summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa/ipa_subdomains_server.c
Commit message (Collapse)AuthorAgeFilesLines
* IPA: fix handling of certmap_ctxSumit Bose2017-09-141-2/+2
| | | | | | | | | | This patch fixes a use-after-free in the AD provider part and initializes the certmap_ctx with data from the cache at startup. Related to https://pagure.io/SSSD/sssd/issue/3508 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Add sdap_domain_copy_search_basesMichal Židek2017-07-111-7/+1
| | | | | | | | | | Add function to copy search bases from one sdap_domain to another. Resolves: https://pagure.io/SSSD/sssd/issue/3435 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SERVER_MODE: Update sdap lists for each ad_ctxMichal Židek2017-05-041-0/+36
| | | | | | | | | | | | | | | | | We use separate AD context for each subdomain in the server mode. Every such context has it's own sdap_domain list witch represents sdap options such as filter and search bases for every domain. However AD context can only fully initialize sdap_domain structure for the same domain for which the whole context was created, which resulted in the other sdap_domain structures to be have automaticily detected settings. This can cause problems if user is member of groups from multiple domains. Resolves: https://pagure.io/SSSD/sssd/issue/3381 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Fix handling of search basesMichal Židek2017-05-021-1/+1
| | | | | | | | | | | | | We were rewriting the sdap_domain's search bases for only the first sdap_domain in the list, which does not work for subdomains. Also when search bases were already initialized in sdap_domain_subdom_add, we should only rewrite them when they were explicitly set in sssd.conf. Resolves: https://pagure.io/SSSD/sssd/issue/3351 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Introduce subdomain_create_conf_path()Michal Židek2017-03-291-3/+1
| | | | | | | | | | This is a utility function that replaces the create_subdom_conf_path(). Differently than the latter, it only takes one parameter and is going to be used in a few different places (thus adding it to util.h). Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* IPA: add certmap supportSumit Bose2017-03-231-0/+4
| | | | | | | | | | Read certificate mapping data from the IPA server and configure the certificate mapping library accordingly. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SUBDOMAINS: Allow options ad(_backup)_serverMichal Židek2017-03-151-1/+6
| | | | | | | | | | | Allow following options in the subdomain section: ad_server ad_backup_server Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUBDOMAINS: Configurable search basesMichal Židek2017-03-151-7/+30
| | | | | | | | | | | Added new trusted domain section in the sssd.conf were the search bases for the trusted domain can be specified. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* data_provider: Fix typo in DEBUG messageMichal Židek2017-03-151-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: mark subdomain service with sd_ prefixPavel Březina2016-08-161-2/+9
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Changing of confusing debug messagePetr Cech2016-08-051-1/+1
| | | | | | | | | | | This debug message used to confuse our users. So this patch changes it. Old version: "Trust direction of %s is %s\n" New version: "Trust type of [%s]: %s\n" Resolves: https://fedorahosted.org/sssd/ticket/3090 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-201-1/+1
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: use krb5_keytab for subdomain initializationSumit Bose2016-06-091-1/+2
| | | | | | | | | | During the initialization of AD subdomains parameters like the SASL auth id are determined. Since subdomains use a default set of the AD specific configuration options the default keytab will be used. If krb5_keytab is set in sssd.conf for the AD domain this keytab should be used for the subdomains (domains of the same AD forest) as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: use forest name when looking up the Global CatalogSumit Bose2016-05-241-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3015 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-231-2/+2
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Change ipa_server_trust_add_send request to be reusable from ID codeJakub Hrozek2015-09-231-58/+64
| | | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2639 Expose a request ipa_server_trusted_dom_setup_send that sets up a trusted domain. The setup might include actions like retrieving a keytab for one-way trusts. Creating the AD ID context for the trused domain is now done in the caller of this new request. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Always re-fetch the keytab from the IPA serverJakub Hrozek2015-08-141-23/+60
| | | | | | | | | | Even if a keytab for one-way trust exists, re-fetch the keytab again and try to use it. Fall back to the previous one if it exists. This is in order to allow the admin to re-establish the trust keytabs with a simple sssd restart. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Handle sssd-owned keytabs when running as rootJakub Hrozek2015-07-281-8/+38
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2718 This patch handles the case where the keytab is created with sssd:sssd ownership (perhaps by the IPA oddjob script) but SSSD runs as root, which is the default in many distributions. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: Better debuggingJakub Hrozek2015-07-281-0/+3
| | | | Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: Utility function for setting up one-way trust contextJakub Hrozek2015-06-141-4/+67
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Do not set AD_KRB5_REALM twiceJakub Hrozek2015-06-141-8/+0
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Both the AD common code and ipa_ad_ctx_new() used set AD_KRB5_REALM. As verified by unit tests, we don't need to set the parameter twice. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/AD: Set up AD domain in ad_create_2way_trust_optionsJakub Hrozek2015-06-141-10/+5
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Removed code duplication. Amends unit test to make sure we don't regress. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_create_default_options to ad_create_2way_trust_optionsJakub Hrozek2015-06-141-2/+2
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Better reflects what's going on in the function. Also adds a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fetch keytab for 1way trustsJakub Hrozek2015-06-141-21/+404
| | | | | | | | | Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Make constructing an IPA server mode context asyncJakub Hrozek2015-06-141-23/+213
| | | | | | | Refactoring in preparation for requesting the keytab in future patches. Currently it's a fake async that just marks the request as done. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Include ipaNTTrustDirection in the attribute set for trusted domainsJakub Hrozek2015-06-141-0/+75
| | | | | | | | | | | Allows to distinguish the trust directions for trusted domains. For domains where we don't know the direction in server mode, we assume two-way trusts. Member domains do not have the direction, but rather the forest root direction is used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Move server-mode functions to a separate moduleJakub Hrozek2015-06-141-0/+340
There is already quite a few functions that are server-mode specific and there will be even more with one-way trusts. Split the server-mode specific functions into a separate module. Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-11 09:15:09 +0000