summaryrefslogtreecommitdiffstats
path: root/src/config
Commit message (Collapse)AuthorAgeFilesLines
* secrets: allow to configure certificate checkPavel Březina2017-03-303-0/+18
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-303-0/+3
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CONFDB: Allow configuring [application] sections as non-POSIX domainsJakub Hrozek2017-03-301-1/+8
| | | | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Allows to add a new section: [application/$name] This section internally (on the confdb level) expands to: [domain/$name] domain_type = application The reasons to add this new section is two-fold. One, to make the configuration of application domains more explicit and two, to make it possible to share configuration between two domains, one POSIX and one non-POSIX by application domain's inherit_from option: [application/$name] inherit_from = posix_domain_name Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Introduce SSSD domain type to distinguish POSIX and application domainsJakub Hrozek2017-03-304-0/+5
| | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new option that allows to distinguish domains that do contain POSIX users and groups and those that don't. The POSIX domains are the default. The non-POSIX domains are selected by selecting an "application" type domain. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add domain_resolution_order config optionFabiano Fidêncio2017-03-294-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | This is the local equivalent of option of ipaDomainResolutionOrder and has precedence over the ones set on IPA side making the precedence order to be like: Local > View > Globally. As done for the IPA side configurations, the domains which were not explicitly set up will be apennded to the final of the domain_resolution_order list in the very same order they're presented in the "domains" option of [sssd] section in the config file. There's no guarantee of order for the subdomains though. It's also important to mention that no expansion magic is performed on our side. It means that if 'example.com' is set it does *not* stand for all its subdomains DNS wise (like 'foo.example.com', 'bar.example.com', etc). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SSSDConfig: Python 3.6 invalid escape sequence deprecation fixVille Skyttä2017-03-271-1/+1
| | | | | | | | https://docs.python.org/3/whatsnew/3.6.html#deprecated-python-behavior Merges: https://pagure.io/SSSD/sssd/pull-request/3346 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Idle-terminate the responder if the secrets back end is usedJakub Hrozek2017-03-271-0/+1
| | | | | | | | | Existing with memory database would be fatal as we keep the ccaches in memory then, but if the ccaches are stored in sssd-secrets, we can just exit on idle. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Make the secrets ccache back end configurable, make secrets the defaultJakub Hrozek2017-03-271-0/+1
| | | | | | | | | Adds a new option 'ccache_storage' that allows to select either the memory back end or the secrets back end. The secrets back end is the default one and this option is even undocumented. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Initial responder build and packagingJakub Hrozek2017-03-271-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the initial build of the Kerberos Cache Manager responder (KCM). This is a deamon that is capable of holding and storing Kerberos ccaches. When KCM is used, the kerberos libraries (invoked through e.g. kinit) are referred to as a 'client' and the KCM deamon is referred to as 'server'. At the moment, only the Heimdal implementation of Kerberos implements the KCM server: https://www.h5l.org/manual/HEAD/info/heimdal/Credential-cache-server-_002d-KCM.html This patch adds a KCM server to SSSD. In MIT, only the 'client-side' support was added: http://k5wiki.kerberos.org/wiki/Projects/KCM_client This page also describes the protocol between the client and the server. The client is capable of talking to the server over either UNIX sockets (Linux, most Unixes) or Mach RPC (macOS). Our server only implements the UNIX sockets way and should be socket-activated by systemd, although can in theory be also ran explicitly. The KCM server only builds if the configuration option "--with-kcm" is enabled. It is packaged in a new subpackage sssd-kcm in order to allow distributions to enable the KCM credential caches by installing this subpackage only, without the rest of the SSSD. The sssd-kcm subpackage also includes a krb5.conf.d snippet that allows the admin to just uncomment the KCM defaults and instructs them to start the socket. The server can be configured in sssd.conf in the "[kcm]" section. By default, the server only listens on the same socket path the Heimdal server uses, which is "/var/run/.heim_org.h5l.kcm-socket". This is, however, configurable. The file src/responder/kcm/kcm.h is more or less directly imported from the MIT Kerberos tree, with an additional sentinel code and some comments. Not all KCM operations are implemented, only those that also the MIT client implements. That said, this KCM server should also be usable with a Heimdal client, although no special testing was with this hybrid. The patch also adds several error codes that will be used in later patches. Related to: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* CACHE_REQ: Check the caches firstFabiano Fidêncio2017-03-144-0/+10
| | | | | | | | | | | | | | | | | | | This patch introduces a new configurable option to define whether the responder should query all domains' caches before querying the Data Providers. This new option is called cache_first and, by default, it's disabled, meaning that, for each provider, the responder may contact the cache and the data provider in the same iteration. Co-Author: Pavel Březina <pbrezina@redhat.com> Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SECRETS: Shutdown the responder in case it becomes idleFabiano Fidêncio2017-03-081-0/+1
| | | | | | | | | | | | | Similarly to what has been done for the other responders, let's shutdown the secrets responder in case it becomes idle. Resolves: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use pagure links as a reference to upstreamLukas Slebodnik2017-02-281-1/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MONITOR: Enable an implicit files domain if one is not configuredJakub Hrozek2017-02-274-1/+5
| | | | | | | | | | | | | | | | | If SSSD is compiled with --enable-files-domain, the loading of the domains changes such that: * if no domain with id_provider=files exists in the config file, an implicit SSSD files domain is added * this domain is always first in the list The administrator is free to create a files domain in the config file himself and either place it at the end of the list or not enable it at all. Resolves: https://pagure.io/SSSD/sssd/issue/3112 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idleFabiano Fidêncio2017-01-234-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit introduces a new option for the responders called responder_idle_timeout, which specifies the number of seconds that the responder process can be up without being used. The default value is 300 seconds (5 minutes) and can be configured per responder, being 60 seconds the minimum acceptable value. Is important to note that setting "responder_idle_timeout = 0" disables the responder timeout, which makes sense for the responders that always will be running. The shutdown timeout is activated per responder in case the responder has been {dbus,socket}-activated. In case of any commnunication with the responder the timeout is reset thereby ensuring we won't shutdown a responder that is not idle. Setting the responder's last request time is done slightly differently for socket-activated and dbus-activated responders. In both cases it's updated in any internal communication in sbus_message_handler(), but for the socket-activated responders it's also updated when the responder's socket is used. Currently it works properly with all responders but the secrets one, which has a different logic and must be treated separately in case some change is required there. Is worth to mention that this commit does not affect the responders explicitly configured in the "services" line of sssd.conf. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Add configurable payload size limit of a secretFabiano Fidêncio2016-11-243-0/+3
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3169 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Add allowed_sec_users_optionsFabiano Fidêncio2016-11-101-5/+10
| | | | | | | | | | | There are options (the proxying related ones) that only apply to the secrets' subsections. In order to make config API able to catch those, let's create a new section called allowed_sec_users_options) and move there these proxying options. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Fix secrets rule in the allowed sectionsFabiano Fidêncio2016-11-101-2/+2
| | | | | | | | | | | | | | We have been matching an invalid subsection of the secrets' section, like: [secrets/users/] Let's ensure that we only match the following cases: [secrets] [secrets/users/[0-9]+] Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: add pam_response_filter optionSumit Bose2016-11-023-0/+3
| | | | | | | | | Currently the main use-case for this new option is to not set the KRB5CCNAME environment varible for services like 'sudo-i'. Resolves https://fedorahosted.org/sssd/ticket/2296 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Add a configurable limit of secrets that can be storedFabiano Fidêncio2016-10-053-0/+3
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3169 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Add a configurable depth limit for nested containersFabiano Fidêncio2016-10-033-0/+3
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3168 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: Add secrets provider optionsFabiano Fidêncio2016-10-033-2/+27
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/3207 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: List allowed secrets responder optionsJakub Hrozek2016-10-031-0/+27
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3207 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: Add secrets responder to the allowed sectionsFabiano Fidêncio2016-10-031-0/+1
| | | | | | | | | | | | | | | | | The regular expression used is quite specific for the two cases we support: - [secrets] - [secrets/users/$uid] It could be done a bit more generic, but the way it's right now it can easily catch errors like: [secrets/usrs/$uid] or [secrets/]. Related: https://fedorahosted.org/sssd/ticket/3207 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSDConfig: Do not fail with nonexisting domains/servicesLukas Slebodnik2016-09-223-2/+48
| | | | | | | | | | dict.keys() returns iterator in python3 and not list Chaging data in dictionary while using iterator fails with "RuntimeError: dictionary changed size during iteration" https://fedorahosted.org/sssd/ticket/3107 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-133-0/+5
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Add disable_netlink optionJustin Stephenson2016-09-124-1/+5
| | | | | | | | | | | | Adding a new monitor boolean option to disable netlink support. This will give users more control over sssd state changes without having to modify systemd unit files. Resolves: https://fedorahosted.org/sssd/ticket/3142 Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Remove leftovers from kill_serviceFabiano Fidêncio2016-08-314-16/+0
| | | | | | | | | | | | | | | Seems that wen I sent the v2 of ac35fe74 I attached the wrong pacth that ended up being pushed. The patch was incomplete as there are still some leftovers. The .po and sssd-docs.pot were not touched as I do believe they are autogenerated from Zanata. Related: https://fedorahosted.org/sssd/ticket/3052 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove leftovers from diag_cmdFabiano Fidêncio2016-08-314-12/+0
| | | | | | | | | | | | Seems that when I sent the v2 of 7579cf99 I attached the wrong patch that ended up being pushed. That patch was incomplete as there are still some leftovers. Related: https://fedorahosted.org/sssd/ticket/3051 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* CONFIG: session_provider does not exist anymoreJakub Hrozek2016-08-234-5/+0
| | | | | | | | | The session_provider used to exist a long time ago when we used to set the SELinux context from it, but the provider had been removed for a long time. We just forgot to remove the value from the config API and the validator. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: selinux_provider is a valid provider typeJakub Hrozek2016-08-234-0/+5
| | | | | | | We should not warn about it in the validator and should allow selinux_provider from the config API. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* AD_PROVIDER: Add ad_enabled_domains optionPetr Cech2016-08-173-0/+3
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIG: re_expression is an allowed option for all domainsJakub Hrozek2016-08-124-0/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIG: full_name_format is an allowed option for all domainsJakub Hrozek2016-08-124-0/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config_schema: Add ldap_user_email to schemaLukas Slebodnik2016-08-101-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-294-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* config: Add config_file_version to schemaMichal Židek2016-07-123-0/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: Allow timeout for all sevicesMichal Židek2016-07-122-1/+8
| | | | | | | | | | Allow option "timeout" for all sevices. Also remove unused macro CONFDB_SERVICE_TIMEOUT. Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: Fix user_attributesMichal Židek2016-07-123-2/+3
| | | | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/3068 Option user_attributes is also available in NSS responder, but not in PAC responder. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: override_space is monitor's optionMichal Židek2016-07-124-4/+5
| | | | | | | | | | We read override_space from [sssd] not [nss] section. Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Monitor: Remove ping infrastructureSimo Sorce2016-06-291-1/+1
| | | | | | | | | | | Now thast services use an internal watchdog we do not need pings anymore, this will cut down the chatter and allow more flexible process management, for example socket activation and exit-on-idle. Resolves: https://fedorahosted.org/sssd/ticket/2921 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Prepare ini schema with rules for validationLukas Slebodnik2016-06-271-0/+615
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2028 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DEBUG: Add `debug` alias for debug_levelStephen Gallagher2016-06-163-0/+6
| | | | | | | | | | | | | Our users constantly make the mistake of typing `debug = 9` in the sssd.conf instead of `debug_level = 9` as would be correct. This happens frequently-enough that we should just alias it rather than continue to have people make mistakes. Resolves: https://fedorahosted.org/sssd/ticket/2999 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Petr Cech <pcech@redhat.com>
* RESPONDERS: Negative caching of local usersPetr Cech2016-06-102-0/+2
| | | | | | | | | | | This patch adds new option 'neg_cache_locals_timeout' into section of NSS responder. It allows negative caching of local groups and users. Default value is 0 which means no caching. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* p11: add missing man page entry and config APISumit Bose2016-06-092-0/+4
| | | | | | | The pam_cert_auth and pam_cert_db_path option where missing in the config API and had no man page entries. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: only save PAC blob into the cacheSumit Bose2016-04-132-0/+2
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2158 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-091-0/+1
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-244-0/+4
| | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Pass account lockout status and display messagePavel Reichl2016-02-172-0/+2
| | | | | | | | | Tested against Windows Server 2012. Resolves: https://fedorahosted.org/sssd/ticket/2839 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IDMAP: Add support for automatic adding of rangesPavel Reichl2016-01-204-0/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: add task to renew the machine account password if neededSumit Bose2016-01-192-0/+4
| | | | | | | | | | | | | | | | | | AD expects its clients to renew the machine account password on a regular basis, be default every 30 days. Even if a client does not renew the password it might not cause issues because AD does not enforce the renewal. But the password age might be used to identify unused machine accounts in large environments which might get disabled or deleted automatically. With this patch SSSD calls an external program to check the age of the machine account password and renew it if needed. Currently 'adcli' is used as external program which is able to renew the password since version 0.8.0. Resolves https://fedorahosted.org/sssd/ticket/1041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-18 00:34:57 +0000