summaryrefslogtreecommitdiffstats
path: root/src/db
Commit message (Collapse)AuthorAgeFilesLines
* SYSDB: Only generate new UID in local domainJakub Hrozek2017-03-301-0/+6
| | | | | | | | | | To avoid issues where a user with no UID but without the posix=false flag was passed to sysdb, we only allow generating the new ID in the local domain. This might prevent bugs where non-POSIX users would get a UID created by sysdb which might allow accessing resources owned by that UID. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Allow storing non-POSIX usersJakub Hrozek2017-03-301-9/+23
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 We already do the same for groups. If the user does not have UID number set but does have the POSIX: false attribute set, then we save the user with zero UID and the non-POSIX flag. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from IPA ID ViewFabiano Fidêncio2017-03-292-0/+75
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from ipaConfigFabiano Fidêncio2017-03-292-0/+78
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Add methods to deal with the domain's resolution orderFabiano Fidêncio2017-03-293-0/+208
| | | | | | | | | | | | | | | | | | | | In the following-up patches those newly introduced methods will be used to deal with the domainResolutionOrder attribute. The sysdb_update_domain_resolution_order() method is purposely not checking whether a value has changed or not before writing to sysdb and while may not be optimal, the readability of the code has increased a lot by keeping it as simple as possible. Tests for these new methods are part of the next commit. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-293-5/+64
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sysdb: add certmap related callsSumit Bose2017-03-232-0/+452
| | | | | | | | | | Add sysdb calls to write and read data for the certificate mapping library to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-232-3/+3
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: always store the certificate from the requestSumit Bose2017-03-232-2/+3
| | | | | | | | | | Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_get_users_send(): new argument mapped_attrsSumit Bose2017-03-232-0/+64
| | | | | | | | | | | | | | | | mapped_attrs can be a list of sysdb_attrs which are not available on the server side but should be store with the cached user entry. This is needed e.g. when the input to look up the user in LDAP is not an attribute which is stored in LDAP but some data where LDAP attributes are extracted from. The current use case is the certificate mapping library which can create LDAP search filters based on content of the certificate. To allow upcoming cache lookup to use the input directly it is stored in the user object in the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_attrs_copy()Sumit Bose2017-03-232-0/+25
| | | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: allow multiple results for searches by certificateSumit Bose2017-03-101-7/+10
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_cache: User/groups invalidation in domain cachePetr Čech2017-03-082-0/+74
| | | | | | | | | | | | | | | | | | When a group/users are invalidated from sss_cache, the group/user information in domain and timestamps cache are inconsistent with regard to dataExpireTimestamp attribute. This patch fixes the problem by explicitly invalidating the domain cache's entry when the timestamp cache entry is invalidated by sss_cache call. There is one new function: * sysdb_invalidate_cache_entry() provided for this purpose and used only in sss_cache utility. Resolves: https://fedorahosted.org/sssd/ticket/3164 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-033-5/+15
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Store UPN suffixes when creating a new subdomainJakub Hrozek2017-03-022-1/+11
| | | | | | | | | We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: Only store lowercased attribute value onceJakub Hrozek2017-02-101-14/+3
| | | | | | | | | | | | | | | | | | | The current code doesn't handle the situation where lowercasing the sudoUser attribute would yield the same value again. For example: sudoUser: TUSER sudoUser tuser would break. This patch switches to using the utility function sysdb_attrs_add_lower_case_string() which already checks for duplicates. Resolves: https://fedorahosted.org/sssd/ticket/3301 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Removing of sysdb_try_to_find_expected_dn()Petr Čech2017-02-082-338/+0
| | | | | | | | | | | | | | | | Currently in order to match multiple LDAP search results we use two different functions - we have sysdb_try_to_find_expected_dn() but also sdap_object_in_domain(). This patch removes sysdb_try_to_find_expected_dn() and add new sdap_search_initgr_user_in_batch() based on sdap_object_in_domain(). This function covers necessary logic. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-02-011-0/+1
| | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sysdb: Search also aliases in sysdb_search_object_by_nameLukas Slebodnik2017-01-232-3/+30
| | | | | | | | | sysdb_search_object_by_name did not work well case insensitive domain. Resolves: https://fedorahosted.org/sssd/ticket/3284 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Update filter for get object by idLukas Slebodnik2017-01-231-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3283 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: add object by idPavel Březina2016-12-192-12/+59
| | | | | | | | | This request returns either user or group object. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: add object by namePavel Březina2016-12-192-0/+17
| | | | | | | | | This request returns either user or group object. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Suppress sysdb_delete_ts_entry failed: 0Jakub Hrozek2016-12-081-3/+7
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SYSDB: Remove unused prototype from header fileLukas Slebodnik2016-11-251-5/+0
| | | | | | | The function sysdb_get_sudo_filter was removed as part of ticket #2919 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Fixing of sudorule without a sudoUserPetr Čech2016-11-231-0/+5
| | | | | | | | | | | | | | This patch solved a regression caused by the recent patches to lowercase sudoUser -- in case sudoUser is missing completely, we abort the processing of this rule and all others. With this patch, we return ERR_MALFORMED_ENTRY and gracefully skip the malformed rule instead. Resolves: https://fedorahosted.org/sssd/ticket/3241 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Adding message about reason why cache changedPetr Cech2016-11-081-4/+20
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding message to inform which cache is usedPetr Cech2016-11-081-0/+32
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding lowercase sudoUser formPetr Čech2016-11-081-0/+64
| | | | | | | | | | | If domain is not case sensitive we add lowercase form of usernames to sudoUser attributes. So we actually able to apply sudoRule on user Administrator@... with login admnistrator@... Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as wellJakub Hrozek2016-11-032-0/+100
| | | | | | | | | | | | | | | | | | | In cases where the domain name in sssd.conf does not match the AD domain, our previous matching process wouldn't match. This patch augments the matching as follows: - the search base is known to sysdb_try_to_find_expected_dn and is expected to be non-NULL - the existing matching is ran first - during the search base, matching, all the non-DC components are stripped from the search base to 'canonicalize' the search base - if only a single entry that matches with a non-DC DN component (matching with a DC component would mean the DN comes from a different domain) then this entry is a match and is returned Resolves: https://fedorahosted.org/sssd/ticket/3199 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Split sysdb_try_to_find_expected_dn() into smaller functionsJakub Hrozek2016-11-031-99/+179
| | | | | | | | | | The function sysdb_try_to_find_expected_dn was performing several matching algorithms and thus it was getting big and hard to extend. This patch doesn't contain any functional changes, only shuffles the code around and splits the monolithic sysdb_try_to_find_expected_dn function into smaller blocks. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP/AD: resolve domain local groups for remote usersSumit Bose2016-10-311-0/+1
| | | | | | | | | | | | | If a user from a trusted domain in the same forest is a direct or indirect member of domain local groups from the local domain those memberships must be resolved as well. Since those domain local groups are not valid in the trusted domain a DC from the trusted domain which is used to lookup the user data is not aware of them. As a consequence those memberships must be resolved against a local DC in a second step. Resolves https://fedorahosted.org/sssd/ticket/3206 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add parent_dom to sysdb_get_direct_parents()Sumit Bose2016-10-312-1/+27
| | | | | | | | | | Currently sysdb_get_direct_parents() only return direct parents from the same domain as the child object. In setups with sub-domains this might not be sufficient. A new option parent_dom is added which allows to specify a domain the direct parents should be lookup up in. If it is NULL the whole cache is searched. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: expose user and group unique IDs through DBusThomas Equeter2016-09-221-0/+2
| | | | | | | | This adds a uniqueID property on User and Group InfoPipe objects. It has a useful value on AD- and IPA-backed domains. For Active Directory, this is the GUID. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Suppress warning from clang static analyserLukas Slebodnik2016-09-021-1/+1
| | | | | | | | | | | | scan-build wrongly assumes that output variable "version" is not initialized if function sysdb_cache_connect returns ERR_SYSDB_VERSION_TOO_OLD or ERR_SYSDB_VERSION_TOO_NEW The reality is that output variable "version" is initialized especially for these two case. Initialisation to NULL suppresses these false positive reports. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Removing of unused parameterPetr Čech2016-09-011-3/+1
| | | | | | | | | | | There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Fix error handling in sysdb_get_user_members_recursivelyLukas Slebodnik2016-08-312-1/+7
| | | | | | We ignored failures from sysdb_search_entry Reviewed-by: Petr Čech <pcech@redhat.com>
* SYSDB: Fix uninitialized scalar variableLukas Slebodnik2016-08-291-1/+1
| | | | | | | | | | The boolean variable newly_created could be used uninitialized in done section in case of failure. The variable was firstly initialized to true after succesfull execution of function sysdb_cache_create_empty. Uninitialized variable usually means true for boolean variable. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Remove the timestamp cache for a newly created cacheFabiano Fidêncio2016-08-261-22/+47
| | | | | | | | | | | | As many users are used to remove the persistent cache without removing the timestamp cache, let's throw away the timestamp cache in this case. Resolves: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Rework sysdb_cache_connect()Fabiano Fidêncio2016-08-261-19/+34
| | | | | | | | | | | | | | | | | | | As sysdb_cache_connect() has two very specific use cases (connect to the cache and connect to the timestamp cache) and each of those calls have a predetermined/fixed sets of values for a few parameters, let's try to make the code a bit simpler to follow by having explicit functions for connecting to the cache and connecting to the timestamp cache. Macros could be used as well, but I have a slightly preference for having two new functions instead of macros accessing internal parameters of the macro's parameter. Related: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Avoid optimisation with modifyTimestamp for usersLukas Slebodnik2016-08-101-19/+0
| | | | | | | | | | | | | | | The usage of modifyTimestamp needn't be a reliable way for detecting of changes in user entry in LDAP. The authorisation need to rely current data from LDAP and therefore we will temporary disable optimisation with modifyTimestamp and we will rather rely on deep comparison of attributes. In he future, it might be changed and responders might control the optimization level. Resolves: https://fedorahosted.org/sssd/ticket/3110 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the ↵Jakub Hrozek2016-08-051-10/+10
| | | | | | | | | | | | | current time sysdb is already able to retrieve the current timestamp if the caller doesn't specify it. However, for the timestamp cache this came too late and the timestamp cache used zero as the 'now' time. Resolves: https://fedorahosted.org/sssd/ticket/3064 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Sanitize dn in sysdb_get_user_members_recursivelyLukas Slebodnik2016-08-051-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | There was a crash in nss responder when a group contained a user with special charactes which shoudl be sanitized before using in filter. ==31651== Conditional jump or move depends on uninitialised value(s) ==31651== at 0x8BEA7DE: _talloc_steal_loc (talloc.c:1215) ==31651== by 0x5264889: sysdb_get_user_members_recursively (sysdb_ops.c:4759) ==31651== by 0x5278F61: sysdb_add_group_member_overrides (sysdb_views.c:1375) ==31651== by 0x526677C: sysdb_getgrnam_with_views (sysdb_search.c:799) ==31651== by 0x1172F6: nss_cmd_getgrnam_search (nsssrv_cmd.c:3168) ==31651== by 0x119C67: nss_cmd_getby_dp_callback (nsssrv_cmd.c:1382) ==31651== by 0x10FD14: nsssrv_dp_send_acct_req_done (nsssrv_cmd.c:916) ==31651== by 0x12898B: sss_dp_internal_get_done (responder_dp.c:791) ==31651== by 0x58FF861: complete_pending_call_and_unlock (dbus-connection.c:2314) ==31651== by 0x5902B50: dbus_connection_dispatch (dbus-connection.c:4580) ==31651== by 0x527F261: sbus_dispatch (sssd_dbus_connection.c:96) ==31651== by 0x89D8B4E: tevent_common_loop_timer_delay (tevent_timed.c:341) Resolves: https://fedorahosted.org/sssd/ticket/3121 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: add user email to fill_orig()Sumit Bose2016-07-291-0/+1
| | | | | | | The IPA server must send the email address of a user to the clients to allow login by email. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: include email in UPN searchesSumit Bose2016-07-292-3/+3
| | | | | | | | | | | Email addresses and Kerberos user principals names (UPNs) do not only look similar they also can be used to identify a user uniquely. In future this approach should be replace by a more generic one where the attributes which can uniquely identifies a user can be configured to support even a wider range of login names. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-291-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: properly override group member namesSumit Bose2016-07-293-119/+119
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2948 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_get_user_members_recursively()Sumit Bose2016-07-292-0/+66
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Removing of duplication of sysdb_ts_cache_attrsPetr Cech2016-07-261-3/+0
| | | | Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org>
* sysdb_master_domain_add_info: properly set do_updateSumit Bose2016-07-251-2/+2
| | | | | | | do_update should be only set if there is a change, i.e if something was added to the ldb_message. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-17 06:40:39 +0000