summaryrefslogtreecommitdiffstats
path: root/src/db
Commit message (Collapse)AuthorAgeFilesLines
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-09-011-0/+1
| | | | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> (cherry picked from commit 2e505786d6d9d537f5b6631099862f6b93e2e687) (cherry picked from commit ff9d6533654d4529e681fbbfa6f118f975e5a333)
* SYSDB: Only process aliases if they are non-NULLJakub Hrozek2016-11-241-1/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Adding lowercase sudoUser formPetr Čech2016-11-242-6/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If domain is not case sensitive we add lowercase form of usernames to sudoUser attributes. So we actually able to apply sudoRule on user Administrator@... with login admnistrator@... This patch is squashed with Resolves: https://fedorahosted.org/sssd/ticket/3203 (cherry picked from commit f4a1046bb88d7a0ab3617e49ae94bfa849d10645) Squashed with: SYSDB: Fixing of sudorule without a sudoUser This patch solved a regression caused by the recent patches to lowercase sudoUser -- in case sudoUser is missing completely, we abort the processing of this rule and all others. With this patch, we return ERR_MALFORMED_ENTRY and gracefully skip the malformed rule instead. Resolves: https://fedorahosted.org/sssd/ticket/3241 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Fix error handling in sysdb_get_user_members_recursivelyLukas Slebodnik2016-11-082-1/+7
| | | | | | | We ignored failures from sysdb_search_entry Reviewed-by: Petr Čech <pcech@redhat.com> (cherry picked from commit b969ccc2cc58fdf761e5d314de9217f2d914bc9b)
* SYSDB: Sanitize dn in sysdb_get_user_members_recursivelyLukas Slebodnik2016-11-081-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | There was a crash in nss responder when a group contained a user with special charactes which shoudl be sanitized before using in filter. ==31651== Conditional jump or move depends on uninitialised value(s) ==31651== at 0x8BEA7DE: _talloc_steal_loc (talloc.c:1215) ==31651== by 0x5264889: sysdb_get_user_members_recursively (sysdb_ops.c:4759) ==31651== by 0x5278F61: sysdb_add_group_member_overrides (sysdb_views.c:1375) ==31651== by 0x526677C: sysdb_getgrnam_with_views (sysdb_search.c:799) ==31651== by 0x1172F6: nss_cmd_getgrnam_search (nsssrv_cmd.c:3168) ==31651== by 0x119C67: nss_cmd_getby_dp_callback (nsssrv_cmd.c:1382) ==31651== by 0x10FD14: nsssrv_dp_send_acct_req_done (nsssrv_cmd.c:916) ==31651== by 0x12898B: sss_dp_internal_get_done (responder_dp.c:791) ==31651== by 0x58FF861: complete_pending_call_and_unlock (dbus-connection.c:2314) ==31651== by 0x5902B50: dbus_connection_dispatch (dbus-connection.c:4580) ==31651== by 0x527F261: sbus_dispatch (sssd_dbus_connection.c:96) ==31651== by 0x89D8B4E: tevent_common_loop_timer_delay (tevent_timed.c:341) Resolves: https://fedorahosted.org/sssd/ticket/3121 Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 31fdda9759a8a03081b5ab6307a5e8ce4cbe50d2)
* views: properly override group member namesSumit Bose2016-11-083-119/+118
| | | | | | | Resolves https://fedorahosted.org/sssd/ticket/2948 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 1594701fbdc341069e11cff9a85e7a795e52db3d)
* sysdb: add sysdb_get_user_members_recursively()Sumit Bose2016-11-082-0/+66
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 17bfd9f69251781140e4b2b55ffeb649d7a79e86)
* views: allow override added for non-default views at runtimeSumit Bose2016-07-131-8/+18
| | | | | | | | | | | | | | | Currently a new override for a non-default view cannot be displayed at run-time. It even does not only require a restart but the view must be un-applied and applied again to make the changes visible. This patch fixes this and makes non-default view behave like the default view where the data from a newly added override are displayed after the cached entry of the related object is expired. Resolves https://fedorahosted.org/sssd/ticket/3092 Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 26a3d4f2ef35a088e4c5fc928290052c89a2ff43)
* SYSDB: Fixing DB updatePetr Cech2016-07-111-3/+19
| | | | | | | | | | | | | | | Functions sysdb_user_base_dn() and sysdb_group_base_dn() expect that struct sss_domain_info contains pointer to struct sysdb_ctx. This is not true in case of sysdb_upgrade functions. This patch fixes the situation and revert code to the state before 12a000c8c7c07259e438fb1e992134bdd07d9a30 commit. Resolves: https://fedorahosted.org/sssd/ticket/3023 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 311836214245600566f881ff6253594e0999008e)
* IPA SUDO: download externalUser attributePavel Březina2016-03-091-0/+1
| | | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 991c9f47fcb24704b880f60ab8ee77cfda056e2c)
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-012-0/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 5ff7a765434ed0b4d37564ade26d7761d06f81c3)
* remove user certificate if not found on the serverPavel Březina2016-03-012-1/+47
| | | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 659232f194f83ec7c450ce89c3fd41e4e74409f2)
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-241-0/+1
| | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 3cf7fdfcaedb986f42a6640e26aa057007b64045)
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-191-0/+3
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit a7d2b4f157194c14bc4a40c74f6416b82befa460)
* IPA SUDO: Add ipasudocmd mappingPavel Březina2016-01-191-0/+3
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit cc7766c8456653ab5d7dedbf432cb1711a905804)
* IPA SUDO: Add ipasudocmdgrp mappingPavel Březina2016-01-191-0/+2
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit ed8650be18af26b7bf389e1246f7e8cdb363f829)
* IPA SUDO: Add ipasudorule mappingPavel Březina2016-01-191-0/+20
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit a2057618f30a3c64bdffb35a2ef3c2ba148c8a03)
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-194-69/+339
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 68abbe716bed7c8d6790d9bec168ef44469306a1)
* SYSDB: Add missing include to sysdb_services.hPavel Březina2015-12-141-0/+2
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 50310d617e25abf118fbd867cbdc0fbc866277b5)
* IPA: fix override with the same nameSumit Bose2015-11-202-4/+18
| | | | | | | | | | | | | If the user name of a AD user is overridden with the name itself in an IPA override object SSSD adds this name twice to the alias list causing an ldb error when trying to write the user object to the cache. As a result the user is not available. This patch makes sure that there are no duplicated alias names. Resolves https://fedorahosted.org/sssd/ticket/2874 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use get_next_domain instead of dom->nextMichal Židek2015-10-301-2/+2
| | | | | | | | Recent get_next_domain refactoring enabled us to use it also for disabled domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 2bbc9d6f8d5f2c1b07fd6968314b7f530b7f3a4d)
* sysdb: Include disabled domains in link_forest_rootsMichal Židek2015-10-301-1/+1
| | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit f191a6f9f3313df88eaf3debf52eebfe5d3dee59)
* util: Update get_next_domain's interfaceMichal Židek2015-10-301-3/+4
| | | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 877b92e80bde510d5cd9f03dbf01e2bcf73ab072)
* nss: fix UPN lookups for sub-domain usersSumit Bose2015-10-081-1/+1
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 8ded8b2f4a57d1833fd230307218d8b07a571785)
* fix ldb_search usageSumit Bose2015-10-081-8/+1
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 391b81f2a78a812a87530e0c50c70d59150f49eb)
* cache_req: add support for UPNPavel Březina2015-10-083-18/+162
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 28ebfa4373d1e7ce45b5d70a3619df1c074a661e)
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-211-2/+5
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: allow ghost members for LOCAL viewPavel Březina2015-09-181-16/+20
| | | | | | | | | | | LOCAL view does not allow the case when both ghost member and user override is created so it is safe to allow ghost members for this view. Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: fix two typos in debug messagesPavel Březina2015-09-181-2/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: do not require overrideDN in grous when LOCAL view is setPavel Březina2015-09-181-0/+6
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add function to expire entryMichal Židek2015-09-032-1/+78
| | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 Added function to expire entry in sysdb using its DN. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Index the objectSIDString attributeJakub Hrozek2015-08-193-1/+61
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SYSDB: prepare for LOCAL viewPavel Březina2015-07-272-1/+20
| | | | | | | | | | | | Objects doesn't have to have overrideDN specified when using LOCAL view. Since the view is not stored on the server we do not want to contact LDAP therefore we special case LOCAL view saying that it is OK that this attribute is missing. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Update few debug messagesLukas Slebodnik2015-07-171-3/+4
| | | | | | | | | It reduces a noise caused by canonicalization of non-existing user. Resolves: https://fedorahosted.org/sssd/ticket/2678 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Add functions to look up multiple entries including name and custom ↵Jakub Hrozek2015-07-152-19/+137
| | | | | | | | | | | | | | | | | | | filter Related: https://fedorahosted.org/sssd/ticket/2553 Adds new sysdb function: - sysdb_enumpwent_filter - sysdb_enumpwent_filter_with_views - sysdb_enumgrent_filter - sysdb_enumgrent_filter_with_views These are similar to enumeration functions, but optionally allow to specify a filter to be applied on user/group names. Also an additional custom filter can be applied. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Minor code improvementsPavel Reichl2015-07-061-1/+0
| | | | | | | | pam_helpers.h had to be included after util.h. Removed exara empty line. Fixed code alignment Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: new attribute lastOnlineAuthWithCurrentTokenPavel Reichl2015-07-061-0/+1
| | | | | | | | | | | | | | Introduce new user attribute lastOnlineAuthWithCurrentToken. This attribute behaves similarly to lastOnlineAuth but is set to NULL after password is changed. This attribute is needed for use-case when cached authentication is used, to request online authentication after password is locally changed. Resolves: https://fedorahosted.org/sssd/ticket/1807 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-022-2/+12
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sysdb: add sysdb_search_user_by_cert() and sysdb_search_object_by_cert()Sumit Bose2015-06-192-0/+49
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: add ldap_user_certificate optionSumit Bose2015-06-191-0/+1
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object]Pavel Březina2015-06-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2338 Example use: $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByName \ string:admin object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Store boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ object path "/org/freedesktop/sssd/infopipe/Users/ipaldap/397400000" ] $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users/ipaldap/397400000 \ org.freedesktop.sssd.infopipe.Cache.Object.Remove boolean true $ dbus-send --print-reply --system \ --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Cache.List array [ ] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Add a forest root attribute to sss_domain_infoJakub Hrozek2015-06-141-0/+66
| | | | | | | | Instead of complex forest root search methods, establish forest root during subdomain list update. The subdomain code can then just use the forest_root pointer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-142-2/+24
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL/SYSDB: Move new_subdomain() to sysdb_subdomains.c and make it privateJakub Hrozek2015-06-142-0/+150
| | | | | | | | | | | In order to make updating the subdomain list a two-step process. Therefore we need to make sure that update_subdomains() is the only interface towards the SSSD that changes the subdomain list. Move the new_subdomain() function to sysdb_subdomains.c and only make it available through a private header so it's usable by unit tests. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-142-5/+50
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Do not print verbose DEBUG messages from providers that don't set UUIDJakub Hrozek2015-06-041-1/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2666 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* 2FA offline authSumit Bose2015-05-081-2/+75
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_cache_password_ex()Sumit Bose2015-05-082-3/+31
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-11/+21
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: enhance ipa_initgr_get_overrides_send()Sumit Bose2015-05-051-0/+5
| | | | | | | | | This patch makes ipa_initgr_get_overrides_send() public and add support to search overrides by UUID or by SID. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 09:02:54 +0000