summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifierHEADmasterJakub Hrozek2017-04-241-1/+4
| | | | | | | | | | | | There was an issue in a production deployment where the admin selected a GID outside the IDM range for a group that contained a user from the trusted domain. This resulted in not adding a SID for the IPA group, which in turn meant the group couldn't be resolved on the client. This patch just improves the DEBUG message so that it's clearer for the admins where the issue is. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: remove unused variableLukas Slebodnik2017-04-211-5/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Use sized_domain_name to format the groups the user is a member ofJakub Hrozek2017-04-211-14/+15
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3268 Uses the common function sized_domain_name() to format a group the user is a member of to the appropriate format. To see the code is working correctly, run: dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:trusted_user Where trusted_user is a user from a trusted domain that is a member of groups from the joined domain and a trusted domain as well. The groups from the joined domain should not be qualified, the groups from the trusted domain should be qualified. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Move sized_output_name() and sized_domain_name() into responder common codeJakub Hrozek2017-04-215-99/+112
| | | | | | | | | | | | | | | | | | | | | These functions are used to format a name into a format that the user configured for output, including case sensitiveness, replacing whitespace and qualified format. They were used only in the NSS responder, which typically returns strings to the NSS client library and then the user. But it makes sense to just reuse the same code in the IFP responder as well, since it does essentially the same job. The patch also renames sized_member_name to sized_domain_name. Previously, the function was only used to format a group member, the IFP responder would use the same function to format a group the user is a member of. Related to: https://pagure.io/SSSD/sssd/issue/3268 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* README: Update links to mailing listsLukas Slebodnik2017-04-201-2/+4
| | | | | | | | | | Old links are redirected to information about Fedorahosted-retirement e.g. https://fedorahosted.org/mailman/listinfo/sssd-devel -> https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Drop conditional build for krb5_local_auth_pluginLukas Slebodnik2017-04-191-6/+0
| | | | | | | | | It was mainly aimed for time when stable CentOS and rhel nightly had different versions of krb5. Anyway, rhel7.0 and rhel <= 6.6 are already out of support Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* minor typo fixesRené Genz2017-04-195-16/+16
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* UTIL: Use max 15 characters for AD host UPNLukas Slebodnik2017-04-121-1/+7
| | | | | | | | | | | | | | | | | We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" because it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" because of other principals in keytab. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name Resolves: https://pagure.io/SSSD/sssd/issue/3329 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sbus: check connection for NULL before unregister itSumit Bose2017-04-121-1/+7
| | | | | | | | | | | | There seem to be code paths where the data is a added to the hash before the connection is properly initialized, to avoid core dump during shut down we only call dbus_conection_unregister_object_path() if there is a connection. Resolves: https://pagure.io/SSSD/sssd/issue/3367 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5_LOCATOR: add env variable to disable pluginSumit Bose2017-04-112-0/+20
| | | | | | | | | | | | | If the new environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value SSSD's krb5 locator plugin is disabled. The variable is needed because there is currently no other way than removing the plugin completely to disable it. For a use-case see e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1072939. Resolves: https://pagure.io/SSSD/sssd/issue/3359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config-check: Message when sssd.conf is missingMichal Židek2017-04-101-1/+4
| | | | | | | | | | sssctl config-check should print a message for user if no sssd.conf was found. Resolves: https://pagure.io/SSSD/sssd/issue/3330 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* i18n: adding sssctl filesSumit Bose2017-04-101-0/+8
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssctl: integrate pam_test_client into sssctlSumit Bose2017-04-105-72/+72
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add InfoPipe user lookupSumit Bose2017-04-102-0/+72
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_sifp: update method namesSumit Bose2017-04-102-3/+3
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add SSSD getpwnam lookupSumit Bose2017-04-102-2/+84
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add service and environment to PAM test clientSumit Bose2017-04-101-12/+38
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Fix handling of enable_files_domainLukas Slebodnik2017-04-101-8/+8
| | | | | | | | | | | The option enable_files_domain worked only if sssd was compiled with --enable-files-domain. But manual page described something else. Resolves: https://pagure.io/SSSD/sssd/issue/3340 Reviewed-by: Michal Židek <mzidek@redhat.com>
* DP: Fix typoPavel Březina2017-04-061-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* selinux: Do not fail if SELinux is not managedMichal Židek2017-04-065-24/+49
| | | | | | | | | | | Previously we failed if semanage_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa_s2n_get_acct_info_send: provide correct req_input namePavel Březina2017-04-031-4/+36
| | | | | | | | | | To avoid crash. Resolves: https://pagure.io/SSSD/sssd/issue/3358 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: do not leak selinux context on clients destructionPavel Březina2017-04-031-1/+19
| | | | | | | | | | The SELinux context created in get_client_cred is not talloc bound and we were leaking it if available with each client's destruction. Resolves: https://pagure.io/SSSD/sssd/issue/3360 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix compilation of libsss_certmap with libcryptoLukas Slebodnik2017-04-031-1/+2
| | | | | | | | | | | CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c:25:18: fatal error: cert.h: No such file or directory #include <cert.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com>
* libsss_certmap: Accept certificate with data before headerDavid Kupka2017-04-032-4/+21
| | | | | | | | | | | | | According to RFC 7468 parser must not fail when some data are present before the encapsulation boundary. sss_cert_pem_to_der didn't respect this and refused valid input. Changing it's code to first locate the certificate header fixes the issue. Resolves: https://pagure.io/SSSD/sssd/issue/3354 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* configure: fix typoPavel Březina2017-03-301-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_iobuf: fix 'read' shadows a global declarationPavel Březina2017-03-301-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* secrets: always add Content-Length headerPavel Březina2017-03-301-4/+68
| | | | | | | | | If custodia server does not reply with Content-Length header, curl may wait for non-existing body of http reply if such body does not exist (for example during POST operation when creating a container). Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: fix debug messagePavel Březina2017-03-301-1/+2
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: support HTTP basic authentication with proxy providerPavel Březina2017-03-301-0/+9
| | | | | | | | Even though configuration options auth_type = basic, username and password are read they were not used anywhere prior this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: allow to configure certificate checkPavel Březina2017-03-305-0/+149
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: remove http-parser code in proxy providerPavel Březina2017-03-301-581/+0
| | | | | | | | | | We switche to libcurl in previous patch. This just removes the unused code. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: use tcurl in proxy providerPavel Březina2017-03-304-84/+192
| | | | | | | | | | | | We switch from http-parser to libcurl for an http client. This gaves us many features for free such as tls and http basic authentication support instead of implementing it on our own. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: make curl required by secretsPavel Březina2017-03-302-15/+7
| | | | | | | | Also remove --disable-libcurl since it doesn't make sense. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ci: do not build secrets on rhel6Pavel Březina2017-03-303-0/+20
| | | | | | | We require newer libcurl version than is available on rhel6. We don't ship secrets responder in rhel6 so we just disable its build. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tcurl test: add support for client certificatePavel Březina2017-03-301-0/+13
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: allow to set custom headersPavel Březina2017-03-301-2/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for http basic authPavel Březina2017-03-303-0/+53
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: add support for tls settingsPavel Březina2017-03-301-0/+19
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: add support for raw outputPavel Březina2017-03-301-0/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: refactor so new options can be added more easilyPavel Březina2017-03-301-125/+209
| | | | | | | Just to make the tool a little bit nicer and more flexible. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for ssl and raw outputPavel Březina2017-03-305-375/+672
| | | | | | | | | | | | | | At first, this patch separates curl_easy handle from the multi-handle processing and makes it encapsulated in custom tcurl_request structure. This allows us to separate protocol initialization from its asynchonous logic which gives us the ability to set different options for each request without over-extending the parameter list. In this patch we implement options for peer verification for TLS-enabled protocols and to return response with body and headers together. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Fix off-by-one error in secrets key parsingJakub Hrozek2017-03-302-17/+101
| | | | | | | | | | | | | | | When parsing the secrets key, the code tried to protect against malformed keys or keys that are too short, but it did an error - the UUID stringified form is 36 bytes long, so the UUID_STR_SIZE is 37 because UUID_STR_SIZE accounts for the null terminator. But the code, that was trying to assert that there are two characters after the UUID string (separator and at least a single character for the name) didn't take the NULL terminator (which strlen() doesn't return) into account and ended up rejecting all ccaches whose name is only a single character. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccacheJakub Hrozek2017-03-306-22/+99
| | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 The following changes were done to the Kerberos authentication code in order to support authentication in a non-POSIX environment: - delayed authentication is disabled in non-POSIX domains - when a user logs in in a non-POSIX domain, SSSD uses a MEMORY:$username ccache and destroys is then krb5_child finishes so that just the numeric result is used - krb5_child doesn't drop privileges in this configuration because there is nothing to drop privileges to Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Relax search filters in application domainsJakub Hrozek2017-03-303-13/+66
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a request comes towards an application domain, we can drop the part of the filter that asserts that the object has a valid UID/GID. Instead, we just search by name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: save non-POSIX users in application domainsJakub Hrozek2017-03-301-15/+57
| | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a user being saved by the LDAP provider does not have a UID or GID and the domain type is application, we save the user entry as non-POSIX. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Only generate new UID in local domainJakub Hrozek2017-03-301-0/+6
| | | | | | | | | | To avoid issues where a user with no UID but without the posix=false flag was passed to sysdb, we only allow generating the new ID in the local domain. This might prevent bugs where non-POSIX users would get a UID created by sysdb which might allow accessing resources owned by that UID. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Allow storing non-POSIX usersJakub Hrozek2017-03-302-9/+79
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 We already do the same for groups. If the user does not have UID number set but does have the POSIX: false attribute set, then we save the user with zero UID and the non-POSIX flag. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-309-6/+241
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Remove unneeded memory contextJakub Hrozek2017-03-301-4/+4
| | | | | | | | | Since we only store data into pam_ctx in get_public_domains(), it doesn't make sense to allow passing a separate memory context. It is always going to be pam_ctx, otherwise the memory hierarchy will cause issues anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: ListByName: Don't crash when no results are foundJakub Hrozek2017-03-301-7/+9
| | | | | | | | | | | If no results were found using the List command, the results variable was undefined which resulted in a crash. Instead, only copy the results of the cache_req lookup returns EOK and we can presume that the results are valid. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-26 23:47:33 +0000