summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Removing of member link from groupSumit Bose2016-10-141-0/+9
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2940 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Initialize a boolean control valueJakub Hrozek2016-10-041-1/+6
| | | | | | | | | | | | | | | | | | | | | | | without this patch, valgrind was reporting: ==30955== Conditional jump or move depends on uninitialised value(s) ==30955== at 0xDBBACC3: ipa_subdomains_slave_search_done (ipa_subdomains.c:1111) ==30955== by 0xE73B34D: sdap_search_bases_ex_done (sdap_ops.c:222) ==30955== by 0xE6FFA98: sdap_get_generic_done (sdap_async.c:1872) ==30955== by 0xE6FF4E2: generic_ext_search_handler (sdap_async.c:1689) ==30955== by 0xE6FF840: sdap_get_and_parse_generic_done (sdap_async.c:1797) ==30955== by 0xE6FEFB5: sdap_get_generic_op_finished (sdap_async.c:1579) ==30955== by 0xE6FB1D2: sdap_process_message (sdap_async.c:353) ==30955== by 0xE6FAD51: sdap_process_result (sdap_async.c:197) ==30955== by 0xE6FAA14: sdap_ldap_next_result (sdap_async.c:145) ==30955== by 0x8E157FF: tevent_common_loop_timer_delay (tevent_timed.c:341) ==30955== by 0x8E16809: epoll_event_loop_once (tevent_epoll.c:911) ==30955== by 0x8E14F09: std_event_loop_once (tevent_standard.c:114) ==30955== Resolves: https://fedorahosted.org/sssd/ticket/3213 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Fixing FQ name of user in krb5_setup()Petr Čech2016-09-224-3/+36
| | | | | | | | | | This patch fixes creation of FQ username if krb5_map_user option ise used. Resolves: https://fedorahosted.org/sssd/ticket/3188 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: proceed normally when no new server is foundPavel Březina2016-09-221-4/+21
| | | | | | | | | | | | | | | Multiple failover requests come in same time, the first one will result in collapsing the meta server but multiple resolution of SRV records are triggered. The first one finishes normally but the others won't find any new server thus ends with an error. This patch makes failover to proceed normally even in such case. Resolves: https://fedorahosted.org/sssd/ticket/3131 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-217-9/+9
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Return partial results from adminlimit exceededJakub Hrozek2016-09-141-1/+2
| | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3185 Since commit c420ce830ac0b0b288a2a887ec2cfce5c748018c we try to move to the next server on any error on the connection, which in case there is only one server sends SSSD offline. It's more graceful to try to process the results, same as we already do with sizelimit exceeded. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-131-2/+20
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Fix settig paging attribute in sdap_get_generic_ext_sendLukas Slebodnik2016-09-131-3/+3
| | | | | | | | | We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Return ERR_NETWORK_IO on clock skewJakub Hrozek2016-09-131-0/+2
| | | | | | | | | | | Adds two more return codes to the list of codes we translate to ERR_NETWORK_IO. Resolves: https://fedorahosted.org/sssd/ticket/3174 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Send the output username, not internal fqname to krb5_childJakub Hrozek2016-09-084-11/+30
| | | | | | | | | | | | | | | | | | krb5_child calls krb5_kuserok() during the access phase which checks if a particular user is allowed to authenticate as a particular principal. We used to pass the internal fqname to krb5_kuserok() which broke the functionality and all users were denied access. This patch changes that to send the 'output' username to krb5_child, because that's the username the system receives through getpwnam() or getpwuid() anyway. The patch also adds a new structure member fo the krb5child_req structure to avoid reusing the pd->user variable but have an explicit one that serves as the input for the child process. Resolves: https://fedorahosted.org/sssd/ticket/3172 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_initgr_nested_get_membership_diff: use fully-qualified namesSumit Bose2016-09-011-1/+1
| | | | | | | | | | | | I think this is a leftover from the change to use fully-qualified names in sysdb. To verify this you can create a nested group in IPA. Without this patch the id command will only show the groups the user is a direct member of. With the patch the indirect groups memberships should be shown as well. https://fedorahosted.org/sssd/ticket/3163 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* dyndns: fix typo and unify ipa with ad debug message when offPavel Březina2016-08-302-2/+2
| | | | | Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Use right name in ldap filterLukas Slebodnik2016-08-301-3/+8
| | | | | | | | | | | | We used internal fq name in ldap filter with id_provider proxy to files and auth provider ldap [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com]. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PROXY: Share common code of save_{group,user}()Fabiano Fidêncio2016-08-271-80/+65
| | | | | | | | | | | | | | | These two functions (save_user() and save_group()) share, between themselves, the code preparing the attributes that are going to be stored in the sysdb. This patch basically splits this code out of those functions and introduces the new prepare_attrs_for_saving_ops(). Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Mention that save_user()'s parameters are already qualifiedFabiano Fidêncio2016-08-271-2/+3
| | | | | | | | | | Those comments are similar to what we have in the save_group() function. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_group()Fabiano Fidêncio2016-08-271-7/+5
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->group_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_user()Fabiano Fidêncio2016-08-271-7/+7
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->user_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove lowercase attribute from save_user()Fabiano Fidêncio2016-08-271-13/+9
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply check whether we will need a lowercase name by accessing domain->case_sensitive. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Parse qualified names when guessing AD user principalJakub Hrozek2016-08-261-2/+12
| | | | | | | | | | | | | | | | | | | Most AD users store their UPN in an attribute. If they don't, or the sssd was configured (typically in earlier versions to work around a bug) to not look at the principal attribute, then sssd is supposed to guess the attribute. That currently doesn't work in 1.14, because the username is already qualified and then we also append the realm name to it. We need to parse the simple username from the qualified name first. The issue can be reproduced simply by authenticating as the Administrator account in IPA-AD trust setups. Resolves: https://fedorahosted.org/sssd/ticket/3127 Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Fixing of removing netgroup from cachePetr Cech2016-08-241-0/+16
| | | | | | | | | | There were problem with local key which wasn't properly removed. This patch fixes it. Resolves: https://fedorahosted.org/sssd/ticket/2841 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Use the fqname when converting to lowercaseFabiano Fidêncio2016-08-241-1/+1
| | | | | | | | | | | | | | When saving the user there is a comparison between the "cased alias" and the "lowercase password name". However, the first doesn't use fully qualified name while the second does, resulting in a not expected override of the "nameAlias" attribute of a stored user when trying to authenticate more than once using an alias. Resolves: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap: Skip exact duplicates when extending mapsMichal Židek2016-08-191-10/+32
| | | | | | | | | | | | | | | | | | When extending map with entry that already exists in the map in the exacty same form, then there is no need to fail. We should only fail if we try to change purpose of already used sysdb attribute. Resolves: https://fedorahosted.org/sssd/ticket/3120 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Add log message for get account infoLukas Slebodnik2016-08-171-0/+5
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* LDAP: Log autofs rfc2307 config changes only with enabled responderLukas Slebodnik2016-08-171-1/+22
| | | | | | | | | | | grep -nE "0x0040" /var/log/sssd/sssd_example.com.log 361:(Tue Aug 16 13:04:04 2016) [sssd[be[example.com]]] [ldap_get_autofs_options] (0x0040): Your configuration uses the autofs provider with schema set to rfc2307 and default attribute mappings. The default map has changed in this release, please make sure the configuration matches the server attributes. Reviewed-by: Petr Čech <pcech@redhat.com>
* LDAP: Adding SIGCHLD callbackPetr Cech2016-08-171-6/+26
| | | | | | | | | | | | This patch adds SIGCHLD callback for ldap_child. So if timeout is reached and ldap_child is terminated by handler we have debug message about it. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Adding SIGTERM signal before SIGKILLPetr Cech2016-08-171-4/+36
| | | | | | | | | | | | | We add better termination of ldap_child. If ldap_child reaches the timeout for termination parent sents SIGTERM signal. Child has 2 seconds for removing temporary file and exit. If it is not sufficient there is SIGKILL send to the child. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Adding support for SIGTERM signalPetr Cech2016-08-171-0/+29
| | | | | | | | | | | We add support for handling SIGTERM signal. If ldap_child receives SIGTERM signal it removes temporary file. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD_PROVIDER: ad_enabled_domains - other then masterPetr Cech2016-08-171-3/+37
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains doesn't contain them. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: ad_enabled_domains - only masterPetr Cech2016-08-171-0/+16
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains contains only master domain. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: Initializing of ad_enabled_domainsPetr Cech2016-08-171-0/+82
| | | | | | | | | | We add ad_enabled_domains into ad_subdomains_ctx. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: Add ad_enabled_domains optionPetr Cech2016-08-172-0/+2
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Warn if IP address is used as option for ipa_server/ad_serverJustin Stephenson2016-08-162-0/+18
| | | | | | | | | GSSAPI is dependent on DNS with hostnames and we should warn about this. Resolves: https://fedorahosted.org/sssd/ticket/2789 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Remove old data provider interfacePavel Březina2016-08-165-237/+4
| | | | | | | | | Reverse data provider interface is moved to a better location in NSS responder. All responders now can have an sbus interface defined per data provider connection. The unused old data provider interface is removed. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Do not abuse data provider interfacePavel Březina2016-08-168-185/+284
| | | | | | | | We want to use custom interface for proxy provider so we do not abuse the data provider one. This way we gain more control over it and we can remove the old interface entirely. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sssctl: print active server and server listPavel Březina2016-08-168-10/+415
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3069 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: mark subdomain service with sd_ prefixPavel Březina2016-08-162-4/+18
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: add sbus_request_reply_error()Pavel Březina2016-08-161-8/+3
| | | | | | | | | | | | | This simplifies error handling in sbus requests since we avoid creating DBusError and checking for NULL manually. It removes few lines of code. This patch does not replace all calls to sbus_request_fail_and_finish since sometimes it is desirable to create the error manualy. But it replaces it in most recent places. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* gpo: gPCMachineExtensionNames with just whitespacesMichal Židek2016-08-111-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3114 We failed GPO procesing if the gPCMachineExtensionNames attribute contained just whitespaces. This coused failures in some server settings. Comment from Alexander Bokovoy quoting: You should use MS-GPOL spec. 2.2.4 'GPO Search' section says that when processing gPCMachineExtensionNames, "Group Policy processing terminates at the first <CSE GUIDn> out of sequence." Since ' ' (space only) does not fall into defined syntax for gPCMachineExtensionNames, this Group Policy processing is stopped and its CSE GUIDs are set to 'empty list'. Because of the 3.2.5.1.10 'Extension Protocol Sequences' language ------------------------------------------------------------------------ The Group Policy client MUST evaluate the subset of the abstract element Filtered GPO list separately for each Group Policy extension by including in the subset only those GPOs whose gPCUserExtensionNames (for user policy mode) or gPCMachineExtensionNames (for computer policy mode) attributes contain CSE GUID that correspond to the Group Policy extension. If the CSE GUID corresponding to the Group Policy extension is present in Extension List, it is invoked using the Implementation Identifier field. Applicability is determined as specified in section 3.2.1.5. The Group Policy Registry Extension MUST always execute first. All other applicable Group Policy extensions in the Extension List MUST be loaded and executed in Extension List order. A failure in any Group Policy extension sequence MUST NOT affect the execution of other Group Policy extensions. ------------------------------------------------------------------------- I think we can practically treat wrong content of gPCMachineExtensionNames (and gPCUserExtensionNames) as inability of the GPO to pass through the Filtered GPO list. Thus, the GPO would be ignored. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SIMPLE: Make the DP handlers testableJakub Hrozek2016-08-102-2/+46
| | | | | | | To make it possible to call the whole DP handler in the unit test, not just the evaluator part. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SIMPLE: Fail on any error parsing the access control listJakub Hrozek2016-08-101-1/+4
| | | | | | | | | | | Luckily this error was hidden by the fact that SSSD didn't start at all when an unparseable name was encountered after startup. Otherwise, this would have been a security issue. Nonetheless, we should just fail and deny access if we can't parse a name in a simple access list. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SIMPLE: Do not parse names on startupJakub Hrozek2016-08-101-7/+0
| | | | | | | | | | | It's not required to parse names on SSSD startup in the simple access provider. We can instead just parse the name when the access request is processed. Resolves: https://fedorahosted.org/sssd/ticket/3101 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Initialize D-Bus as soon as possiblePavel Březina2016-08-092-11/+23
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3111 Reviewed-by: Petr Cech <pcech@redhat.com>
* IPA: Check the return value of sss_parse_internal_fqnameJakub Hrozek2016-08-081-0/+8
| | | | | | We should fail the request if sss_parse_internal_fqname() fails. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Fixing wrong pam error code for passwdPetr Cech2016-08-081-0/+5
| | | | | | | This patch adds right pam error code for sssd offline state. Resolves: https://fedorahosted.org/sssd/ticket/3109
* LDAP: Fix Dereference after NULL checkLukas Slebodnik2016-08-081-1/+1
| | | | | | | | | | | The commit dc30c60f166ad9adc63a47a1013508a71624ac87 changed the logic in NULL check - if (protocol) { + if (protocol == NULL) { Found by Coverity: Reviewed-by: Petr Čech <pcech@redhat.com>
* SDAP: Don't log an op failure when no users are foundFabiano Fidêncio2016-08-051-3/+6
| | | | | | | | | | | | | | | When no users are found during the search users process, just log (at TRACEL_ALL level) that zero users were retrieve and avoid logging (at OP_FAILURE level) that a failure has occurred, which may end up misleading admins, giving them the impression that something wrong has happened. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Resolves: https://fedorahosted.org/sssd/ticket/3089 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PROVIDER: Conversion empty string from D-Bus to NULLPetr Cech2016-08-052-4/+4
| | | | | | | | | | This patch fixes the issue with empty string recieving from D-Bus. Data providers obtains NULL. So this is simple conversin. Resolves: https://fedorahosted.org/sssd/ticket/3084 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Revert "LDAP: Lookup services by all protocols unless a protocol is specified"Petr Cech2016-08-051-5/+2
| | | | | | This reverts commit aa58e216c1f794bd335151f19e79adbb3ddf4c73. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Changing of confusing debug messagePetr Cech2016-08-052-3/+6
| | | | | | | | | | | This debug message used to confuse our users. So this patch changes it. Old version: "Trust direction of %s is %s\n" New version: "Trust type of [%s]: %s\n" Resolves: https://fedorahosted.org/sssd/ticket/3090 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: sysdb_search_users does not set users_count for failuresLukas Slebodnik2016-08-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | ==32577== Conditional jump or move depends on uninitialised value(s) ==32577== at 0x140DCE10: sdap_process_missing_member_2307 (sdap_async_groups.c:1556) ==32577== by 0x140DCE10: sdap_process_group_members_2307 (sdap_async_groups.c:1625) ==32577== by 0x140DCE10: sdap_process_group_send (sdap_async_groups.c:1298) ==32577== by 0x140DCE10: sdap_get_groups_process (sdap_async_groups.c:2130) ==32577== by 0x140CFDA8: generic_ext_search_handler.isra.3 (sdap_async.c:1688) ==32577== by 0x140D2416: sdap_get_generic_op_finished (sdap_async.c:1578) ==32577== by 0x140D0DFC: sdap_process_message (sdap_async.c:353) ==32577== by 0x140D0DFC: sdap_process_result (sdap_async.c:197) ==32577== by 0x8BF1B4E: tevent_common_loop_timer_delay (tevent_timed.c:341) ==32577== by 0x8BF2B59: epoll_event_loop_once (tevent_epoll.c:911) ==32577== by 0x8BF1256: std_event_loop_once (tevent_standard.c:114) ==32577== by 0x8BED40C: _tevent_loop_once (tevent.c:533) ==32577== by 0x8BED5AA: tevent_common_loop_wait (tevent.c:637) ==32577== by 0x8BF11F6: std_event_loop_wait (tevent_standard.c:140) ==32577== by 0x529DD02: server_loop (server.c:702) ==32577== by 0x110951: main (data_provider_be.c:587) Resolves: https://fedorahosted.org/sssd/ticket/3121 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 15:59:23 +0000