summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
...
* NSS: UPN as a template expansion for homedir mappingsPavel Reichl2014-10-121-0/+3
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2340 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: Check return value of function hash_entriesLukas Slebodnik2014-10-121-0/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-091-1/+1
| | | | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam: sub-domain authentication fixSumit Bose2014-10-011-1/+11
| | | | | | | | | | With a recent patch sysdb_getpwnam() was replaced by sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave differently with respect to sub-domain users. As a consequence the PAM responder was not able to resolve users from sub-domains. This patch reverts this change and uses sysdb_getpwnam() again. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-291-1/+50
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-293-3/+178
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Suppress 'git diff' noiseMichal Zidek2014-09-081-159/+159
| | | | | | | | | | | | This patch suppresses the 'git diff' noise after ifp_iface_generated.c is generated. It simply changes the file to the same form it is being automatically generated so that 'git diff' only shows changes in the code and not the differently generated ifp_iface_generated.c file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-051-1/+2
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-013-23/+167
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-013-10/+12
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
* PAM: remove ldb_result member from pam_auth_req contextSumit Bose2014-09-012-6/+6
| | | | | This member was used only in a single call where a local variable suits better.
* PAM: extract checks from parsing routinesSumit Bose2014-09-011-34/+18
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* SUDO: Use the override_space optionJakub Hrozek2014-08-132-2/+8
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 With this path, a user whose name is "space user" would match a sudo rule while using the override_default_space option. Please note that the option is only a client-side override, so the sudoUser attribute must contain the space in order to match the original name. In other words, when substituting space ( ) for underscore (_), this attribute would match: sudoUser: space user this would not: sudoUser: space_user Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Use the override_space optionJakub Hrozek2014-08-131-2/+51
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 The input of the InfoPipe responder substitutes the configured character for space and the GetUserAttrs and GetUserGroups functions substitute space for the configured character in their output. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Use the override_space optionJakub Hrozek2014-08-131-0/+8
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 When using the override_default_space option, this patch allows to log in using both the original name (space user) as well as the normalized name (space_user). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Make the space override responder-agnosticJakub Hrozek2014-08-135-13/+34
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 In order to make the override_space option usable by other responders, we need to move the override_space option to the generic responder structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Only replace space with the specified substitutionJakub Hrozek2014-08-133-24/+19
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 - make sss_replace_whitespaces only replace space (' ') not any whitespace - make sss_replace_whitespaces only replace a single char, not the whole string - rename CONFDB_NSS_OVERRIDE_DEFAULT_WHITESPACE to CONFDB_NSS_OVERRIDE_DEFAULT_SPACE - rename the override_default_whitespace option to override_space - rename sss_replace_whitespaces() to sss_replace_space() - rename sss_reverse_replace_whitespaces() to sss_reverse_replace_space() - rename nctx->override_default_wsp_str to nctx->override_space - make the return value of sss_replace_space non-const to avoid freeing the result without compilation warnings Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Ignore default_domain for netgroupsJakub Hrozek2014-08-121-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2400 Netgroups often have members that will not process correctly when we require a fully-qualified name. This patch simply ignores the default_domain setting for netgroup lookups - we ignore FQDN only domains for netgroup lookups since 1933ff17513da1d979dd22776a03478341ef5e6b anyway. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix lookups with fully-qualified namesJakub Hrozek2014-08-111-2/+2
| | | | | | | | | | | | | The Data Provider lookup code user the original input string as the lookup key instead of the parsed name component. For example, for an input joe@mydomain, the backend would have searched for: (&(cn=joe@mydomain)(objectclass=user)) This patch fixes the lookup to use the parsed name. https://fedorahosted.org/sssd/ticket/2402 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* case_sensitivity = preservingMichal Zidek2014-07-291-2/+2
| | | | | | | | | | | If case_sensitivity is set to 'preserving', getXXnam returns name attribute in the same format as stored in LDAP. Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Replace spaces with specified string in names.Lukas Slebodnik2014-07-283-1/+67
| | | | | | | | | | | | This patch add possibility to replace whitespace in user and group names with a specified string. With string "-", sssd will return the same result as winbind enabled option "winbind normalize names" Resolves: https://fedorahosted.org/sssd/ticket/1854 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* sudo: use dbus array for rules refreshPavel Březina2014-07-241-1/+15
| | | | | | | | | | D-Bus only supports 255 signatures which caused a segmentation fault when sudo responder tried to refresh more rules at once. Resolves: https://fedorahosted.org/sssd/ticket/2387 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-151-0/+1
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: touch config when changing debug level temporarilyPavel Březina2014-07-091-0/+13
| | | | | | | If we want the debug level to switch back to the value from configuration file we need to touch sssd.conf so it is reloaded. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* BUILD: Add the DBus service activationJakub Hrozek2014-07-081-0/+4
| | | | | | | | The system bus has the ability to start services on demant. This patch adds the sysbus service activation file that, currently, only calls the sss_signal tool to signal the monitor. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Provide a SBUS method to reconnect to sysbusJakub Hrozek2014-07-087-1/+44
| | | | | | | | | Introduces a new method implemented only by the IFP responder. When this method is received, the responder attempts to reconnect to the system bus, if not connected already. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Return a specific value on failure connecting to the system busJakub Hrozek2014-07-081-2/+6
| | | | | | | | We need to treat the failure to connect to the system bus as non-fatal. In this commit, we introduce a special error code and only print a DEBUG message when this error code is returned from the startup function. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix DEBUG messagesJakub Hrozek2014-07-081-7/+9
| | | | | | | The DEBUG messages in the IFP responder predated Nikolai's mass-patches and were not converted correctly. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sudo: return after tevent_req_errorPavel Reichl2014-06-271-0/+1
| | | | | | Don't call tevent_req_done after tevent_req_error (for the same request). Reviewed-by: Sumit Bose <sbose@redhat.com>
* NSS: lookup_netgr_step don't access result on ENOENTPavel Reichl2014-06-251-13/+11
| | | | | | | Don't access result if return value is not EOK. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: minor code style improvementsPavel Reichl2014-06-191-7/+9
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: fix memory leak in sysdb_getnetgrPavel Reichl2014-06-191-10/+19
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: sysdb_getnetgr refactorPavel Reichl2014-06-191-20/+46
| | | | | | Move functionality for creating cache dummies into separate function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: sysdb_getnetgr check return value firstPavel Reichl2014-06-191-5/+7
| | | | | | Output parameter was accessed before return value was checked. Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-024-2/+17
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-022-13/+27
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* IFP: Implement SSSD componentsPavel Březina2014-05-287-1/+1604
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Implement domain gettersPavel Březina2014-05-286-0/+859
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Add ListDomains and FindDomainByNameJakub Hrozek2014-05-286-0/+342
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SBUS: Implement org.freedesktop.DBus.Properties.GetAll for primitive typesJakub Hrozek2014-05-271-1/+28
| | | | | | | | | | | | This patch implements the GetAll method of the org.freedesktop.DBus.Properties interface by iterating over the available getters and putting all the results into a single getter. The patch includes a unit test that exercies all currently supported array types. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Support multiple interfaces on sysbusJakub Hrozek2014-05-231-18/+29
| | | | | | | | Instead of passing just one interface with the functions, we need to support multiple interfaces for the InfoPipe and export them all on the sysbus. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Allow Set, Get and GetAll from DBus.PropertiesJakub Hrozek2014-05-221-0/+10
| | | | | | | | | | | | The InfoPipe will support all three of: DBus.Properties.Get DBus.Properties.GetAll DBus.Properties.Set Hence it must allow these calls to be received. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add a utility function to reply with an object pathPavel Březina2014-05-222-0/+48
| | | | | Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add utility functions to escape and unescape object pathsJakub Hrozek2014-05-222-1/+134
| | | | | | | | | | | | D-Bus spec says: Each element must only contain the ASCII characters "[A-Z][a-z][0-9]_" This patch adds two utility functions to escape raw input into format suitable for DBus and conversely transform escaped paths back into raw paths. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove unused parameter from ifp_user_get_groups_replyLukas Slebodnik2014-05-201-4/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove unused parameter from ifp_user_get_attr_handle_replyLukas Slebodnik2014-05-201-4/+4
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Add a GetGroupsList methodJakub Hrozek2014-05-146-14/+225
| | | | | | | | | | | | | This patch adds a new method on the bus with the following synopsis: <method name="GetUserGroups"> <arg name="user" type="s" direction="in" /> <arg name="values" type="as" direction="out"/> </method> Its purpose is to return names of groups the user is a member of as a list of strings. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Per-attribute ACL for usersJakub Hrozek2014-05-134-2/+194
| | | | | | | | | | | Introduces a new option called user_attributes that allows to specify which user attributes are allowed to be queried from the IFP responder. By default only the default POSIX set is allowed, this option allows to either add other attributes (+attrname) or remove them from the default set (-attrname). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 05:06:04 +0000