summaryrefslogtreecommitdiffstats
path: root/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
* SSSCTL: Replace sss_debuglevel with shell wrapperJustin Stephenson2017-09-251-0/+13
| | | | | | | | | | | | | The sss_debuglevel binary is replaced by a shell wrapper calling sssctl debug-level as part of merging sss_debuglevel into sssctl. The wrapper will redirect sss_debuglevel to the sssctl debug-level command performing the same task. The sss_debuglevel(8) man page is updated to indicate that sss_debuglevel is deprecated and functionality exists now in sssctl. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSCTL: Move sss_debuglevel to sssctl debug-levelJustin Stephenson2017-09-251-8/+0
| | | | | | | | | | | | | | | | Move code from sss_debuglevel to sssctl_logs.c and add new debug-logs sssctl command to perform the same task of changing debug level dynamically. POPT_CONTEXT_KEEP_FIRST Flag added to poptGetContext call in sssctl_debug_level() to fix argument parsing. Resolves: https://pagure.io/SSSD/sssd/issue/3057 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* sssd_client: add mutex protected call to the PAC responderSumit Bose2017-09-221-0/+16
| | | | | | | | | | | | | | | | | | | | | | SSSD's plugin for MIT Kerberos to send the PAC to the PAC responder currently uses sss_pac_make_request() which does not protect the communication with the PAC responder with a mutex as e.g. the NSS and PAM clients. If an application using threads loads this plugin via libkrb5 in different threads and is heavily processing Kerberos tickets with PACs chances are that two threads try to communicate with SSSD at once. In this case one of the threads will miss a reply and will wait for it until the default client timeout of 300s is passed. This patch adds a call which uses a mutex to protect the communication which will avoid the 300s delay mentioned above. Resolves: https://pagure.io/SSSD/sssd/issue/3518 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IPA: fix handling of certmap_ctxSumit Bose2017-09-141-0/+20
| | | | | | | | | | This patch fixes a use-after-free in the AD provider part and initializes the certmap_ctx with data from the cache at startup. Related to https://pagure.io/SSSD/sssd/issue/3508 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONTRIB: Add DP Request analysis scriptJustin Stephenson2017-09-081-0/+1
| | | | | | | | | | | | | | | Run this script using stap as root and Ctrl-C to print the summary report stap -v /usr/share/sssd/systemtap/dp_request.stp This script will use the data provider request probe markers to provide elapsed time of each request and more information about the slowest request in the summary report. Resolves: https://pagure.io/SSSD/sssd/issue/3061 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Add Generic DP Request ProbesJustin Stephenson2017-09-081-0/+9
| | | | | | | | | | | | | | | Add the ability to analyze performance and monitor Data Provider requests at a high-level, probes fire when a request is sent and when a request is completed. Request name, domain, target, method, and return code information is passed as target variables to the systemtap probe tapsets which can be used in systemtap scripts. Resolves: https://pagure.io/SSSD/sssd/issue/3061 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SELINUX: Use getseuserbyname to get IPA seuserJustin Stephenson2017-09-061-0/+1
| | | | | | | | | | | | | | The libselinux function getseuserbyname is more reliable method to retrieve SELinux usernames then functions from libsemanage `semanage_user_query` and is recommended by libsemanage developers. Replace get_seuser function with getseuserbyname. Resolves: https://pagure.io/SSSD/sssd/issue/3308 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Petr Lautrbach <plautrba@redhat.com>
* certmap: add OpenSSL implementationSumit Bose2017-09-051-5/+2
| | | | | | | | | | The OpenSSL 1.1 API is used but there is a short macro block which should added the needed compatibility if and older OpenSSL version is used. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Do not link with c-aresJakub Hrozek2017-09-011-1/+0
| | | | | | | | | | | | Since we started using libcurl for the proxy provider, there is no point in initializing or linking against c-ares. If we want to explicitly use a resolver in the future, we should use libcurl callbacks. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: add unit tests for krb5 localauth pluginSumit Bose2017-08-281-0/+18
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* DESKPROFILE: Introduce the new IPA session providerFabiano Fidêncio2017-08-281-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to provide FleetCommander[0] integration, a session provider has been introduced for IPA. The design of this feature and more technical details can be found at [1] and [2], which are the design pages of both freeIPA and SSSD parts. As there's no way to test freeIPA integration with our upstream tests, no test has been provided yet. Is also worth to mention that the name "deskprofile" has been chosen instead of "fleetcmd" in order to match with the freeIPA plugin. It means that, for consistence, all source files, directories created, options added, functions prefixes and so on are following the choice accordingly. [0]: https://wiki.gnome.org/Projects/FleetCommander [1]: https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/Feature.mediawiki [2]: https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.html Resolves: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: move {files,selinux}.c under util directoryFabiano Fidêncio2017-08-281-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | files.c has at least one function that will be re-used for the new session provider that's about to be added. Also, a few other functions may be added and files.c seems the right place for those. selinux.c has been moved together with files.c as the latter takes advantage of some functions from the former and we do not want to always link agains the tools code. The public functions from files.c got a "sss_" prefix and it has been changed whenever they're used. Last but not least, all the places that included "tools/tools_util.h" due to the functions on files.c had this include removed (as they were already including "util/util.h". Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Make ipa_hbac_sysdb_save() more genericFabiano Fidêncio2017-08-281-0/+2
| | | | | | | | | | | | | | | | | | | Although there's no change in the ipa_hbac_sysdb_save() itself, its name has been changed to ipa_common_entries_and_groups_sysdb_save() and its been split out from HBAC related files and moved to the newly created ipa_rules_common.[ch] files, which will also be used in the future for new backend modules. ipa_rules_common.[ch] is not exactly the best name for those files, IMO, but I really cannot come up with something better. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Moving headers used by both server and client to special folderAmitKumar2017-08-031-3/+3
| | | | | | | | | | | | | | | | | | | These are the header files which are used by both client and server: src/util/io.h src/util/murmurhash3.h src/util/util_safealign.h This patch is about moving these header files to special folder (src/shared). It will be easier to identify these headers when looking for them in the src tree. util_safalign.h is renamed as safalign.h because util_ namespace is appropriate when this file belonged to the util's folder which is no longer the case. Resolves: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* INTG: Add --with-session-recording=/bin/false to intgcheck's configureFabiano Fidêncio2017-08-031-0/+1
| | | | | | | | | | | | Let's ensure that running `make intgcheck-*` doesn't fail when done locally. As --with-session-recording=/bin/false is now set in the Makefile.am, there's no need to set it in contrib/ci/configure.sh. Thus, the option has been removed from there. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CACHE_REQ: Pull sessionRecording attrs from initgrNikolai Kondrashov2017-07-271-0/+1
| | | | | | | | | | | | After entires are retrieved by cache_req for user info requests (except initgr), overlay them with sessionRecording attribute retrieved from an initgr request made additionally for each entry. Do not do additional initgr requests with selective session recording enabled, if we don't have any group names to match against in session recording configuration. Only do user name matches instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add session recording conf loadingNikolai Kondrashov2017-07-271-0/+1
| | | | | | | | Add session recording configuration loading to the data provider initialization. To be used for matching users and groups with session recording enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Add session recording conf loadingNikolai Kondrashov2017-07-271-0/+3
| | | | | | | | Add session recording configuration loading to the common responder initialization. To be used for substituting the user shell when session recording is enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add session recording conf management moduleNikolai Kondrashov2017-07-271-0/+1
| | | | | | | Add an util module for loading session recording configuration. To be used by responders and data provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KCM: Modify krb5 snippet file kcm_default_ccacheLukas Slebodnik2017-07-251-3/+3
| | | | | | | | | | | | | | | The file kcm_default_ccache must enable KCM ccache by default without any modification of the file. /etc/krb5.conf.d/ is fedora/el7 specific and it is not allowed to enable or start systemd services in scriptlets. It would result in broken krb5 configuration. Therefore krb5 configuration snippet was moved from /etc/krb5.conf.d/ -> /usr/share/sssd-kcm. And each downstream distribution should enable systemd services + change krb5 configuration in it's own way. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* idmap_error_string: add missing descriptionsSumit Bose2017-07-241-1/+1
| | | | | | | | | Related to https://pagure.io/SSSD/sssd/issue/1960 Related to https://pagure.io/SSSD/sssd/issue/1938 Related to https://pagure.io/SSSD/sssd/issue/1844 Related to https://pagure.io/SSSD/sssd/issue/1593 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add unit tests for cfg validationMichal Židek2017-05-311-0/+16
| | | | | | Add infrastructure for unit tests for validators. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix build without sshLukas Slebodnik2017-05-251-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cache_req_host_by_name_lookup should be used only by ssh responder. But we cannot rely on this fact and therefore we should return ERR_INTERNAL instead of EOK to catch mis-usage of the cache_req plugin autoreconf -if ./configure --without-ssh make check CCLD sssd_nss src/responder/common/cache_req/plugins/cache_req_host_by_name.o: In function `cache_req_host_by_name_lookup': src/responder/common/cache_req/plugins/cache_req_host_by_name.c:48: undefined reference to `sysdb_get_ssh_host' collect2: error: ld returned 1 exit status make: *** [Makefile:14285: sssd_nss] Error 1 src/tests/cmocka/test_utils-test_sss_ssh.o: In function `test_textual_public_key': src/tests/cmocka/test_sss_ssh.c:78: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:82: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:86: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:89: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:92: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_utils-test_sss_ssh.o:src/tests/cmocka/test_sss_ssh.c:95: more undefined references to `sss_ssh_format_pubkey' follow collect2: error: ld returned 1 exit status Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Link libwbclient with libdlLukas Slebodnik2017-05-241-0/+1
| | | | | | | | | | | | dlopen-tests cannot catch it because it has to be linked with libdl sh$ grep dlopen src/sss_client/libwbclient/ src/sss_client/libwbclient/wbc_pwd_sssd.c: ctx->dl_handle = dlopen("libnss_sss.so.2", RTLD_NOW); sh$ nm --dynamic --undefined-only .libs/libwbclient.so | grep dlopen U dlopen Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* INTG: Do not use configure time option enable-files-domainLukas Slebodnik2017-05-231-1/+0
| | | | | | | | The implicit_files was started with each test even though was not required. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test: make sure p11_child is build for pam-srv-testsSumit Bose2017-05-231-0/+3
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sssctl: integrate pam_test_client into sssctlSumit Bose2017-04-101-11/+5
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add InfoPipe user lookupSumit Bose2017-04-101-0/+1
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_sifp: update method namesSumit Bose2017-04-101-1/+1
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add SSSD getpwnam lookupSumit Bose2017-04-101-2/+8
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* selinux: Do not fail if SELinux is not managedMichal Židek2017-04-061-0/+1
| | | | | | | | | | | Previously we failed if semanage_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix compilation of libsss_certmap with libcryptoLukas Slebodnik2017-04-031-1/+2
| | | | | | | | | | | CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c:25:18: fatal error: cert.h: No such file or directory #include <cert.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com>
* secrets: use tcurl in proxy providerPavel Březina2017-03-301-0/+3
| | | | | | | | | | | | We switch from http-parser to libcurl for an http client. This gaves us many features for free such as tls and http basic authentication support instead of implementing it on our own. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: Make use of domainResolutionOrderFabiano Fidêncio2017-03-291-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | domainResolutionOrder has been introduced in the previous commits and allows the admin to set up a specific order which the domains will be resolved during a lookup and with this patch we can take advantage of this. In order to have it working a new structure has been added (struct domain_resolution_order) to the responder context and will be used by the cache_req to perform the lookups based on this list. As the ipaDomainResolutionOrder may be set globally on IPA or per View, SSSD does respect the following precedence order: View > Globally. The way the list is built is quite simple, basically having the domains present on ipaDomainResolutionOrder as the first domains (in that specific order) and then appending the remaining domains to this list. The final result is a completely flat list with all the domains respecting the specified order (it's important to remember that the domains not specified won't follow any specific order, they're just "random" based on the domains list present in the responder context. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB/TESTS: Add tests for the domain's resolution order methodsFabiano Fidêncio2017-03-291-0/+16
| | | | | | | | | | | | | | Introduce a new and small set of tests for these new helper methods that are going to be used in different parts of the code in the follow-up patches. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Add methods to deal with the domain's resolution orderFabiano Fidêncio2017-03-291-0/+2
| | | | | | | | | | | | | | | | | | | | In the following-up patches those newly introduced methods will be used to deal with the domainResolutionOrder attribute. The sysdb_update_domain_resolution_order() method is purposely not checking whether a value has changed or not before writing to sysdb and while may not be optimal, the readability of the code has increased a lot by keeping it as simple as possible. Tests for these new methods are part of the next commit. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* intg: fix configure failure with strict cflagsLukas Slebodnik2017-03-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The warning -Wstrict-prototypes is a part of AM_CFLAGS which was appended for CFLAGS in make target intgcheck-prepare. And combination with strict CFLAGS in environment variable (e.g. -Werror) caused failures. sh$ CFLAGS="-Werror" make intgcheck-prepare checking for gcc... gcc checking whether the C compiler works... no configure: error: in `/home/build/sssd/ci-build-debug/intg/bld': configure: error: C compiler cannot create executables configure:3719: checking whether the C compiler works configure:3741: gcc -g3 -O2 -Werror -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wundef -Werror-implicit-function-declaration -Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99 -DKCM_PEER_UID=1000 conftest.c >&5 conftest.c:11:1: error: function declaration isn't a prototype [-Werror=strict-prototypes] main () ^~~~ cc1: all warnings being treated as errors Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KCM: Queue requests by the same UIDJakub Hrozek2017-03-271-1/+20
| | | | | | | | | In order to avoid race conditions, we queue requests towards the KCM responder coming from the same client UID. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Store ccaches in secretsJakub Hrozek2017-03-271-2/+38
| | | | | | | | Adds a new KCM responder ccache back end that forwards all requests to sssd-secrets. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Implement KCM server operationsJakub Hrozek2017-03-271-0/+2
| | | | | | | | | | | | | | | Implements the actual KCM server operations. On a high level, each operation unmarhalls the needed data from the input buffer, calls into the ccache db and marshalls a response. Only the operations that are also implemented by the MIT client are implemented by our KCM server. Resolves: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Add a in-memory credential storageJakub Hrozek2017-03-271-0/+1
| | | | | | | | Implements a simple back end for the ccache module that lets the KCM server store credentials directly in memory. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Implement an internal ccache storage and retrieval APIJakub Hrozek2017-03-271-0/+9
| | | | | | | | | | | | In order for the KCM server to work with ccaches stored in different locations, implement a middle-man between the KCM server and the ccache storage. This module has asynchronous API because we can't assume anything about where the ccaches are stored. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Initial responder build and packagingJakub Hrozek2017-03-271-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the initial build of the Kerberos Cache Manager responder (KCM). This is a deamon that is capable of holding and storing Kerberos ccaches. When KCM is used, the kerberos libraries (invoked through e.g. kinit) are referred to as a 'client' and the KCM deamon is referred to as 'server'. At the moment, only the Heimdal implementation of Kerberos implements the KCM server: https://www.h5l.org/manual/HEAD/info/heimdal/Credential-cache-server-_002d-KCM.html This patch adds a KCM server to SSSD. In MIT, only the 'client-side' support was added: http://k5wiki.kerberos.org/wiki/Projects/KCM_client This page also describes the protocol between the client and the server. The client is capable of talking to the server over either UNIX sockets (Linux, most Unixes) or Mach RPC (macOS). Our server only implements the UNIX sockets way and should be socket-activated by systemd, although can in theory be also ran explicitly. The KCM server only builds if the configuration option "--with-kcm" is enabled. It is packaged in a new subpackage sssd-kcm in order to allow distributions to enable the KCM credential caches by installing this subpackage only, without the rest of the SSSD. The sssd-kcm subpackage also includes a krb5.conf.d snippet that allows the admin to just uncomment the KCM defaults and instructs them to start the socket. The server can be configured in sssd.conf in the "[kcm]" section. By default, the server only listens on the same socket path the Heimdal server uses, which is "/var/run/.heim_org.h5l.kcm-socket". This is, however, configurable. The file src/responder/kcm/kcm.h is more or less directly imported from the MIT Kerberos tree, with an additional sentinel code and some comments. Not all KCM operations are implemented, only those that also the MIT client implements. That said, this KCM server should also be usable with a Heimdal client, although no special testing was with this hybrid. The patch also adds several error codes that will be used in later patches. Related to: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* nss-idmap: add sss_nss_getlistbycert()Sumit Bose2017-03-231-1/+1
| | | | | | | | | This patch adds a getlistbycert() call to libsss_nss_idmap to make it on par with InfoPipe. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add certmap related callsSumit Bose2017-03-231-0/+17
| | | | | | | | | | Add sysdb calls to write and read data for the certificate mapping library to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-231-0/+1
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* certmap: add placeholder for OpenSSL implementationSumit Bose2017-03-231-8/+22
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* certmap: add new library libsss_certmapSumit Bose2017-03-231-0/+55
| | | | | | | | | | | | | | | | With this library it would be possible to map certificates and users not only by adding the full certificate to the user's LDAP object but by adding e.g. only parts like the issuer and subject name. Additionally the library is also able to flexible select/match certificates based on values in the certificate. Details about mapping and matching rules can be found in the included man page. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* split_on_separator: move to a separate fileSumit Bose2017-03-231-7/+23
| | | | | | | | | | To be able to include split_on_separator() without additional dependencies (only talloc), it is moved into a separate file. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: test the curl wrapper with a command-line toolJakub Hrozek2017-03-141-0/+20
| | | | | | | | | In order to test the curl integration code, this patch adds a command-line tool and tests that it's possible to drive a conversation with the secrets responder using the tool. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-08 02:59:11 +0000