summaryrefslogtreecommitdiffstats
path: root/src/providers/ad
Commit message (Collapse)AuthorAgeFilesLines
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-291-1/+2
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Introduce subdomain_create_conf_path()Michal Židek2017-03-293-14/+1
| | | | | | | | | | This is a utility function that replaces the create_subdom_conf_path(). Differently than the latter, it only takes one parameter and is going to be used in a few different places (thus adding it to util.h). Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* SUBDOMAINS: Allow options ad(_backup)_serverMichal Židek2017-03-151-1/+6
| | | | | | | | | | | Allow following options in the subdomain section: ad_server ad_backup_server Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUBDOMAINS: Configurable search basesMichal Židek2017-03-153-111/+198
| | | | | | | | | | | Added new trusted domain section in the sssd.conf were the search bases for the trusted domain can be specified. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fixed typo in debug outputThorsten Scherf2017-03-081-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-031-1/+1
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Use ad_domain to match forest root domain, not the configured domain ↵Jakub Hrozek2017-02-081-2/+11
| | | | | | | | | | | | | | | | | | | | from sssd.conf If the sssd.conf domain name was different from the joined domain name, but sssd was joined to the forest root, the AD subdomains code considered sssd joined to a non-root domain and tried to discover the forest root. This could be reproduced by joining sssd to a domain, for example win.trust.test but calling the sssd.conf domain otherwise, for example: [domain/addomain] ad_domain = win.trust.test This is/was a frequent use-case in the RHEL world, where authconfig often names the sssd.conf domain 'default'. Without the patch, the trusted domains were not detected. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-02-011-0/+1
| | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* gpo: Improve debug messagesMichal Židek2017-01-251-3/+6
| | | | | | | | Improve debug messages during security filtering. It was not possible to figure out why the GPO was filtered by reading the logs, because we use the same debug message in various cases. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Skip GPOs without gPCFunctionalityVersionMichal Židek2017-01-251-3/+19
| | | | | | | | | | | | We falsely stopped GPO processing when Group Policy Container in AD did not contain gPCFunctionalityVersion. Such GPOs should be ignored by SSSD according to MS-GPOL: https://msdn.microsoft.com/en-us/library/cc232538.aspx Resolves: https://fedorahosted.org/sssd/ticket/3269 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA/AD: check auth ctx before using itSumit Bose2016-11-101-2/+11
| | | | | | | | | | | | | In e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483 a feature was introduced to set the 'canonicalize' option in the system-wide Kerberos configuration according to the settings in SSSD if the AD or IPA provider were used. Unfortunately the patch implied that the auth provider is the same as the id provider which might not always be the case. A different auth provider caused a crash in the backend which is fixed by this patch. Resolves https://fedorahosted.org/sssd/ticket/3234 Reviewed-by: Petr Cech <pcech@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: fix typo and unify ipa with ad debug message when offPavel Březina2016-08-301-1/+1
| | | | | Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: ad_enabled_domains - other then masterPetr Cech2016-08-171-3/+37
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains doesn't contain them. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: ad_enabled_domains - only masterPetr Cech2016-08-171-0/+16
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains contains only master domain. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: Initializing of ad_enabled_domainsPetr Cech2016-08-171-0/+82
| | | | | | | | | | We add ad_enabled_domains into ad_subdomains_ctx. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: Add ad_enabled_domains optionPetr Cech2016-08-172-0/+2
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Warn if IP address is used as option for ipa_server/ad_serverJustin Stephenson2016-08-161-0/+9
| | | | | | | | | GSSAPI is dependent on DNS with hostnames and we should warn about this. Resolves: https://fedorahosted.org/sssd/ticket/2789 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: mark subdomain service with sd_ prefixPavel Březina2016-08-161-2/+9
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* gpo: gPCMachineExtensionNames with just whitespacesMichal Židek2016-08-111-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3114 We failed GPO procesing if the gPCMachineExtensionNames attribute contained just whitespaces. This coused failures in some server settings. Comment from Alexander Bokovoy quoting: You should use MS-GPOL spec. 2.2.4 'GPO Search' section says that when processing gPCMachineExtensionNames, "Group Policy processing terminates at the first <CSE GUIDn> out of sequence." Since ' ' (space only) does not fall into defined syntax for gPCMachineExtensionNames, this Group Policy processing is stopped and its CSE GUIDs are set to 'empty list'. Because of the 3.2.5.1.10 'Extension Protocol Sequences' language ------------------------------------------------------------------------ The Group Policy client MUST evaluate the subset of the abstract element Filtered GPO list separately for each Group Policy extension by including in the subset only those GPOs whose gPCUserExtensionNames (for user policy mode) or gPCMachineExtensionNames (for computer policy mode) attributes contain CSE GUID that correspond to the Group Policy extension. If the CSE GUID corresponding to the Group Policy extension is present in Extension List, it is invoked using the Implementation Identifier field. Applicability is determined as specified in section 3.2.1.5. The Group Policy Registry Extension MUST always execute first. All other applicable Group Policy extensions in the Extension List MUST be loaded and executed in Extension List order. A failure in any Group Policy extension sequence MUST NOT affect the execution of other Group Policy extensions. ------------------------------------------------------------------------- I think we can practically treat wrong content of gPCMachineExtensionNames (and gPCUserExtensionNames) as inability of the GPO to pass through the Filtered GPO list. Thus, the GPO would be ignored. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-291-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: replace ad_get_client_site_parse_ndr() with netlogon_get_domain_info()Sumit Bose2016-07-251-120/+33
| | | | | | | | | | | | netlogon_get_domain_info() does not fail if only the site is missing in the CLDAP ping respond. If the site is not available a Global Catalog can still be looked up with the forest name. Only if the forest name is missing as well we fall back to the configured domain name. Resolves: https://fedorahosted.org/sssd/ticket/3104 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: netlogon_get_domain_info() allow missing arguments and empty resultsSumit Bose2016-07-254-51/+65
| | | | | | | | | | | netlogon_get_domain_info() should not fail if not all parameters can be retrieved. It should be the responsibility of the caller to see if the needed data is available and act accordingly. Resolves: https://fedorahosted.org/sssd/ticket/3104 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: avoid memory leak in netlogon_get_domain_info() and make it publicSumit Bose2016-07-252-9/+26
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: make subdomain calls aware of upn_suffixesSumit Bose2016-07-181-1/+1
| | | | | | | sysdb_subdomain_store() and sysdb_update_subdomains() can now update upn_suffixes as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add UPN suffix support for the master domainSumit Bose2016-07-182-2/+2
| | | | | | | sysdb_master_domain_update() and sysdb_master_domain_add_info() are now aware of the UPN suffix attribute. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: rename be_acct_req to dp_id_dataPavel Březina2016-07-155-13/+13
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: No need to separately qualify subdomain users anymoreJakub Hrozek2016-07-071-11/+2
| | | | | | | All usernames across SSSD are stored in the same manner, so there's no need to create per-domain names anymore. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/AD: globally set krb5 canonicalization flagSumit Bose2016-07-061-1/+6
| | | | | | | | | | | If Kerberos principal canonicalization is configured in SSSD, currently it is the default for the IPA provider, a configuration snippet is generated for the system-wide libkrb5 configuration so that all kerberized applications will use canonicalization by default. Resolves https://fedorahosted.org/sssd/ticket/3041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: ignore non-KVP lines if possibleMichal Židek2016-06-221-1/+60
| | | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2751 Non-KVP break GPO processing. They are used for values we are not interested in so it is safe to ignore them. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-2010-1138/+1348
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_backend.h to backend.hPavel Březina2016-06-205-5/+5
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.h to be_dyndns.hPavel Březina2016-06-203-3/+3
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_ptask to be_ptaskPavel Březina2016-06-201-1/+1
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-181-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: read user certificate if availableSumit Bose2016-06-091-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: use krb5_keytab for subdomain initializationSumit Bose2016-06-093-14/+20
| | | | | | | | | | During the initialization of AD subdomains parameters like the SASL auth id are determined. Since subdomains use a default set of the AD specific configuration options the default keytab will be used. If krb5_keytab is set in sssd.conf for the AD domain this keytab should be used for the subdomains (domains of the same AD forest) as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD_PROVIDER: Fix constant char *Petr Cech2016-06-071-1/+1
| | | | | | | | This patch fixes loading of ad_domain option. It is declared like const, co we should use dp_opt_get_cstring() instead of dp_opt_get_string(). Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Add "polkit-1" to ad_gpo_map_allowStephen Gallagher2016-06-031-1/+3
| | | | | | | | | | | Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-312-21/+25
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: Do not leak file descriptors during machine password renewalJakub Hrozek2016-05-311-13/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3017 The AD renewal task was opening a pipe to write to the child process but never closed it, leaking the fd. This patch uses a desctructor we already use for pipes towards other child processes. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: Do not schedule the machine renewal task if adcli is not executableJakub Hrozek2016-05-191-0/+9
| | | | | | | | | | | Before scheduling the adcli renewal task, check if the renewal program (typically adcli) is accessible. If not, do dot schedule the renewal task at all. Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-192-16/+14
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Add "unity" to ad_gpo_map_interactiveStephen Gallagher2016-05-061-1/+2
| | | | | | | | | | | Ubuntu systems use "unity" as their screen-locker. Without this in the defaults, people often get locked out of their machines when the screen locks. Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: process PAC during initgroups requestSumit Bose2016-04-134-8/+878
| | | | | | | | | If there is a recently attached PAC blob in the cached user entry the PAC data is used to update the group memberships data of the user. If there is no PAC attached or if it is too old the other configured methods will be used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* GPO: Process GPOS in offline mode if ldap search failedLukas Slebodnik2016-04-121-0/+20
| | | | | | | | | | | | | | | | | Initgroup requests use global catalog for LDAP queries. Only port for global catalog is marked as offline if request fails due to problems with connection. However, GPO code uses standard LDAP port for retrieving of target DNs and other information. Previously, GPOs were processed in offline mode only if there were issues with connection to AD server. But connection can be cached and ldap search can still fail. Resolves: https://fedorahosted.org/sssd/ticket/2964 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO_CHILD: Create directories in gpo_cache with right permissionsLukas Slebodnik2016-04-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The parent directory has to have execute bit if we want to create subdirectories or read files there. sh-4.3$ mkdir dir sh-4.3$ echo "test" > dir/test_file sh-4.3$ chmod 644 dir/ sh-4.3$ ls dir/ test_file sh-4.3$ cat dir/test_file cat: dir/test_file: Permission denied It was not probelm for sssd in root mode because root has by default capbilities DAC_OVERRIDE and DAC_READ_SEARCH which bypass file read, write, and execute permission checks and directory read and execute permission checks Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: Soften umask in gpo_childLukas Slebodnik2016-04-071-4/+12
| | | | | | | | | | | | | | | | | | The default umask(0177) inherited from sssd_be is to strict for gpo_child in non-root mode. mkdir creates directories with only "rw" permission for owner. The man 1 chmod says: "execute (or search for directories) (x)" In another words, execute bit is required for directories. sh-4.3$ mkdir dir sh-4.3$ chmod 600 dir/ sh-4.3$ mkdir dir/subdir mkdir: cannot create directory ‘dir/subdir’: Permission denied Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: log specific ini parse error messagesMichal Židek2016-03-232-2/+40
| | | | | | | | We should log error messages generated by libini if there are problems with parsing gpo files. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Add other display managers to interactive logonStephen Gallagher2016-02-291-1/+6
| | | | | | | | Gone are the days when all systems used GDM or KDM. We need to support other display managers in the default configuration to avoid issues when enrolled in AD domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 22:01:02 +0000