summaryrefslogtreecommitdiffstats
path: root/src/db
Commit message (Collapse)AuthorAgeFilesLines
...
* sysdb: add searches by certificate with overridesSumit Bose2016-06-093-1/+180
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_attrs_add_base64_blob()Sumit Bose2016-06-092-0/+24
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_ulong()Fabiano Fidêncio2016-05-315-31/+44
| | | | | | | | | | | | | | | | | | | | | | As the add_ulong() convenience can add, replace or remove a unsigned long according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_ulong(), sysdb_replace_ulong() and sysdb_delete_ulong(). These new functions are basically wrappers of add_ulong() (now sysdb_ldb_msg_ulong_helper()), calling it using the proper flag according to each function. Any code previously using add_ulong() is now adapted to use these brand new functions. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_ulong() convenience to sysdb.cFabiano Fidêncio2016-05-312-13/+13
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_ulong() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_string()Fabiano Fidêncio2016-05-315-37/+51
| | | | | | | | | | | | | | | | | | | | | | As the add_string() convenience can add, replace or delete a string according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_string(), sysdb_replace_string() and sysdb_delete_string(). These new functions are basically wrappers of add_string() (now sysdb_ldb_msg_string_helper()), calling it using the proper flag according to each function. Any code previously using add_string() is now adapted to use these brand new functions. Resolves: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_string() convenience to sysdb.cFabiano Fidêncio2016-05-312-13/+13
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_string() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* SYSDB: Add new funtions into sysdb_sudoPetr Cech2016-04-202-0/+111
| | | | | | | | | | | | This patch adds two new functions into public API of sysdb_sudo: * sysdb_search_sudo_rules * sysdb_set_sudo_rule_attr Resolves: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB_SUDO: Remove useless testLukas Slebodnik2016-04-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The function sysdb_search_custom cannot return EOK and together set output argument count to zero. This case is already handled in function sysdb_search_entry which is used inside sysdb_search_custom. Such useless test can just cause read of unitialized variable in case of other errors returned from sysdb_search_custom. Error: UNINIT (CWE-457): [#def1] sssd-1.13.4/src/db/sysdb_sudo.c:678: var_decl: Declaring variable "count" without initializer. sssd-1.13.4/src/db/sysdb_sudo.c:698: uninit_use: Using uninitialized value "count". # 696| SUDORULE_SUBDIR, attrs, # 697| &count, &msgs); # 698|-> if (ret == ENOENT || count == 0) { # 699| DEBUG(SSSDBG_TRACE_FUNC, "No rules matched\n"); # 700| ret = EOK; Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAC: only save PAC blob into the cacheSumit Bose2016-04-131-0/+2
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2158 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-091-0/+1
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-012-0/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-012-1/+47
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-241-0/+1
| | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmd mappingPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmdgrp mappingPavel Březina2016-01-191-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudorule mappingPavel Březina2016-01-191-0/+20
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-194-69/+339
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add missing include to sysdb_services.hPavel Březina2015-12-141-0/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: fix override with the same nameSumit Bose2015-11-202-4/+18
| | | | | | | | | | | | | If the user name of a AD user is overridden with the name itself in an IPA override object SSSD adds this name twice to the alias list causing an ldb error when trying to write the user object to the cache. As a result the user is not available. This patch makes sure that there are no duplicated alias names. Resolves https://fedorahosted.org/sssd/ticket/2874 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use get_next_domain instead of dom->nextMichal Židek2015-10-231-2/+2
| | | | | | | Recent get_next_domain refactoring enabled us to use it also for disabled domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Include disabled domains in link_forest_rootsMichal Židek2015-10-231-1/+1
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-231-3/+4
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: fix UPN lookups for sub-domain usersSumit Bose2015-10-081-1/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* fix ldb_search usageSumit Bose2015-10-081-8/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: add support for UPNPavel Březina2015-10-083-18/+162
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-211-2/+5
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: allow ghost members for LOCAL viewPavel Březina2015-09-181-16/+20
| | | | | | | | | | | LOCAL view does not allow the case when both ghost member and user override is created so it is safe to allow ghost members for this view. Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: fix two typos in debug messagesPavel Březina2015-09-181-2/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: do not require overrideDN in grous when LOCAL view is setPavel Březina2015-09-181-0/+6
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add function to expire entryMichal Židek2015-09-032-1/+78
| | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 Added function to expire entry in sysdb using its DN. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Index the objectSIDString attributeJakub Hrozek2015-08-193-1/+61
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SYSDB: prepare for LOCAL viewPavel Březina2015-07-272-1/+20
| | | | | | | | | | | | Objects doesn't have to have overrideDN specified when using LOCAL view. Since the view is not stored on the server we do not want to contact LDAP therefore we special case LOCAL view saying that it is OK that this attribute is missing. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Update few debug messagesLukas Slebodnik2015-07-171-3/+4
| | | | | | | | | It reduces a noise caused by canonicalization of non-existing user. Resolves: https://fedorahosted.org/sssd/ticket/2678 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Add functions to look up multiple entries including name and custom ↵Jakub Hrozek2015-07-152-19/+137
| | | | | | | | | | | | | | | | | | | filter Related: https://fedorahosted.org/sssd/ticket/2553 Adds new sysdb function: - sysdb_enumpwent_filter - sysdb_enumpwent_filter_with_views - sysdb_enumgrent_filter - sysdb_enumgrent_filter_with_views These are similar to enumeration functions, but optionally allow to specify a filter to be applied on user/group names. Also an additional custom filter can be applied. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Minor code improvementsPavel Reichl2015-07-061-1/+0
| | | | | | | | pam_helpers.h had to be included after util.h. Removed exara empty line. Fixed code alignment Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: new attribute lastOnlineAuthWithCurrentTokenPavel Reichl2015-07-061-0/+1
| | | | | | | | | | | | | | Introduce new user attribute lastOnlineAuthWithCurrentToken. This attribute behaves similarly to lastOnlineAuth but is set to NULL after password is changed. This attribute is needed for use-case when cached authentication is used, to request online authentication after password is locally changed. Resolves: https://fedorahosted.org/sssd/ticket/1807 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-022-2/+12
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sysdb: add sysdb_search_user_by_cert() and sysdb_search_object_by_cert()Sumit Bose2015-06-192-0/+49
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: add ldap_user_certificate optionSumit Bose2015-06-191-0/+1
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object]Pavel Březina2015-06-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2338 Example use: $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByName \ string:admin object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Store boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Remove boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Add a forest root attribute to sss_domain_infoJakub Hrozek2015-06-141-0/+66
| | | | | | | | Instead of complex forest root search methods, establish forest root during subdomain list update. The subdomain code can then just use the forest_root pointer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-142-2/+24
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL/SYSDB: Move new_subdomain() to sysdb_subdomains.c and make it privateJakub Hrozek2015-06-142-0/+150
| | | | | | | | | | | In order to make updating the subdomain list a two-step process. Therefore we need to make sure that update_subdomains() is the only interface towards the SSSD that changes the subdomain list. Move the new_subdomain() function to sysdb_subdomains.c and only make it available through a private header so it's usable by unit tests. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-142-5/+50
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Do not print verbose DEBUG messages from providers that don't set UUIDJakub Hrozek2015-06-041-1/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2666 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* 2FA offline authSumit Bose2015-05-081-2/+75
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_cache_password_ex()Sumit Bose2015-05-082-3/+31
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-11/+21
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: enhance ipa_initgr_get_overrides_send()Sumit Bose2015-05-051-0/+5
| | | | | | | | | This patch makes ipa_initgr_get_overrides_send() public and add support to search overrides by UUID or by SID. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 15:11:51 +0000