summaryrefslogtreecommitdiffstats
path: root/src/db
Commit message (Collapse)AuthorAgeFilesLines
* IFP: expose user and group unique IDs through DBusThomas Equeter2016-09-221-0/+2
| | | | | | | | This adds a uniqueID property on User and Group InfoPipe objects. It has a useful value on AD- and IPA-backed domains. For Active Directory, this is the GUID. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Suppress warning from clang static analyserLukas Slebodnik2016-09-021-1/+1
| | | | | | | | | | | | scan-build wrongly assumes that output variable "version" is not initialized if function sysdb_cache_connect returns ERR_SYSDB_VERSION_TOO_OLD or ERR_SYSDB_VERSION_TOO_NEW The reality is that output variable "version" is initialized especially for these two case. Initialisation to NULL suppresses these false positive reports. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Removing of unused parameterPetr Čech2016-09-011-3/+1
| | | | | | | | | | | There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Fix error handling in sysdb_get_user_members_recursivelyLukas Slebodnik2016-08-312-1/+7
| | | | | | We ignored failures from sysdb_search_entry Reviewed-by: Petr Čech <pcech@redhat.com>
* SYSDB: Fix uninitialized scalar variableLukas Slebodnik2016-08-291-1/+1
| | | | | | | | | | The boolean variable newly_created could be used uninitialized in done section in case of failure. The variable was firstly initialized to true after succesfull execution of function sysdb_cache_create_empty. Uninitialized variable usually means true for boolean variable. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Remove the timestamp cache for a newly created cacheFabiano Fidêncio2016-08-261-22/+47
| | | | | | | | | | | | As many users are used to remove the persistent cache without removing the timestamp cache, let's throw away the timestamp cache in this case. Resolves: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Rework sysdb_cache_connect()Fabiano Fidêncio2016-08-261-19/+34
| | | | | | | | | | | | | | | | | | | As sysdb_cache_connect() has two very specific use cases (connect to the cache and connect to the timestamp cache) and each of those calls have a predetermined/fixed sets of values for a few parameters, let's try to make the code a bit simpler to follow by having explicit functions for connecting to the cache and connecting to the timestamp cache. Macros could be used as well, but I have a slightly preference for having two new functions instead of macros accessing internal parameters of the macro's parameter. Related: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Avoid optimisation with modifyTimestamp for usersLukas Slebodnik2016-08-101-19/+0
| | | | | | | | | | | | | | | The usage of modifyTimestamp needn't be a reliable way for detecting of changes in user entry in LDAP. The authorisation need to rely current data from LDAP and therefore we will temporary disable optimisation with modifyTimestamp and we will rather rely on deep comparison of attributes. In he future, it might be changed and responders might control the optimization level. Resolves: https://fedorahosted.org/sssd/ticket/3110 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the ↵Jakub Hrozek2016-08-051-10/+10
| | | | | | | | | | | | | current time sysdb is already able to retrieve the current timestamp if the caller doesn't specify it. However, for the timestamp cache this came too late and the timestamp cache used zero as the 'now' time. Resolves: https://fedorahosted.org/sssd/ticket/3064 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Sanitize dn in sysdb_get_user_members_recursivelyLukas Slebodnik2016-08-051-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | There was a crash in nss responder when a group contained a user with special charactes which shoudl be sanitized before using in filter. ==31651== Conditional jump or move depends on uninitialised value(s) ==31651== at 0x8BEA7DE: _talloc_steal_loc (talloc.c:1215) ==31651== by 0x5264889: sysdb_get_user_members_recursively (sysdb_ops.c:4759) ==31651== by 0x5278F61: sysdb_add_group_member_overrides (sysdb_views.c:1375) ==31651== by 0x526677C: sysdb_getgrnam_with_views (sysdb_search.c:799) ==31651== by 0x1172F6: nss_cmd_getgrnam_search (nsssrv_cmd.c:3168) ==31651== by 0x119C67: nss_cmd_getby_dp_callback (nsssrv_cmd.c:1382) ==31651== by 0x10FD14: nsssrv_dp_send_acct_req_done (nsssrv_cmd.c:916) ==31651== by 0x12898B: sss_dp_internal_get_done (responder_dp.c:791) ==31651== by 0x58FF861: complete_pending_call_and_unlock (dbus-connection.c:2314) ==31651== by 0x5902B50: dbus_connection_dispatch (dbus-connection.c:4580) ==31651== by 0x527F261: sbus_dispatch (sssd_dbus_connection.c:96) ==31651== by 0x89D8B4E: tevent_common_loop_timer_delay (tevent_timed.c:341) Resolves: https://fedorahosted.org/sssd/ticket/3121 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: add user email to fill_orig()Sumit Bose2016-07-291-0/+1
| | | | | | | The IPA server must send the email address of a user to the clients to allow login by email. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: include email in UPN searchesSumit Bose2016-07-292-3/+3
| | | | | | | | | | | Email addresses and Kerberos user principals names (UPNs) do not only look similar they also can be used to identify a user uniquely. In future this approach should be replace by a more generic one where the attributes which can uniquely identifies a user can be configured to support even a wider range of login names. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-291-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: properly override group member namesSumit Bose2016-07-293-119/+119
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2948 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_get_user_members_recursively()Sumit Bose2016-07-292-0/+66
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Removing of duplication of sysdb_ts_cache_attrsPetr Cech2016-07-261-3/+0
| | | | Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org>
* sysdb_master_domain_add_info: properly set do_updateSumit Bose2016-07-251-2/+2
| | | | | | | do_update should be only set if there is a change, i.e if something was added to the ldb_message. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Do not try to modify ts cache for unsupported DNsLukas Slebodnik2016-07-251-1/+6
| | | | | | | Only users and groups have timestamp data in separate cache. It caused false positive warnings for autofs, netgroup ... Reviewed-by: Petr Čech <pcech@redhat.com>
* sysdb: make subdomain calls aware of upn_suffixesSumit Bose2016-07-182-4/+55
| | | | | | | sysdb_subdomain_store() and sysdb_update_subdomains() can now update upn_suffixes as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add UPN suffix support for the master domainSumit Bose2016-07-182-3/+50
| | | | | | | sysdb_master_domain_update() and sysdb_master_domain_add_info() are now aware of the UPN suffix attribute. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: allow override added for non-default views at runtimeSumit Bose2016-07-121-8/+18
| | | | | | | | | | | | | | Currently a new override for a non-default view cannot be displayed at run-time. It even does not only require a restart but the view must be un-applied and applied again to make the changes visible. This patch fixes this and makes non-default view behave like the default view where the data from a newly added override are displayed after the cached entry of the related object is expired. Resolves https://fedorahosted.org/sssd/ticket/3092 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Fixing DB updatePetr Cech2016-07-111-3/+19
| | | | | | | | | | | | | | Functions sysdb_user_base_dn() and sysdb_group_base_dn() expect that struct sss_domain_info contains pointer to struct sysdb_ctx. This is not true in case of sysdb_upgrade functions. This patch fixes the situation and revert code to the state before 12a000c8c7c07259e438fb1e992134bdd07d9a30 commit. Resolves: https://fedorahosted.org/sssd/ticket/3023 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sudo: solve problems with fully qualified namesPavel Březina2016-07-072-67/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | sudo expects the same name in sudo rule as login name. Therefore if fully qualified name is used or even enforced by setting use_fully_qualified_names to true or by forcing default domain with default_domain_suffix sssd is able to correctly return the rules but sudo can't match the user with contect of sudoUser attribute since it is not qualified. This patch changes the rules on the fly to avoid using names at all. We do this in two steps: 1. We fetch all rules that match current user name, id or groups and replace sudoUser attribute with sudoUser: #uid. 2. We fetch complementry rules that contain netgroups since it is expected we don't have infromation about existing netgroups in cache, sudo still needs to evaluate it for us if needed. This patch also remove test for sysdb_get_sudo_filter since it wasn't sufficient anyway and I did not rewrite it since I don't thing it is a good thing to have filter tests that depends on exact filter order. Resolves: https://fedorahosted.org/sssd/ticket/2919 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: qualify_attr: create new attribute only onceSumit Bose2016-07-071-3/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Upgrade sysdb to use qualified names for users and groups, sudo rules ↵Jakub Hrozek2016-07-074-3/+603
| | | | | | | | | | and override objects Runs a sysdb upgrade that changes objects that represent users, groups, sudo rules and overrides to the new schema, which uses the fully qualified names. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Remove the timestamps cache on updateJakub Hrozek2016-07-071-3/+30
| | | | | | | | | | | When the cache is upgraded, we want to avoid upgrading the timestamps cache, because it was only introduced recently in Beta, so it doesn't make senes to write complex code to change the format. This patch rather removes the cache during upgrade, it will be recreated with later lookups anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Fix small issues during db upgradeJakub Hrozek2016-07-071-1/+3
| | | | | | | | | | | | | | | | | | This patch fixes several issues introduced during the recent sysdb upgrade: 1) The upgrade code often accesses sysdb->ldb, but at this point, the ldb pointer might not be initialized yet. As a kind of an ugly, yet functional workaround, we pass in the ldb pointer that we received from the caller as part of the sysdb structure. 2) the version that sysdb_domain_cache_upgrade() returns is not a talloc pointer, so the upgrade was crashing when we tried to steal it. 3) the ldb pointer sysdb_cache_connect() returns was kept allocated on the tmp_ctx. We need to steal it instead. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Allow passing a context to sysdb upgrade functionsJakub Hrozek2016-07-073-20/+47
| | | | | | | | | We decide on whether to upgrade or not based on a pointer value, not a boolean. This pointer points to a structure that the upgrade invoker (typically the monitor) can use to fill auxilary data the sysdb upgrade has no means of instantiating. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Remove useless parameter from sysdb_init()Jakub Hrozek2016-07-072-5/+3
| | | | | | | The function sysdb_init() is never used to allow upgrade, so the allow_upgrade parameter was pointless. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Construct internal fqnames, not NSS names in ↵Jakub Hrozek2016-07-071-7/+7
| | | | | | | | | | sysdb_add_group_member_overrides Because all users and groups are stored the same way in sysdb, we can avoid parsing and unparsing the name with NSS functions and instead just grab the name from the FQDN in the cache. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add a utility function to return a list of qualified namesJakub Hrozek2016-07-072-9/+44
| | | | | | | | Adds a utility function the LDAP provider can use. This is different from sss_create_internal_fqname_list in the sense that the LDAP provider passes in the attribute name that contains the name attribute value. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: add_name_and_aliases_for_name_override no longer needs to special ↵Jakub Hrozek2016-07-071-40/+5
| | | | | | | | | | case subdomain users All user and group names use the same unified format in the cache, so there's no need to special-case subdomains and create different names for the main domain and a subdomain. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search functions don't need to construct per-domain namesMichal Zidek2016-07-071-30/+3
| | | | | | | All user and group names are standardized to be fully qualified, so there's no need to provide per-domain names anymore. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: convert sysdb_group_membership_mod to operate on qualified namesMichal Zidek2016-07-071-2/+22
| | | | | | | This patch infers the member domain from the FQDN to allow the function to add group members from different domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use ldb_result as output in sysdb_search_ts_{users,groups}Lukas Slebodnik2016-07-063-16/+42
| | | | | | | | | | | | | Passing address of unsigned to the output argument size_t causes access out of boundaries for type unsigned and and wrong data on big endian. It looks like functions sysdb_search_ts_{users,groups} need to store results in structure ldb_result anyway for further processing. Therefore it will be better to convert output arguments size_t* + ldb_message*** into structure ldb_result and avoid using additional helper variable with type size_t before each invocation of these functions. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Only update user attributes if neededJakub Hrozek2016-06-231-0/+35
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2602 Uses the same logic as previously used for updating group entries to only update user attributes if the group entry actually changed. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Refactor sysdb_store_userJakub Hrozek2016-06-231-64/+136
| | | | | | | Splits sysdb_store_user internals to two functions because the original function either creates a new user or updates an existing one. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Check if group attributes differ before saving a groupJakub Hrozek2016-06-233-7/+139
| | | | | | | | | | | Adds a new function sysdb_entry_attrs_diff() used in group saving code. This function is used to check if the result of updating a group would result in actually changing the sysdb entry -- often, we would try to dump the same data to the cache during update. If that's the case, the update code now only updates the timestamp cache, avoiding costly writes. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: If modifyTimestamp is the same, only update the TS cacheJakub Hrozek2016-06-235-36/+670
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2602 If the entry being saved contains the original modifyTimestamp attribute and the modifyTimestamp attribute is the same as the one we already saved to the timestamp cache, only the expire timestamps in the asynchronous timestamp cache will be bumped and the sysdb code will avoid writes to the main cache completely. If the modifyTimestamp is either missing or differs, we assume the entry had changed and do a full write to the main cache. Also amends the generic sysdb_set_attrs* and similar functions that their results is also reflected in the timestamps cache. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search the timestamp caches in addition to the sysdb cacheJakub Hrozek2016-06-235-32/+640
| | | | | | | | | | | | | | | When a sysdb entry is searched, the sysdb cache is consulted first for users or groups. If an entry is found in the sysdb cache, the attributes from the timestamp cache are merged to return the full and up-to-date set of attributes. The merging is done with a single BASE search which is a direct lookup into the underlying key-value database, so it should be relatively fast. More complex merging is done only for enumeration by filter which is currently done only via the IFP back end and should be quite infrequent, so I hope we can justify a more complex merging there. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Wrap sysdb_store_group in a transaction and split it into smaller ↵Jakub Hrozek2016-06-231-42/+107
| | | | | | | | | | | | | | functions sysdb_store_group can do several things -- add, rename or update a group. It's important they are all done in a single transaction (even though the caller should typically start a transaction of his own). Also split the sysdb_store_group function into two, one that only stores a new group and one that changes attributes of an existing group to keep the flow easy and avoid two labels in a single function. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Open a timestamps cache for caching domainsJakub Hrozek2016-06-234-17/+82
| | | | | | | | | | | For all domain types, except the local domain, open a connection to a new ldb file located at /var/lib/sss/db names timestamps_$domain.ldb. Constructs the ldb file path manually in sysdb_check_upgrade_02() but that should be acceptable because nobody should be running such an old cache these days anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add a second, timestamp-only ldb cacheJakub Hrozek2016-06-232-0/+158
| | | | | | | | | | | | | | | | | Uses the generic functions in sysdb_init.c to open a new ldb database. The path to the database and the ldb context are stored in the sysdb_ctx. The database will be used to store ephemeral attributes such as timestamps. Because these attributes are not required for SSSD operation and the intent is for writes to this cache to be very fast, the database is opened with LDB_FLG_NOSYNC flag. At the same time, none of the attributes of the cache is required for sssd operation, so if we fail to open the database, we just start over. Adds a separate base LDIF with attributes that are supposed to be indexed in the timestamp database as well as a separate timestamp cache version. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Refactor database connectionJakub Hrozek2016-06-233-183/+342
| | | | | | | | | | | | | | | | | | | | | Changes the functions in sysdb_init.c so that the functions are usable to initialize a second cache to store timestamps. In particular, functions that operated on sysdb->ldb now operate on a generic ldb context so that a new ldb_ts context can be used later. Existing functions that initialize the sysdb cache call the generic functions with sysdb->ldb as a parameter. Splits out a function to initialize an empty ldb database with a generic LDIF. Splits out the sysdb upgrade function because the upgrade will only be used by the sysdb cache, the timestamp cache will start with a different version and might receive separate upgrade functions in the future. The ldb connection function accepts ldb flags parameter, currently unused. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add error codes for sysdb too old or too newJakub Hrozek2016-06-232-6/+6
| | | | | | | We used really strange errno codes for detecting whether the database is too old or too new. We should use our sssd-specific error coded instead. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Move sysdb initialization into a new module sysdb_init.cJakub Hrozek2016-06-232-526/+553
| | | | | | | | | | | The sysdb initialization was in the sysdb.c module. With adding initialization of the timestamp cache, this module would become too big with too many private functions meant only for initialization. This patch only moves code around, there are no functional changes to the initialization. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add systemtap probes to track sysdb transactionsJakub Hrozek2016-06-101-0/+8
| | | | | | | | | | | | | | | | | | | Actually adds marks for sysdb transactions that receive the transaction nesting level as an argument. The nesting is passed on from probes to marks along with a human-friendly description. The transaction commit is decorated with two probes, before and after. This would allow the caller to distinguish between the time we spend in the transaction (which might be important, because if a transaction is active on an ldb context, even the readers are blocked before the transaction completes) and the time we spend commiting the transaction (which is important because that's when the disk writes occur) The probes would be installed into /usr/share/systemtap/tapset on RHEL and Fedora. This is in line with systemtap's paths which are described in detail in "man 7 stappaths". Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Track transaction nesting in sysdb_ctxJakub Hrozek2016-06-102-3/+10
| | | | | | | | | Adds an integer that tracks how deeply nested we are in sysdb transactions. This will become useful later, because generally we are only interested in level-0 transactions when probing, so we'll want to pass the transaction nesting to the systemtap probes. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_override: add certificate supportSumit Bose2016-06-091-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 08:11:24 +0000