summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* IPA: Improve s2n debug message for missing ipaNTSecurityIdentifierJustin Stephenson2017-04-281-1/+7
| | | | | | | | | | | | This patch improves the log message to be more information for the SSSD user troubleshooting issues. If the IDM POSIX group used for AD trust HBAC/SUDO operation is missing the ipaNTSecurityIdentifier it can cause client s2n operations failures resolving the group which resulted in the inability to login for the AD user. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* overrides: add certificates to mapped attributeSumit Bose2017-04-281-0/+41
| | | | | | | | | Certificates in overrides are explicitly used to map users to certificates, so we add them to SYSDB_USER_MAPPED_CERT as well. Resolves https://pagure.io/SSSD/sssd/issue/3373 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad: handle forest root not listed in ad_enabled_domainsSumit Bose2017-04-281-3/+36
| | | | | | | | | | | Although users and groups from the forest root should be ignored SSSD will still try to get information about the forest topology from a DC from the forest root. So even if the forest root domain is disabled we should makes sure it is usable for those searches. Resolves https://pagure.io/SSSD/sssd/issue/3361 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* utils: add sss_domain_is_forest_root()Sumit Bose2017-04-282-0/+6
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3361 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Fix standalone application domainsJakub Hrozek2017-04-281-4/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a standalone application domain was configured, for example: ------------------------------------------------- [sssd] domains = appdomain [application/appdomain] id_provider=ldap ldap_uri = ldap://dc.ipa.test ldap_search_base = cn=accounts,dc=ipa,dc=test ldap_schema = rfc2307bis sudo_provider = none ldap_sasl_mech = gssapi krb5_realm = IPA.TEST krb5_server = dc.ipa.test ldap_user_uid_number = telephonenumber ldap_user_gid_number = mobile ldap_user_extra_attrs = location:l ------------------------------------------------- We would, when unrolling the application section into a domain section, first add a domain stub, equivalent to: ----------------------------- [domain/appdomain] domain_type = application ----------------------------- Which in config.ldb also contains cn. Then, whem we would add the parameters from the [application] section, but try to add the cn again. This didn't happen when inheriting from a POSIX domain, because there we would set LDB_FLAG_REPLACE for any attributes that exist in the inherited domain. This patch skips the cn attribute both when replacing an inherited domain's attributes and when writing a standalone application domain. Resolves: https://pagure.io/SSSD/sssd/issue/3355 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use search bases instead of domain_to_basedn when fetching external groupsJakub Hrozek2017-04-261-17/+13
| | | | | | | | | | | | | Instead of deriving the search base from the IPA domain name, actually use the search base from the sdap_domain structure. This has primarily the advantage of not matching groups in the compat tree. Resolves: https://pagure.io/SSSD/sssd/issue/3378 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Allow passing a NULL map to sdap_search_bases_ex_sendJakub Hrozek2017-04-261-1/+1
| | | | | | | | | | NULL attribute map and a NULL list of attributes should translate into "fetch all entry attributes" Required for: https://pagure.io/SSSD/sssd/issue/3378 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ_DOMAIN: debug the set domain resolution orderFabiano Fidêncio2017-04-261-0/+11
| | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER_COMMON: Improve domaiN_resolution_order debug messagesFabiano Fidêncio2017-04-261-0/+6
| | | | | | | | | Indicate whether a domain_resolution_order has been used and where it came from. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ_DOMAIN: Add some comments to ↵Fabiano Fidêncio2017-04-261-0/+4
| | | | | | | | cache_req_domain_new_list_from_string_list() Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Allow configurationless shortname lookupsFabiano Fidêncio2017-04-263-1/+50
| | | | | | | | | | | | | | | | Configurationless shortnames lookups must be allowed when a domains' resolution order is present and the (head) domain is not enforcing the usage of fully-qualified-names. With this patch SSSD does not require any kind of changes from client side for taking advantage of shortname lookups. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Improve non-fqnames testsFabiano Fidêncio2017-04-261-15/+30
| | | | | | | | | | | | | | | | | | | | | | With the changes that are about to happen we have to have the subdomain's fqnames flag set by the time we populate the cr_domains list (as it actually occurs with the real code), as this list may set its own fqnames flag based on the subdomain's fqnames flag. Currently the flag is set to false only when running the tests itself so the cr_domains list doesn't get populate properly (although it still works with the current code). For the changes that are comming, let's introduce a new setup function that ensures that the subdomain's fqnames flag is set up in the right time. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Fallback to global domain resolution order in case the view ↵Fabiano Fidêncio2017-04-263-53/+74
| | | | | | | | | | | | | | | | | | | | doesn't have this option set The current code has been ignoring the domain resolution order set globally on IPA in case there's a view but this doesn't have any domain resolution order set. It happens because we haven't been checking whether the view attribute didn't exist and then we ended up populating the list cache_req domains' list assuming that no order has been set instead of falling back to the next preferred method. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifierHEADmasterJakub Hrozek2017-04-241-1/+4
| | | | | | | | | | | | There was an issue in a production deployment where the admin selected a GID outside the IDM range for a group that contained a user from the trusted domain. This resulted in not adding a SID for the IPA group, which in turn meant the group couldn't be resolved on the client. This patch just improves the DEBUG message so that it's clearer for the admins where the issue is. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: remove unused variableLukas Slebodnik2017-04-211-5/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Use sized_domain_name to format the groups the user is a member ofJakub Hrozek2017-04-211-14/+15
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3268 Uses the common function sized_domain_name() to format a group the user is a member of to the appropriate format. To see the code is working correctly, run: dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:trusted_user Where trusted_user is a user from a trusted domain that is a member of groups from the joined domain and a trusted domain as well. The groups from the joined domain should not be qualified, the groups from the trusted domain should be qualified. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Move sized_output_name() and sized_domain_name() into responder common codeJakub Hrozek2017-04-215-99/+112
| | | | | | | | | | | | | | | | | | | | | These functions are used to format a name into a format that the user configured for output, including case sensitiveness, replacing whitespace and qualified format. They were used only in the NSS responder, which typically returns strings to the NSS client library and then the user. But it makes sense to just reuse the same code in the IFP responder as well, since it does essentially the same job. The patch also renames sized_member_name to sized_domain_name. Previously, the function was only used to format a group member, the IFP responder would use the same function to format a group the user is a member of. Related to: https://pagure.io/SSSD/sssd/issue/3268 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* README: Update links to mailing listsLukas Slebodnik2017-04-201-2/+4
| | | | | | | | | | Old links are redirected to information about Fedorahosted-retirement e.g. https://fedorahosted.org/mailman/listinfo/sssd-devel -> https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Drop conditional build for krb5_local_auth_pluginLukas Slebodnik2017-04-191-6/+0
| | | | | | | | | It was mainly aimed for time when stable CentOS and rhel nightly had different versions of krb5. Anyway, rhel7.0 and rhel <= 6.6 are already out of support Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* minor typo fixesRené Genz2017-04-195-16/+16
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* UTIL: Use max 15 characters for AD host UPNLukas Slebodnik2017-04-121-1/+7
| | | | | | | | | | | | | | | | | We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" because it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" because of other principals in keytab. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name Resolves: https://pagure.io/SSSD/sssd/issue/3329 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sbus: check connection for NULL before unregister itSumit Bose2017-04-121-1/+7
| | | | | | | | | | | | There seem to be code paths where the data is a added to the hash before the connection is properly initialized, to avoid core dump during shut down we only call dbus_conection_unregister_object_path() if there is a connection. Resolves: https://pagure.io/SSSD/sssd/issue/3367 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5_LOCATOR: add env variable to disable pluginSumit Bose2017-04-112-0/+20
| | | | | | | | | | | | | If the new environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value SSSD's krb5 locator plugin is disabled. The variable is needed because there is currently no other way than removing the plugin completely to disable it. For a use-case see e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1072939. Resolves: https://pagure.io/SSSD/sssd/issue/3359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config-check: Message when sssd.conf is missingMichal Židek2017-04-101-1/+4
| | | | | | | | | | sssctl config-check should print a message for user if no sssd.conf was found. Resolves: https://pagure.io/SSSD/sssd/issue/3330 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* i18n: adding sssctl filesSumit Bose2017-04-101-0/+8
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssctl: integrate pam_test_client into sssctlSumit Bose2017-04-105-72/+72
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add InfoPipe user lookupSumit Bose2017-04-102-0/+72
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_sifp: update method namesSumit Bose2017-04-102-3/+3
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add SSSD getpwnam lookupSumit Bose2017-04-102-2/+84
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add service and environment to PAM test clientSumit Bose2017-04-101-12/+38
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Fix handling of enable_files_domainLukas Slebodnik2017-04-101-8/+8
| | | | | | | | | | | The option enable_files_domain worked only if sssd was compiled with --enable-files-domain. But manual page described something else. Resolves: https://pagure.io/SSSD/sssd/issue/3340 Reviewed-by: Michal Židek <mzidek@redhat.com>
* DP: Fix typoPavel Březina2017-04-061-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* selinux: Do not fail if SELinux is not managedMichal Židek2017-04-065-24/+49
| | | | | | | | | | | Previously we failed if semanage_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa_s2n_get_acct_info_send: provide correct req_input namePavel Březina2017-04-031-4/+36
| | | | | | | | | | To avoid crash. Resolves: https://pagure.io/SSSD/sssd/issue/3358 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: do not leak selinux context on clients destructionPavel Březina2017-04-031-1/+19
| | | | | | | | | | The SELinux context created in get_client_cred is not talloc bound and we were leaking it if available with each client's destruction. Resolves: https://pagure.io/SSSD/sssd/issue/3360 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix compilation of libsss_certmap with libcryptoLukas Slebodnik2017-04-031-1/+2
| | | | | | | | | | | CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c:25:18: fatal error: cert.h: No such file or directory #include <cert.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com>
* libsss_certmap: Accept certificate with data before headerDavid Kupka2017-04-032-4/+21
| | | | | | | | | | | | | According to RFC 7468 parser must not fail when some data are present before the encapsulation boundary. sss_cert_pem_to_der didn't respect this and refused valid input. Changing it's code to first locate the certificate header fixes the issue. Resolves: https://pagure.io/SSSD/sssd/issue/3354 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* configure: fix typoPavel Březina2017-03-301-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_iobuf: fix 'read' shadows a global declarationPavel Březina2017-03-301-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* secrets: always add Content-Length headerPavel Březina2017-03-301-4/+68
| | | | | | | | | If custodia server does not reply with Content-Length header, curl may wait for non-existing body of http reply if such body does not exist (for example during POST operation when creating a container). Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: fix debug messagePavel Březina2017-03-301-1/+2
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: support HTTP basic authentication with proxy providerPavel Březina2017-03-301-0/+9
| | | | | | | | Even though configuration options auth_type = basic, username and password are read they were not used anywhere prior this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: allow to configure certificate checkPavel Březina2017-03-305-0/+149
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: remove http-parser code in proxy providerPavel Březina2017-03-301-581/+0
| | | | | | | | | | We switche to libcurl in previous patch. This just removes the unused code. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: use tcurl in proxy providerPavel Březina2017-03-304-84/+192
| | | | | | | | | | | | We switch from http-parser to libcurl for an http client. This gaves us many features for free such as tls and http basic authentication support instead of implementing it on our own. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: make curl required by secretsPavel Březina2017-03-302-15/+7
| | | | | | | | Also remove --disable-libcurl since it doesn't make sense. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ci: do not build secrets on rhel6Pavel Březina2017-03-303-0/+20
| | | | | | | We require newer libcurl version than is available on rhel6. We don't ship secrets responder in rhel6 so we just disable its build. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tcurl test: add support for client certificatePavel Březina2017-03-301-0/+13
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: allow to set custom headersPavel Březina2017-03-301-2/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for http basic authPavel Březina2017-03-303-0/+53
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 14:00:08 +0000