summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* TESTS: Add tests for sysdb_search_{users,groups}_by_orig_dn()Fabiano Fidêncio2017-09-051-0/+74
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Add sysdb_search_by_orig_dn()Fabiano Fidêncio2017-09-052-7/+86
| | | | | | | | | | | | | | Three new methods have been added to sysdb's API in order to perform search by the orig dn (which is quite common in SSSD's code base). A common/base method called sysdb_search_by_orig_dn() is the most important one and then a few other helpers for searching users and groups groups directly. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Only generate kdcinfo files on clientsJakub Hrozek2017-09-042-9/+18
| | | | | | | | | | | | | | | | | In some cases, IPA masters end up having a broken SSSD configuration that also includes the SRV records. This can cause the kdcinfo files to point to a different master which uses a different PKINIT certificate which is only valid for that IPA master. This can result e.g. in webui not working. This patch prevents the kdcinfo files from being generated on the IPA masters, but keep generating them on the clients. Not generating kdcinfo files on masters has no negative performance impact, because libkrb5 is configured via krb5.conf to point to self anyway. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Reword the DEBUG message about SRV resolution on IDM mastersJakub Hrozek2017-09-041-3/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Relax the assert in test_idle_timeoutJakub Hrozek2017-09-041-7/+9
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3473 We're being quite strict in test_idle_timeout when checking for the number of open fds which leads to spurious failures like: =================================== FAILURES =================================== ______________________________ test_idle_timeout _______________________________ Traceback (most recent call last): File "/var/lib/jenkins/workspace/ci/label/fedora23/src/tests/intg/test_secrets.py", line 427, in test_idle_timeout assert nfds_pre + 1 == nfds_conn AssertionError: assert (27 + 1) == 27 ==================== 1 failed, 221 passed in 473.37 seconds ==================== This is just a check that "a" connection was opened, so we don't have to check for exact match, but just for larger-or-equal. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Support 0 as unlimited for the quotasJakub Hrozek2017-09-017-3/+95
| | | | | | | | | | | | Add a special value for all the quota-like settings that means 'no limit'. Because the responder also had a global limit on the size of the accepted body (64kiB), this patch also removes the hardcoded limit and instead keep track of the biggest quota value on startup. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Add a new option to control per-UID limitsJakub Hrozek2017-09-019-1/+178
| | | | | | | | | | | Adds a new option max_uid_secrets that allows to set a limit of secrets for this particular client so that the user cannot starve other users. Resolves: https://pagure.io/SSSD/sssd/issue/3363 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Test that ccaches can be stored after max_secrets is reached for ↵Jakub Hrozek2017-09-011-1/+51
| | | | | | | | | | | regular non-ccache secrets Test that even when we store the maximum number of secrets, we can still store kerberos credentials, but only until we reach the max_secrets limit as well. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Use separate quotas for /kcm and /secrets hivesJakub Hrozek2017-09-015-23/+51
| | | | | | | | | | | | | | | | | | This would differentiate between out-of-capacity errors for secrets and for KCM as they are two independent trees as far as sssd-secrets is concerned. The quotas for /kcm are also different in their defaults. For the /secrets hive, we presume a large amount of small secrets. For the /kcm hive, we presume a small amount of large secrets, because the secret is a ccache which contains multiple credentials. The operations are also passed in a struct quota from the local request context instead of local_context. The quota is assigned to the request context when the hive is selected. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Rename local_db_req.basedn to local_db_req.req_dnJakub Hrozek2017-09-011-15/+15
| | | | | | | | | | This will make it possible to reuse the basedn name later for the "hive" base DN in order to differentiate quotas for different hives. There is no functional change in this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Read the quotas for cn=secrets from [secrets/secrets] configuration ↵Jakub Hrozek2017-09-014-54/+259
| | | | | | | | | | | | | | | | subsection This patch makes obsoletes the old way of configuring quotas for the secrets responder. Instead, adds a new way of configuring each hive separately in a configuration subsection, e.g. [secrets/secrets] max_secrets = 123 The old way is still supported as a backwards-compatible method. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Store quotas in a per-hive configuration structureJakub Hrozek2017-09-013-18/+26
| | | | | | | | | | Adds two new structures to hold the quotas and associate a quota with a hive. This is just an internal change for now, but will allow us to read quota configuration from per-hive sections later. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Do not link with c-aresJakub Hrozek2017-09-014-12/+0
| | | | | | | | | | | | Since we started using libcurl for the proxy provider, there is no point in initializing or linking against c-ares. If we want to explicitly use a resolver in the future, we should use libcurl callbacks. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Remove unused declarationsJakub Hrozek2017-09-011-2/+0
| | | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Only attempt migration for the joined domainJakub Hrozek2017-09-011-1/+11
| | | | | | | | | | | | | | After the recent changes in commit a5e134b22aa27ff6cd66a7ff47089788ebc098a1 to fix ticket #3394, the PAM_CRED_ERR error would try to start migration for any account. Further down the request, a sysdb search would try to find the user in the joined domain only because the migration code presumes the user is in the IPA domain which would error out and return System Error to the PAM client. This patch changes the migration somewhat to only attempt the migration for IPA users. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Fix unowned directoryLukas Slebodnik2017-09-011-0/+1
| | | | | | | | | | https://fedoraproject.org/wiki/Packaging:UnownedDirectories sh$ rpm -qf /usr/lib64/sssd/conf/ /usr/lib64/sssd/conf/sssd.conf file /usr/lib64/sssd/conf is not owned by any package sssd-common-1.15.3-2.fc27.x86_64 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: rhel8 will have python3 as wellLukas Slebodnik2017-09-011-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: format fixesSumit Bose2017-09-012-2/+2
| | | | | | | | | | | There are format warnings when compiling on 32bit. One is about time_t where %ld should be used and the other is about size_t where %zu should be used. Related to https://pagure.io/SSSD/sssd/issue/2995 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* PYTHON: Define constants as bytes instead of stringsFabiano Fidêncio2017-08-311-0/+7
| | | | | | | | | | | | | | | When using python3 getsidbyname() and getnamebysid() expect the key as bytes instead of strings, and currently those are defined as strings. So, in order to avoid people working around this by doing `pysss_nss_idmap.SID_KEY.encode('utf-8')` let's make their life easier and properly have those constants defined as bytes. Resolves: https://pagure.io/SSSD/sssd/issue/3491 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Don't call be_mark_offline() because ↵Fabiano Fidêncio2017-08-311-0/+8
| | | | | | | | | | | | | | sdap_id_conn_data_set_expire_timer() failed Marking the whole backend as offline because sdap_id_conn_data_set_expire_timer() failed doesn't look any right and from now on let's avoiding doing so. Related: https://pagure.io/SSSD/sssd/issue/2976 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Add a debug message to explain why a backend was marked offlineFabiano Fidêncio2017-08-311-0/+4
| | | | | | | | | | | This new debug message may help us when debugging the cases where a backend was marked offline but it shouldn't be. Related: https://pagure.io/SSSD/sssd/issue/2976 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFDB: Do not crash with an invalid domain_type or case_sensitive valueJakub Hrozek2017-08-311-0/+2
| | | | | | | | | | | If the domain_type parameter contained an invalid value, the error branch wouldn't have set the 'ret' parameter to an error condition, which might crash sssd. The same problem occured with CONFDB_DOMAIN_CASE_SENSITIVE Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFDB: Set a default value for subdomain_refresh_interval in case an ↵Fabiano Fidêncio2017-08-302-2/+12
| | | | | | | | | | | invalid value is set The code as it was seemed wrong as when an invalid value as set we neither error out nor set a default valid value there. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: add unit tests for krb5 localauth pluginSumit Bose2017-08-282-0/+215
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* localauth plugin: change return code of sss_an2lnSumit Bose2017-08-281-1/+1
| | | | | | | | | | | | | It is expected that the an2ln plugin function returns KRB5_LNAME_NOTRANS to indicate that no mapping can be determined and other an2ln methods can be tried. Currently SSSD's localauth plugin returns KRB5_PLUGIN_NO_HANDLE which sould only be used for the userok plugin function. Resolves https://pagure.io/SSSD/sssd/issue/3459 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Add regression tests to try if resolving root and ID 0 fails as expectedJakub Hrozek2017-08-281-0/+21
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Add files provider tests that request a user and group by IDJakub Hrozek2017-08-281-6/+91
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Add wrappers to request a user or a group by IDJakub Hrozek2017-08-282-2/+84
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TEST_NEGCACHE: Ensure root's uid and gid are always added to ncacheFabiano Fidêncio2017-08-281-0/+24
| | | | | | | | | | | | In order to do so two new functions have been introduced and test_sss_ncache_prepopulate() has been modified in order to ensure that root's uid and gid are always added to the negative cache. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Add root's uid/gid to ncacheFabiano Fidêncio2017-08-281-0/+17
| | | | | | | | | | | | | | | | | As "root" is not handled by SSSD, let's add its uid and gid to the negative cache as well. The reason it's added without specifying a domain is to follow how the negative cache is used by cache req's code when searching something by id. As the negative cache check for uid/gid, in the cache req code, is done after resolving the name, we can save one LDAP call to the data provider. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Don't error out when deleting an entry which has id = 0 from the memcacheFabiano Fidêncio2017-08-281-0/+6
| | | | | | | | | | | | | | | This code path can be easily triggered by calling `id 0` after applying the previous patch in this series and SSSD should not error out in this case. As SSSD doesn't handle "root", this entry never will be part of the memcache and EOK can be safely returned there. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: Don't error out when searching by id = 0Fabiano Fidêncio2017-08-281-6/+0
| | | | | | | | | | | | | | This code path can be easily triggered by calling `id 0` and SSSD should not error out in this case. Previous patches in this series already add uid and gid 0 to the negative cache and we can properly handle this situation. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Descend to all subdomains when adding user/groupsFabiano Fidêncio2017-08-281-2/+6
| | | | | | | | | | | When a user or group is added to the negative cache, we should descend to all subdomains as well. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST_NEGCACHE: Test that "root" is always added to ncacheFabiano Fidêncio2017-08-281-0/+6
| | | | | | | | | | | | | Simply modify test_sss_ncache_prepopulate() in order to ensure that "root" user and group are always added to the negative cache, no matter whether they're set as part of the filter_users or filter_groups options. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Always add "root" to the negative cacheFabiano Fidêncio2017-08-281-34/+54
| | | | | | | | | | | | | | The current code only adds "root" to the negative cache in case there's any other user or group set up in to be added. As SSSD doesn't handle "root", it should *always* be added to the negative cache. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Add some comments about each step of sss_ncache_prepopulate()Fabiano Fidêncio2017-08-281-1/+4
| | | | | | | | | | | The comments help to understand which part of the code is dealing with users or groups of specific or non-specific domain filters. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DESKPROFILE: Add ipa_deskprofile_request_intervalFabiano Fidêncio2017-08-288-1/+53
| | | | | | | | | | | | | | | | This option has been added to avoid contacting the Data Provider when no rules were found in the previous request. By adding this configurable option we avoid contacting the Data Provider too often in the case described above and also when the server doesn't support Desktop Profile's integration. Resolves: https://pagure.io/SSSD/sssd/issue/3482 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Not having rules should not be logged as errorFabiano Fidêncio2017-08-281-1/+1
| | | | | | | | | Let's tone down the debug level to TRACE_FUNC instead of MINOR_FAILURE. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Add a debug message in case ipa_hbac_rule_info_next() failsFabiano Fidêncio2017-08-281-0/+1
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Enforce coding style ipa_hbac_rule_info_recv()Fabiano Fidêncio2017-08-282-6/+6
| | | | | | | | | By convention, the output variables are prefixed with a underscore. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Enforce coding style on ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-1/+1
| | | | | | | | | | Use if-else if-else statements instead of using severel different if statements. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Improve readability of ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-12/+11
| | | | | | | | | | | Move an if condition inside another if condition in order to make the readability a little bit more clear that those checks are about the same return code. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Remove a cosmetic extra space from an if clauseFabiano Fidêncio2017-08-281-1/+1
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Document ipa_hbac_rule_info_next()'s behaviourFabiano Fidêncio2017-08-281-0/+8
| | | | | | | | | | | Let's add a comment on ipa_hbac_rule_info_send() in order to have cleaner why ret is set to EINVAL when ipa_hbac_rule_info_next() returns EOK. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Fix tevent hierarchy in ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-24/+15
| | | | | | | | | | | | | | | The first thing a _send() function should o is call `tevent_req_create()` in order to create both the state and the request and then use the state as context for temporary data. Also, `tevent_req_create()` should be only function returning NULL from the _send function, while all the other calls should goto immediate and return the proper error, as they have a valid request. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DESKPROFILE: Introduce the new IPA session providerFabiano Fidêncio2017-08-2828-2/+2708
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to provide FleetCommander[0] integration, a session provider has been introduced for IPA. The design of this feature and more technical details can be found at [1] and [2], which are the design pages of both freeIPA and SSSD parts. As there's no way to test freeIPA integration with our upstream tests, no test has been provided yet. Is also worth to mention that the name "deskprofile" has been chosen instead of "fleetcmd" in order to match with the freeIPA plugin. It means that, for consistence, all source files, directories created, options added, functions prefixes and so on are following the choice accordingly. [0]: https://wiki.gnome.org/Projects/FleetCommander [1]: https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/Feature.mediawiki [2]: https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.html Resolves: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add sss_create_dir()Fabiano Fidêncio2017-08-283-0/+119
| | | | | | | | | | | | | | | | | The newly added function helps us to create a new dir avoiding a possible TUCTOU issue. It's going to be used by the new session provider code. A simple test for this new function has also been provided. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: move {files,selinux}.c under util directoryFabiano Fidêncio2017-08-289-46/+44
| | | | | | | | | | | | | | | | | | | | | | | | | files.c has at least one function that will be re-used for the new session provider that's about to be added. Also, a few other functions may be added and files.c seems the right place for those. selinux.c has been moved together with files.c as the latter takes advantage of some functions from the former and we do not want to always link agains the tools code. The public functions from files.c got a "sss_" prefix and it has been changed whenever they're used. Last but not least, all the places that included "tools/tools_util.h" due to the functions on files.c had this include removed (as they were already including "util/util.h". Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_COMMON: Introduce ipa_get_host_attrs()Fabiano Fidêncio2017-08-283-29/+55
| | | | | | | | | | | | | By adding this method it can reused in the future for new backend modules. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_ACCESS: Make use of struct ipa_common_entriesFabiano Fidêncio2017-08-281-82/+41
| | | | | | | | | | | | Just by doing so ipa_save_hbac() can be completely removed. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 12:11:53 +0000