21/+46
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* nss: make enumeration requests aware of viewsSumit Bose2014-10-201-6/+8
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam: make pam responder aware if viewsSumit Bose2014-10-201-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sid2name: return name without views appliedSumit Bose2014-10-201-2/+22
| | | | | | | Make sure that the original name of an object without any overrides applied is returned by sid2name requests. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support for getgr* requestsSumit Bose2014-10-201-13/+50
| | | | | | | | Make group lookups view and override aware. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support to initgroups requestSumit Bose2014-10-201-14/+37
| | | | | | | | Make sysdb request view and override aware. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add view support for getpwnam/getpwuid requestsSumit Bose2014-10-201-16/+62
| | | | | | | | | For user lookups view and override aware calls to search the cache and read attribute values are used. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add SSS_NSS_GETORIGBYNAME requestSumit Bose2014-10-141-2/+89
| | | | | | | | | | | | | | | This patch adds a new request to the nss responder which follows the same flow as a SSS_NSSGETSIDBYNAME request but returns more data than just the SID. The data is returned as pairs of \0-terminated strings where the first string is the sysdb attribute name and the second the corresponding value. The main use case is on the FreeIPA server to make additional user and group data available to the extdom plugin which then send this data to SSSD running on FreeIPA clients. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: UPN as a template expansion for homedir mappingsPavel Reichl2014-10-121-0/+3
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2340 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: Check return value of function hash_entriesLukas Slebodnik2014-10-121-0/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-091-1/+1
| | | | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam: sub-domain authentication fixSumit Bose2014-10-011-1/+11
| | | | | | | | | | With a recent patch sysdb_getpwnam() was replaced by sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave differently with respect to sub-domain users. As a consequence the PAM responder was not able to resolve users from sub-domains. This patch reverts this change and uses sysdb_getpwnam() again. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-291-1/+50
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-293-3/+178
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Suppress 'git diff' noiseMichal Zidek2014-09-081-159/+159
| | | | | | | | | | | | This patch suppresses the 'git diff' noise after ifp_iface_generated.c is generated. It simply changes the file to the same form it is being automatically generated so that 'git diff' only shows changes in the code and not the differently generated ifp_iface_generated.c file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-051-1/+2
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-013-23/+167
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-013-10/+12
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
* PAM: remove ldb_result member from pam_auth_req contextSumit Bose2014-09-012-6/+6
| | | | | This member was used only in a single call where a local variable suits better.
* PAM: extract checks from parsing routinesSumit Bose2014-09-011-34/+18
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* SUDO: Use the override_space optionJakub Hrozek2014-08-132-2/+8
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 With this path, a user whose name is "space user" would match a sudo rule while using the override_default_space option. Please note that the option is only a client-side override, so the sudoUser attribute must contain the space in order to match the original name. In other words, when substituting space ( ) for underscore (_), this attribute would match: sudoUser: space user this would not: sudoUser: space_user Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-23 04:14:45 +0000