summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* tcurl test: add support for tls settingsPavel Březina2017-03-301-0/+19
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: add support for raw outputPavel Březina2017-03-301-0/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: refactor so new options can be added more easilyPavel Březina2017-03-301-125/+209
| | | | | | | Just to make the tool a little bit nicer and more flexible. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for ssl and raw outputPavel Březina2017-03-305-375/+672
| | | | | | | | | | | | | | At first, this patch separates curl_easy handle from the multi-handle processing and makes it encapsulated in custom tcurl_request structure. This allows us to separate protocol initialization from its asynchonous logic which gives us the ability to set different options for each request without over-extending the parameter list. In this patch we implement options for peer verification for TLS-enabled protocols and to return response with body and headers together. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Fix off-by-one error in secrets key parsingJakub Hrozek2017-03-302-17/+101
| | | | | | | | | | | | | | | When parsing the secrets key, the code tried to protect against malformed keys or keys that are too short, but it did an error - the UUID stringified form is 36 bytes long, so the UUID_STR_SIZE is 37 because UUID_STR_SIZE accounts for the null terminator. But the code, that was trying to assert that there are two characters after the UUID string (separator and at least a single character for the name) didn't take the NULL terminator (which strlen() doesn't return) into account and ended up rejecting all ccaches whose name is only a single character. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccacheJakub Hrozek2017-03-306-22/+99
| | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 The following changes were done to the Kerberos authentication code in order to support authentication in a non-POSIX environment: - delayed authentication is disabled in non-POSIX domains - when a user logs in in a non-POSIX domain, SSSD uses a MEMORY:$username ccache and destroys is then krb5_child finishes so that just the numeric result is used - krb5_child doesn't drop privileges in this configuration because there is nothing to drop privileges to Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Relax search filters in application domainsJakub Hrozek2017-03-303-13/+66
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a request comes towards an application domain, we can drop the part of the filter that asserts that the object has a valid UID/GID. Instead, we just search by name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: save non-POSIX users in application domainsJakub Hrozek2017-03-301-15/+57
| | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a user being saved by the LDAP provider does not have a UID or GID and the domain type is application, we save the user entry as non-POSIX. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Only generate new UID in local domainJakub Hrozek2017-03-301-0/+6
| | | | | | | | | | To avoid issues where a user with no UID but without the posix=false flag was passed to sysdb, we only allow generating the new ID in the local domain. This might prevent bugs where non-POSIX users would get a UID created by sysdb which might allow accessing resources owned by that UID. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Allow storing non-POSIX usersJakub Hrozek2017-03-302-9/+79
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 We already do the same for groups. If the user does not have UID number set but does have the POSIX: false attribute set, then we save the user with zero UID and the non-POSIX flag. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-309-6/+241
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Remove unneeded memory contextJakub Hrozek2017-03-301-4/+4
| | | | | | | | | Since we only store data into pam_ctx in get_public_domains(), it doesn't make sense to allow passing a separate memory context. It is always going to be pam_ctx, otherwise the memory hierarchy will cause issues anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: ListByName: Don't crash when no results are foundJakub Hrozek2017-03-301-7/+9
| | | | | | | | | | | If no results were found using the List command, the results variable was undefined which resulted in a crash. Instead, only copy the results of the cache_req lookup returns EOK and we can presume that the results are valid. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: Search both POSIX and non-POSIX domainsJakub Hrozek2017-03-303-105/+194
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Changes the behaviour of the InfoPipe responder so that both application and POSIX domains are searched. In general, the IFP responder uses the CACHE_REQ_ANY_DOM lookup type because we can't presume the intention of the caller. Therefore, deployments that combine both POSIX and non-POSIX domains must use fully qualified names or select the right domain order manually. There is one change between the POSIX and non-POSIX users or groups - the object path. For the POSIX users, the object path includes the UID or GID. Because we don't have that for the non-POSIX objects, the object name is used in the path instead. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Domain type selection in cache_reqJakub Hrozek2017-03-3029-47/+246
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new enumeration cache_req_dom_type. It is a tri-state that allows the caller to select which domains can be contacted - either only POSIX, only application domains or any type. Not all plugins of cache_req have the new parameter added -- only those that are usable/useful in a non-POSIX environment. For example, it makes no sense to allow the selection for calls by ID because those are inherently POSIX-specific. Also, services or netgroups are supported only coming from POSIX domains. At the moment, the patch should not change any behaviour as all calls default to contacting POSIX domains only. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Allow configuring [application] sections as non-POSIX domainsJakub Hrozek2017-03-305-18/+368
| | | | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Allows to add a new section: [application/$name] This section internally (on the confdb level) expands to: [domain/$name] domain_type = application The reasons to add this new section is two-fold. One, to make the configuration of application domains more explicit and two, to make it possible to share configuration between two domains, one POSIX and one non-POSIX by application domain's inherit_from option: [application/$name] inherit_from = posix_domain_name Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Introduce SSSD domain type to distinguish POSIX and application domainsJakub Hrozek2017-03-309-1/+85
| | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new option that allows to distinguish domains that do contain POSIX users and groups and those that don't. The POSIX domains are the default. The non-POSIX domains are selected by selecting an "application" type domain. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: enable AD user lookup by certificateSumit Bose2017-03-291-0/+1
| | | | | | | | | Without this the lookup by certificate for AD users on an IPA client will just error out. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: lookup AD users by certificates on IPA clientsSumit Bose2017-03-291-4/+105
| | | | | | | | | | Get a list of users mapped to a certificate back from the IPA server, look them up and store them together with the certificate used for the search as mapped attribute to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: add mapped attributes to user from trusted domainsSumit Bose2017-03-291-9/+24
| | | | | | | | | Allow the usage of the mapped attribute for the lookup of AD users on IPA clients as already used for the normal LDAP lookup. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: return to responder that pkinit is not availableSumit Bose2017-03-291-4/+13
| | | | | | | | | | | If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh: add support for certificates from non-default viewsSumit Bose2017-03-291-1/+19
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ssh: handle binary keys correctlySumit Bose2017-03-291-1/+7
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3332 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add domain_resolution_order config optionFabiano Fidêncio2017-03-298-1/+58
| | | | | | | | | | | | | | | | | | | | | | | | | This is the local equivalent of option of ipaDomainResolutionOrder and has precedence over the ones set on IPA side making the precedence order to be like: Local > View > Globally. As done for the IPA side configurations, the domains which were not explicitly set up will be apennded to the final of the domain_resolution_order list in the very same order they're presented in the "domains" option of [sssd] section in the config file. There's no guarantee of order for the subdomains though. It's also important to mention that no expansion magic is performed on our side. It means that if 'example.com' is set it does *not* stand for all its subdomains DNS wise (like 'foo.example.com', 'bar.example.com', etc). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Expose replace_char() as sss_replace_char()Fabiano Fidêncio2017-03-292-6/+11
| | | | | | | | | | | | | | | This method is going to be used in the follow-up patch for replacing ',' by ':' so we can keep the domain resolution order option consitent with the way it's set on IPA side and still keep consistent with the way lists are represented on sssd.conf file. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Make use of domainResolutionOrderFabiano Fidêncio2017-03-2911-37/+457
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | domainResolutionOrder has been introduced in the previous commits and allows the admin to set up a specific order which the domains will be resolved during a lookup and with this patch we can take advantage of this. In order to have it working a new structure has been added (struct domain_resolution_order) to the responder context and will be used by the cache_req to perform the lookups based on this list. As the ipaDomainResolutionOrder may be set globally on IPA or per View, SSSD does respect the following precedence order: View > Globally. The way the list is built is quite simple, basically having the domains present on ipaDomainResolutionOrder as the first domains (in that specific order) and then appending the remaining domains to this list. The final result is a completely flat list with all the domains respecting the specified order (it's important to remember that the domains not specified won't follow any specific order, they're just "random" based on the domains list present in the responder context. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DLINKLIST: Add DLIST_FOR_EACH_SAFE macroFabiano Fidêncio2017-03-291-0/+5
| | | | | | | | | | | This macro, as DLIST_FOR_EACH, iterates over the whole list. The main difference between both is that in the _SAFE version the pointer to the next list node is stored, allowing us to delete the current node safely. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from IPA ID ViewFabiano Fidêncio2017-03-293-0/+257
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA_SUBDOMAINS: Rename _refresh_view() to _refresh_view_name()Fabiano Fidêncio2017-03-291-3/+4
| | | | | | | | | | | | | This method got renamed in order to match better with what it does currently. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from ipaConfigFabiano Fidêncio2017-03-293-12/+234
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB/TESTS: Add tests for the domain's resolution order methodsFabiano Fidêncio2017-03-292-0/+206
| | | | | | | | | | | | | | Introduce a new and small set of tests for these new helper methods that are going to be used in different parts of the code in the follow-up patches. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Add methods to deal with the domain's resolution orderFabiano Fidêncio2017-03-294-0/+210
| | | | | | | | | | | | | | | | | | | | In the following-up patches those newly introduced methods will be used to deal with the domainResolutionOrder attribute. The sysdb_update_domain_resolution_order() method is purposely not checking whether a value has changed or not before writing to sysdb and while may not be optimal, the readability of the code has increased a lot by keeping it as simple as possible. Tests for these new methods are part of the next commit. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Include searches for non-fqnames members of a subdomainFabiano Fidêncio2017-03-291-37/+213
| | | | | | | | | | | | | Let's extend the NSS tests in order to also test looking up users, from a subdomain, by their short names (non fully qualified names). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Improve setup/teardown for subdomains testsFabiano Fidêncio2017-03-291-32/+150
| | | | | | | | | | | | | | This patch basically makes the getgrnam_members_subdom(), getgrnam_mix_dom(), getgrnam_mix_dom_fqdn() and getgrnam_mix_subdom() more independent of each other. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Fix subdomains attributionPavel Březina2017-03-291-1/+1
| | | | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Descend into subdomains on lookupsFabiano Fidêncio2017-03-2910-10/+10
| | | | | | | | | | | | | | | | | | | | | Let's make all plugins, but the "host_by_name", to descend into the subdomains on lookups. This patch basically prepares the field for the coming up patches that will allow group/user resolution in all domains (or a subset of the domains) to be possible by only using the short names without the domain component. The "host_by_name" plugin was not changed as it's a specific IPA plugin and won't find anything on its subdomains. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-2914-40/+107
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Introduce subdomain_create_conf_path()Michal Židek2017-03-296-17/+20
| | | | | | | | | | This is a utility function that replaces the create_subdom_conf_path(). Differently than the latter, it only takes one parameter and is going to be used in a few different places (thus adding it to util.h). Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* intg: Remove bashism from intgcheck-prepareLukas Slebodnik2017-03-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | env variable UID is not defined in all shells (eg. dash) We also need to move invocation of "id -u" before nss_wraper is enabled otherwise we would get root instead of real user. =================================== FAILURES =================================== ________________________ test_kcm_mem_init_list_destroy ________________________ Traceback (most recent call last): File "/home/build/sssd/src/tests/intg/test_kcm.py", line 198, in test_kcm_mem_init_list_destroy kcm_init_list_destroy(testenv) File "/home/build/sssd/src/tests/intg/test_kcm.py", line 183, in kcm_init_list_destroy exp_ccname = testenv.ccname() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 45, in ccname my_uid = self.my_uid() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 41, in my_uid return int(s_myuid) ValueError: invalid literal for int() with base 10: '' And we already use different approach in top level Makefile.am 3488) $(INTGCHECK_CONFIGURE_FLAGS) \ 3489) CFLAGS="$$CFLAGS $(AM_CFLAGS) -DKCM_PEER_UID=$$(id -u)"; \ 3490) $(MAKE) $(AM_MAKEFLAGS) ; \ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: fix configure failure with strict cflagsLukas Slebodnik2017-03-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The warning -Wstrict-prototypes is a part of AM_CFLAGS which was appended for CFLAGS in make target intgcheck-prepare. And combination with strict CFLAGS in environment variable (e.g. -Werror) caused failures. sh$ CFLAGS="-Werror" make intgcheck-prepare checking for gcc... gcc checking whether the C compiler works... no configure: error: in `/home/build/sssd/ci-build-debug/intg/bld': configure: error: C compiler cannot create executables configure:3719: checking whether the C compiler works configure:3741: gcc -g3 -O2 -Werror -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wundef -Werror-implicit-function-declaration -Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99 -DKCM_PEER_UID=1000 conftest.c >&5 conftest.c:11:1: error: function declaration isn't a prototype [-Werror=strict-prototypes] main () ^~~~ cc1: all warnings being treated as errors Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFIGURE: Fix fallback if pkg-config for uuid is missingLukas Slebodnik2017-03-281-1/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SSSDConfig: Python 3.6 invalid escape sequence deprecation fixVille Skyttä2017-03-271-1/+1
| | | | | | | | https://docs.python.org/3/whatsnew/3.6.html#deprecated-python-behavior Merges: https://pagure.io/SSSD/sssd/pull-request/3346 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Idle-terminate the responder if the secrets back end is usedJakub Hrozek2017-03-272-0/+10
| | | | | | | | | Existing with memory database would be fatal as we keep the ccaches in memory then, but if the ccaches are stored in sssd-secrets, we can just exit on idle. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Queue requests by the same UIDJakub Hrozek2017-03-278-6/+716
| | | | | | | | | In order to avoid race conditions, we queue requests towards the KCM responder coming from the same client UID. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Make the secrets ccache back end configurable, make secrets the defaultJakub Hrozek2017-03-277-11/+56
| | | | | | | | | Adds a new option 'ccache_storage' that allows to select either the memory back end or the secrets back end. The secrets back end is the default one and this option is even undocumented. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Store ccaches in secretsJakub Hrozek2017-03-279-25/+3525
| | | | | | | | Adds a new KCM responder ccache back end that forwards all requests to sssd-secrets. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* TCURL: Support HTTP POST for creating containersJakub Hrozek2017-03-274-0/+41
| | | | | | | | The curl integration must allow us to create containers, therefore we also add support of the POST HTTP request type. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Store ccaches in secrets for the KCM responderJakub Hrozek2017-03-273-11/+86
| | | | | | | | | Adds a new "hive" to the secrets responder whose base path is /kcm. Only root can contact the /kcm hive, because the KCM responder only runs as root and it must impersonate other users and store ccaches on their behalf. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Return a nicer error message on request with no PUT dataJakub Hrozek2017-03-271-0/+6
| | | | | | | | | | I managed to create this pathological situation with the tcurl tool which didn't send any PUT data. The error in sssd-secrets was quite strange (ENOMEM). This patch just adds a safeguard sooner so that we return a graceful error. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Create DB path before the operation itselfJakub Hrozek2017-03-271-85/+83
| | | | | | | | | | | | This is a refactoring where instead of creating the ldb path in the operation itself, we create the ldb path when creating the local db request and pass the path to the operation. This would allow us to store different kind of objects in the secrets storage later. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 21:02:32 +0000