summaryrefslogtreecommitdiffstats
path: root/src/db/sysdb_subdomains.c
Commit message (Collapse)AuthorAgeFilesLines
* RESPONDER: Use fqnames as output when neededFabiano Fidêncio2017-06-211-0/+7
| | | | | | | | | | | | | | | | | | | | | | As some regressions have been caused by not handling properly naming conflicts when using shortnames, last explicitly use fully qualified names as output in the following situations: - domain resolution order is set; - a trusted domain has been using `use_fully_qualified_name = false` In both cases we want to ensure that even handling shortnames as input, the output will always be fully qualified. As part of this patch, our tests ended up being modified to reflect the changes done. In other words, the tests related to shortnames now return expect as return a fully qualified name for trusted domains. Resolves: https://pagure.io/SSSD/sssd/issue/3403 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from ipaConfigFabiano Fidêncio2017-03-291-0/+67
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-291-3/+60
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Store UPN suffixes when creating a new subdomainJakub Hrozek2017-03-021-1/+10
| | | | | | | | | We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Removing of sysdb_try_to_find_expected_dn()Petr Čech2017-02-081-332/+0
| | | | | | | | | | | | | | | | Currently in order to match multiple LDAP search results we use two different functions - we have sysdb_try_to_find_expected_dn() but also sdap_object_in_domain(). This patch removes sysdb_try_to_find_expected_dn() and add new sdap_search_initgr_user_in_batch() based on sdap_object_in_domain(). This function covers necessary logic. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as wellJakub Hrozek2016-11-031-0/+99
| | | | | | | | | | | | | | | | | | | In cases where the domain name in sssd.conf does not match the AD domain, our previous matching process wouldn't match. This patch augments the matching as follows: - the search base is known to sysdb_try_to_find_expected_dn and is expected to be non-NULL - the existing matching is ran first - during the search base, matching, all the non-DC components are stripped from the search base to 'canonicalize' the search base - if only a single entry that matches with a non-DC DN component (matching with a DC component would mean the DN comes from a different domain) then this entry is a match and is returned Resolves: https://fedorahosted.org/sssd/ticket/3199 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Split sysdb_try_to_find_expected_dn() into smaller functionsJakub Hrozek2016-11-031-99/+179
| | | | | | | | | | The function sysdb_try_to_find_expected_dn was performing several matching algorithms and thus it was getting big and hard to extend. This patch doesn't contain any functional changes, only shuffles the code around and splits the monolithic sysdb_try_to_find_expected_dn function into smaller blocks. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb_master_domain_add_info: properly set do_updateSumit Bose2016-07-251-2/+2
| | | | | | | do_update should be only set if there is a change, i.e if something was added to the ldb_message. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: make subdomain calls aware of upn_suffixesSumit Bose2016-07-181-3/+53
| | | | | | | sysdb_subdomain_store() and sysdb_update_subdomains() can now update upn_suffixes as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add UPN suffix support for the master domainSumit Bose2016-07-181-2/+47
| | | | | | | sysdb_master_domain_update() and sysdb_master_domain_add_info() are now aware of the UPN suffix attribute. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-011-0/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use get_next_domain instead of dom->nextMichal Židek2015-10-231-2/+2
| | | | | | | Recent get_next_domain refactoring enabled us to use it also for disabled domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Include disabled domains in link_forest_rootsMichal Židek2015-10-231-1/+1
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-231-3/+4
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-211-2/+5
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-021-2/+1
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Add a forest root attribute to sss_domain_infoJakub Hrozek2015-06-141-0/+66
| | | | | | | | Instead of complex forest root search methods, establish forest root during subdomain list update. The subdomain code can then just use the forest_root pointer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-141-1/+21
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL/SYSDB: Move new_subdomain() to sysdb_subdomains.c and make it privateJakub Hrozek2015-06-141-0/+133
| | | | | | | | | | | In order to make updating the subdomain list a two-step process. Therefore we need to make sure that update_subdomains() is the only interface towards the SSSD that changes the subdomain list. Move the new_subdomain() function to sysdb_subdomains.c and only make it available through a private header so it's usable by unit tests. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-141-4/+47
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: add view data to domainsSumit Bose2014-10-201-0/+116
| | | | | | | The information about view is read from the cache and added to the domain structs accordingly. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responder: Set forest attribute in AD domainsPavel Reichl2014-01-091-1/+34
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2160
* IPA: store forest name for forest member domainsSumit Bose2013-09-271-3/+48
| | | | | In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
* Read enumerate state for subdomains from cacheJakub Hrozek2013-08-281-1/+15
| | | | | The enumerate flag will be read from the cache for subdomains and the domain object will be created accordingly.
* SYSDB: Store enumerate flag for subdomainJakub Hrozek2013-08-281-2/+25
|
* DB: remove unused realm parameter from sysdb_master_domain_add_infoJakub Hrozek2013-08-281-20/+1
| | | | The parameter was not used at all.
* DB: Update sss_domain_info with new updated dataJakub Hrozek2013-08-281-5/+5
|
* Read mpg state for subdomains from cacheSumit Bose2013-06-281-5/+19
| | | | | The mpg flag will be read from the cache for subdomains and the domain object will be created accordingly.
* Save mpg state for subdomainsSumit Bose2013-06-281-3/+30
| | | | | | The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
* Change the way domains are linked.Simo Sorce2013-02-101-101/+66
| | | | | | | | | | | | | | | | | | | - Use a double-linked list for domains and subdomains. - Never remove a subdomain, simply mark it as disabled if it becomes unused. - Rework the way subdomains are refreshed. Now sysdb_update_subdomains() actually updates the current subdomains and marks as disabled the ones not found in the sysdb or add new ones found. It never removes them. Removal of missing domains from sysdb is deferred to the providers, which will perform it at refresh time, for the ipa provider that is done by ipa_subdomains_write_mappings() now. sysdb_update_subdomains() is then used to update the memory hierarchy of the subdomains. - Removes sysdb_get_subdomains() - Removes copy_subdomain() - Add sysdb_subdomain_delete()
* Remove sysdb_subdom completelySimo Sorce2013-02-101-19/+5
| | | | | struct sss_domain_info is always used to represent domains now. Adjust tests accordingly.
* Add sysdb_subdomain_store() functionSimo Sorce2013-02-101-37/+98
| | | | Replaces sysdb_add_subdomain_attributes and is a public sysdb interface.
* Refactor sysdb_master_domain_add_info()Simo Sorce2013-02-101-24/+19
|
* Update main domain info in placeSimo Sorce2013-02-101-32/+29
|
* Avoid sysdb_subdom in sysdb_get_subdomains()Simo Sorce2013-02-101-55/+35
|
* Stop creating fake sysdb contextsSimo Sorce2013-01-151-20/+0
| | | | | | Now that the sysdb context does not contain anymore domain related data we can simply stop creating faxe sysdb context and just reference the parent context.
* Kill sysdb->domainSimo Sorce2013-01-151-2/+0
| | | | Finally remove this upside-down dependency.
* Move mpg flag to the domain where it belongsSimo Sorce2013-01-151-1/+0
| | | | | A sysdb contains now multiple domains, but the mpg property is a property of a specific domain not of the underlying database.
* Add domain to some subdomain functionsSimo Sorce2013-01-151-5/+6
|
* Add domain argument to sysdb_delete_group()Simo Sorce2013-01-151-15/+0
| | | | Also remove sysdb_delete_domgroup()
* Add domain argument to sysdb_delete_user()Simo Sorce2013-01-151-8/+0
| | | | Also remove sysdb_delete_domuser()
* Add domain argument to sysdb_store_group()Simo Sorce2013-01-151-13/+0
| | | | Also remove sysdb_store_domgroup()
* Add domain argument to sysdb_store_user()Simo Sorce2013-01-151-18/+0
| | | | Also remove sysdb_store_domuser()
* Add domain to sysdb_search_group_by_gid()Simo Sorce2013-01-151-11/+0
| | | | Also remove unused sysdb_search_domgroup_by_gid()
* Add domain to sysdb_search_group_by_name()Simo Sorce2013-01-151-12/+0
| | | | Also remove unused sysdb_search_domgroup_by_name()
* Add domain to sysdb_search_user_by_uid()Simo Sorce2013-01-151-11/+0
| | | | Also remove unused sysdb_search_domuser_by_uid()
* Add domain to sysdb_search_user_by_name()Simo Sorce2013-01-151-11/+0
| | | | Also remove unused sysdb_search_domuser_by_name()
* Pass domain to sysdb_get<pw/gr>nam() functionsSimo Sorce2013-01-151-40/+0
| | | | | | Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore fqnames proper value in subdomains, by testing for a parent domain being present or not.
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-201-1/+1
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
generated by cgit (git 2.34.1) at 2025-09-02 19:31:08 +0000