summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
...
* mmap_cache: Invalidate entry in right memory cacheLukas Slebodnik2015-07-031-8/+25
| | | | | | | | | If group was not found in nss_cmd_getgrnam_search then we tied to invalidate entry in memory cache. But function delete_entry_from_memory cache only invalidated in passwd memory cache. Reviewed-by: Michal Židek <mzidek@redhat.com>
* nss: Store entries in responder to initgr mmap cacheLukas Slebodnik2015-07-035-4/+116
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2485 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IFP: add FindByCertificate method for User objectsSumit Bose2015-06-1911-13/+239
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ncache: add calls for certificate based searchesSumit Bose2015-06-192-0/+34
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix warnings with enabled optimisationLukas Slebodnik2015-06-191-2/+2
| | | | | | | | | | | | | | | | | It seems that gcc 5.1 optimize enum in some ways and expects that unctions ifp_cache_build_path and ifp_cache_build_base_dn can return unitialized value due to missing default in switch. src/responder/ifp/ifp_cache.c:118:13: warning: 'base_dn' may be used uninitialized in this function [-Wmaybe-uninitialized] ldb_ret = ldb_search(sysdb_ctx_get_ldb(domain->sysdb), tmp_ctx, &result, ^ src/responder/ifp/ifp_cache.c: scope_hint: In function 'ifp_cache_get_cached_objects' src/responder/ifp/ifp_cache.c:135:18: warning: 'path' may be used uninitialized in this function [-Wmaybe-uninitialized] paths[i] = ifp_cache_build_path(paths, type, domain, result->msgs[i]); ^ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Export nodesPavel Březina2015-06-185-22/+199
| | | | | | | | | | | | | | | | | | | | | | IFP now exports cached users and groups in introspection. After a user is cached with: dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Store And Introspection called with: dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.DBus.Introspectable.Introspect The cached users would be visible in the Introspection XML as: <node name="ipaldap/397400000" /> </node> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object]Pavel Březina2015-06-1811-0/+708
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2338 Example use: $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByName \ string:admin object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Store boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Remove boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: deprecate GetUserAttrPavel Březina2015-05-221-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: add org.freedesktop.sssd.infopipe.Groups.GroupPavel Březina2015-05-227-0/+658
| | | | | | | | | | | | | | | | Example calls: dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups/LDAP_2ePB/30001 org.freedesktop.DBus.Properties.Get string:org.freedesktop.sssd.infopipe.Groups.Group string:name method return sender=:1.159 -> dest=:1.168 reply_serial=2 variant string "group-1" dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups/LDAP/30002 org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList method return sender=:1.934 -> dest=:1.937 reply_serial=2 Resolves: https://fedorahosted.org/sssd/ticket/2150 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: add org.freedesktop.sssd.infopipe.GroupsPavel Březina2015-05-227-0/+369
| | | | | | | | | | | | | | | | Example calls: dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups org.freedesktop.sssd.infopipe.Groups.FindByName string:group-1method return sender=:1.159 -> dest=:1.166 reply_serial=2 object path "/org/freedesktop/sssd/infopipe/Groups/LDAP_2ePB/30001" dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups org.freedesktop.sssd.infopipe.Groups.FindByID uint32:30001 method return sender=:1.159 -> dest=:1.167 reply_serial=2 object path "/org/freedesktop/sssd/infopipe/Groups/LDAP_2ePB/30001" Resolves: https://fedorahosted.org/sssd/ticket/2150 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: add org.freedesktop.sssd.infopipe.Users.UserPavel Březina2015-05-2212-34/+846
| | | | | | | | | | | | Example calls: dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users/LDAP_2ePB/10001 org.freedesktop.DBus.Properties.Get string:org.freedesktop.sssd.infopipe.Users.User string:name method return sender=:1.159 -> dest=:1.165 reply_serial=2 variant string "user-1" Resolves: https://fedorahosted.org/sssd/ticket/2150 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: add org.freedesktop.sssd.infopipe.UsersPavel Březina2015-05-227-0/+493
| | | | | | | | | | | | | | | | Example calls: dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByName string:user-1 method return sender=:1.159 -> dest=:1.160 reply_serial=2 object path "/org/freedesktop/sssd/infopipe/Users/LDAP_2ePB/10001" dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByID uint32:10001 method return sender=:1.159 -> dest=:1.163 reply_serial=2 object path "/org/freedesktop/sssd/infopipe/Users/LDAP_2ePB/1000 Resolves: https://fedorahosted.org/sssd/ticket/2150 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: Do not ignore default vaue of SYSDB_INITGR_EXPIRELukas Slebodnik2015-05-221-3/+2
| | | | | | | | When SYSDB_INITGR_EXPIRE had default value (0) then value of SYSDB_CACHE_EXPIRE was used as initgroups expire attribute. The right apoach is already used in responder_cache_req.c Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* negcache: Soften condition for expired entriesLukas Slebodnik2015-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Type of timestamp for entries in negative cache is time_t which is number of *seconds* that have elapsed since 1 January 1970. The condition for ttl was to strict so entry could be valid from "ttl-1" to ttl e.g. * ttl is 1 second * entry was stored to negative cache at 1432120871.999639 stored_timestamp = 1432120871 * entry was tested few miliseconds later 1432120872.001293 current_time = 1432120872 Entry was marked as expired becuase result of condition was false stored_timestamp + ttl < current_time 1432120871 + 1 < 1432120872 This is a reason why ./test-negcache sometime fails. It's quite easily reproducible on slow machine or when valgrind was used. sh$ while libtool --mode=execute valgrind ./test-negcache ; do echo OK: done Reviewed-by: Pavel Reichl <preichl@redhat.com>
* 2FA offline authSumit Bose2015-05-081-3/+32
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add pre-auth requestSumit Bose2015-05-081-0/+7
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam: handle 2FA authentication token in the responderSumit Bose2015-05-081-0/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: check for overrides before calling backendSumit Bose2015-05-061-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the flag that the input data in a user or group lookup request might be an override value is only set if no cached entry was found. If the cached entry of an object with overrides is expired and a request with the override value as input is processed the flag is not set and the backend might not be able to find the right entry on the server. Typically this should not happen because of mid-point refreshes. To reproduce this create a FreeIPA user and override the login name for a specific view. On a client which has this view applied call getent passwd overridename sss_cache -E getent passwd overridename The second getent command will still show the right output but in the logs a [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 0 error message: Account info lookup failed message can be found for the second request. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* autofs: fix 'Cannot allocate memory' with FQDNsAron Parsons2015-04-301-9/+0
| | | | | | https://fedorahosted.org/sssd/ticket/2643 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: Use negcache for getbysid requestsJakub Hrozek2015-04-241-0/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Option filter_users had no effect for retrieving sudo rulesAdam Tkac2015-04-143-0/+39
| | | | | | | | | Previously sssd_sudo always obtained sudo rules for user from LDAP even when user was enlisted in filter_users. Resolves https://fedorahosted.org/sssd/ticket/2625 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Reset negcache after checking domainsJakub Hrozek2015-04-091-0/+24
| | | | | | | | The NSS responder periodically re-checks subdomains. We need to reset the negative cache each time the check finishes to allow the negative cache to contain entries from different domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-099-15/+45
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Add sss_ncache_reset_repopulate_permanentJakub Hrozek2015-04-092-0/+20
| | | | | | | This new function resets the negative cache and then re-adds the permanent entries. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Silence critical error from filter_users when default_domain_suffix ↵Jakub Hrozek2015-04-091-3/+15
| | | | | | | | | | | | | | | is set When default_domain_suffix is used and filter_users is set (at least root is always, by default), SSSD tried to add the negcache entry to the default domain. But since the default domain is not known after start up, adding the entries fail with a verbose error message. This patch handles EAGAIN returned from the parsing function while setting negcache entries gracefully and also makes the debug message in parsing function more precise. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Fix sss_ncache_reset_permanentJakub Hrozek2015-04-091-1/+1
| | | | | | | There was an off-by-one error in sss_ncache_reset_permanent that prevented the reset from working. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SSH: Ignore the default_domain_suffixJakub Hrozek2015-04-011-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2609 In a trust setup, hosts are normally only stored on the IPA server. The default_domain_suffix option is only recommended for the IPA-AD trust scenario as well. Therefore we should ignore this option in the SSH provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com>
* PAC: Remove unused functionLukas Slebodnik2015-03-311-35/+0
| | | | | | The last usage of function dom_sid_in_domain was removed as a part of chages in ticket "Enhance PAC responder for AD users" 92af6f25864b5c389b57d0f659686801b45ca58c
* Fix a few typos in commentsPavel Reichl2015-03-261-4/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-179-15/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* responder_cache: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | | | There is a warning with gcc-5.0 and enabled optimization. Warning is not visible with "-O0". CC src/responder/common/responder_cache_req.o src/responder/common/responder_cache_req.c: In function ‘cache_req_next_domain’: src/responder/common/responder_cache_req.c:296:160: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] src/responder/common/responder_cache_req.c:277:13: note: ‘ret’ was declared here errno_t ret; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_initgr_check_timeout: add debug outputSumit Bose2015-03-131-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use the logon_name as the key for the PAM initgr cacheSumit Bose2015-03-131-13/+3
| | | | | | | | | | | | | Currently the name member of the pam_data struct is used as a key but it can change during a request. Especially for sub-domain users the name is changed from the short to the fully-qualified version before the cache entry is created. As a result the cache searches are always done with the short name while the entry was written with the fully-qualified name. The logon_name member of the pam_data struct contains the name which was send by the PAM client and is never changed during the request. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: return ERR_INTERNAL if more than one entry is foundPavel Březina2015-03-131-1/+1
| | | | | | | This means that the db is not in the expected format thus we should make the error more visible. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: parse input name if neededPavel Březina2015-03-133-25/+119
| | | | | | | | The input name is now parse automatically by cache_req if none particullar domain is specified. The parsed named is returned from _recv as an output parameter. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by idPavel Březina2015-03-132-0/+58
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove default branch from switchesPavel Březina2015-03-131-20/+4
| | | | | | | | | | | | Originaly, the cache_req used enum sss_dp_acct_type to indicate request type but not all types were implemented. Thus we used default branch to indicate unimplemented request type. Now when we switched to a custom enum type we can get rid of the default branch so the compiler can check if all switches contains all values. This proved to be useful during development of new request types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by namePavel Březina2015-03-132-0/+56
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for user by uidPavel Březina2015-03-133-9/+117
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: preparations for different input typePavel Březina2015-03-133-100/+310
| | | | | | | | | Currently cache_req takes only user name as an input parameter. However, this is not enough since we will need also UID and GID in the future. This patch creates a structure to hold input parameters so it can be simply extended to support other input types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-121-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: check return value of confdb_get_stringPavel Reichl2015-02-271-0/+6
| | | | | | Coverity found this neglect. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: print the pam status as string, tooJakub Hrozek2015-02-252-4/+7
| | | | | | | | On several places, let's add a pam_strerror() call so that it's easier to debug user problems. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
* PAM: warn all services about account expirationPavel Reichl2015-02-231-2/+17
| | | | | | | | | | if pam_verbose is above one then output warning about account expiration for all services. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: new option pam_account_expired_messagePavel Reichl2015-02-231-4/+10
| | | | | | | | | | This option sets string to be printed when authenticating using SSH keys and account is expired. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: do not reject abruptlyPavel Reichl2015-02-231-0/+53
| | | | | | | | | If account has expired then pass message. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* RESPONDERS: Warn to syslog about colliding objectsLukas Slebodnik2015-02-182-0/+18
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2203 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sbus: add constant to represent subtreePavel Březina2015-02-172-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: simplify object path constant namesPavel Březina2015-02-176-17/+15
| | | | | | | | | | | | | | | | | | | | The number of interfaces will grow and in order to keep names of object path constant consistent it means that also their names will grow. The new naming schema is: /org/freedesktop/sssd/infopipe -> IFP_PATH_ / -> _ everything uppercase Example: /org/freedesktop/sssd/infopipe/Components/Responders -> IFP_PATH_COMPONENTS_RESPONDERS If the path contains a _TREE suffix, it represents the whole subtree. For example: IFP_PATH_DOMAINS_TREE is /org/freedesktop/sssd/infopipe/Domains/* Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus codegen: do not prefix getters with iface namePavel Březina2015-02-173-57/+57
| | | | | | | | | | | | | | | | | | Prefixing getters with C name of the interface is just redundant since it is the same as the name of the structure that contains those fields. The following structure: struct test_pilot { $type test_pilot_get_name; } changes to: struct test_pilot { $type get_name; } Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-20 06:18:39 +0000