summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/ldap_id.c
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Relax search filters in application domainsJakub Hrozek2017-03-301-5/+30
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a request comes towards an application domain, we can drop the part of the filter that asserts that the object has a valid UID/GID. Instead, we just search by name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: add certmap supportSumit Bose2017-03-231-1/+3
| | | | | | | | | | Read certificate mapping data from the IPA server and configure the certificate mapping library accordingly. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-231-1/+1
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: always store the certificate from the requestSumit Bose2017-03-231-1/+18
| | | | | | | | | | Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_get_users_send(): new argument mapped_attrsSumit Bose2017-03-231-2/+2
| | | | | | | | | | | | | | | | mapped_attrs can be a list of sysdb_attrs which are not available on the server side but should be store with the cached user entry. This is needed e.g. when the input to look up the user in LDAP is not an attribute which is stored in LDAP but some data where LDAP attributes are extracted from. The current use case is the certificate mapping library which can create LDAP search filters based on content of the certificate. To allow upcoming cache lookup to use the input directly it is stored in the user object in the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-031-1/+1
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Remove unused attr_type from struct dp_id_dataLukas Slebodnik2017-01-161-5/+0
| | | | | | | | | Structure member attr_type was set to BE_ATTR_CORE on all places and there was a single place src/providers/ldap/ldap_id.c where we checked to other values. It is not used anymore; it's better to remove it. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Remove unused parameter attr_type from groups_get_sendLukas Slebodnik2017-01-161-11/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Removed unused attr_type from users_get_sendLukas Slebodnik2017-01-161-5/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Fix debug messages after errors in *_get_sendLukas Slebodnik2017-01-161-2/+2
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: add enterprise principal strings for user searchesSumit Bose2016-07-291-2/+8
| | | | | | | | | | Unfortunately principal aliases with an alternative realm are stored in IPA as the string representation of an enterprise principal, i.e. name\@alt.realm@IPA.REALM. To be able to lookup the alternative principal in LDAP properly the UPN search filter is extended to search for this type of name as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: include email in UPN searchesSumit Bose2016-07-291-4/+14
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: rename be_acct_req to dp_id_dataPavel Březina2016-07-151-4/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: fix typoSumit Bose2016-07-071-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Delete cache entry if not found by UPNJakub Hrozek2016-07-071-0/+19
| | | | | | | | | Previously, the user account was only looked by name when the LDAP provider didn't match any entry on the server side. This patch removes the entry from the cache with the matching function, either by name or by UPN. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use shortname for LDAP queriesJakub Hrozek2016-07-071-8/+28
| | | | | | | | | | When looking up users or groups by name, we need to user the plain username in the filter. The domain is typically signified by the search base. When looking up by UPN, we can keep using the raw value from the DP. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Rename DP filter value from name to filter_valueJakub Hrozek2016-07-071-54/+57
| | | | | | | filter_value is a better name, because we don't look just by name, the same variable is used to look up certificates etc. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-201-215/+85
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Decorate the hot paths in the LDAP provider with systemtap probesJakub Hrozek2016-06-101-0/+11
| | | | | | | | | | | | | During performance analysis, the LDAP provider and especially its nested group code proved to be the place where we spend the most time during account requests. Therefore, I decorated the LDAP provider with systemtap probes to be able to observe where the time is spent. The code allows passing of search properties (base, filter, ...) from marks to probes. Where applicable, the probes pass on these arguments to functions and build a human-readable string representation. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-011-0/+10
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Just return NULL if tevent_req_create() failsSumit Bose2016-02-111-2/+1
| | | | | | | | | In general we just return NULL if tevent_req_create() fails because there is nothing we can do with the request anyway. Especially tevent_req_error() should not be called because it tries to dereference req. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: remove unused param. in sdap_fallback_local_userPavel Reichl2015-10-121-2/+1
| | | | | | Remove unused sdap_options parameter. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Update few debug messagesLukas Slebodnik2015-07-171-2/+3
| | | | | | | | | It reduces a noise caused by canonicalization of non-existing user. Resolves: https://fedorahosted.org/sssd/ticket/2678 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Add sdap_lookup_type enumJakub Hrozek2015-07-151-8/+8
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Change the boolan parameter of sdap_get_users_send and sdap_get_groups_send to a tri-state that controls whether we expect only a single entry (ie don't use the paging control), multiple entries with a search limit (wildcard request) or multiple entries with no limit (enumeration). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fetch users and groups using wildcardsJakub Hrozek2015-07-151-2/+48
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds handler for the BE_FILTER_WILDCARD in the LDAP provider. So far it's the same code as if enumeration was used, so there are no limits. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Remove user from cache for missing user in LDAPLukas Slebodnik2015-06-191-21/+26
| | | | | | | | | | | | Function sysdb_get_real_name overrode reurned code LDAP and thus user was not removed from cache after removing it from LDAP. This patch also do not try to set initgroups flag if user does not exist. It reduce some error message. Resolves: https://fedorahosted.org/sssd/ticket/2681 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP/IPA: add user lookup by certificateSumit Bose2015-06-191-6/+49
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ldap: use proper sysdb name in groups_by_user_done()Sumit Bose2015-06-011-3/+12
| | | | | | | | | | | | | | | | In a recent change set_initgroups_expire_attribute() was added to groups_by_user_done() to make sure that the initgroups timeout is only added to the user object until all groups added to the cache. This change (and the original code in groups_by_user_done() as well) didn't took sub-domain users into account where the name in sysdb might different form the original request and the domain is not the configured domain. This patch tries to ensure that the right name and domain are used. https://fedorahosted.org/sssd/ticket/2663 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Skip enumeration requests in IPA and AD providers as wellJakub Hrozek2015-06-011-29/+19
| | | | | | | | | | | | | | Checking the enum request in the underlying LDAP provider to skip it might be too late as the richer IPA or AD providers depend on having a useful result when the sdap request finishes. Move the enumeration check earlier instead and allow directly in the IPA or AD handler. Related: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Remove unnecessary argument from sdap_save_userLukas Slebodnik2015-05-221-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Set initgroups expire attribute at the endLukas Slebodnik2015-05-221-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | Initgrups consisted of two main steps: 1. store user to cache 2. store all user groups to cache. Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step. So in case of epmty cache and parallel initgroups request in responders there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were not cached. Therefore sometime responder could return zero supplementary groups. This patch moves the setting of initgroups expire attribute from 1st step to the end of 2nd step. In case of parallel initgroups requests in responder there are two other ways how we could get correct results even thought there was a bug. a) Time between two request was too small. User was not stored in cache yet and 2nd request waited for response from DP. b) Time between two request was big enough. All users groups were successfully stored in cache and 2nd request returned correct results. Resolves: https://fedorahosted.org/sssd/ticket/2634 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-12/+8
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-291-2/+13
| | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-171-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: do not resolve group members during tokenGroups requestSumit Bose2015-03-171-5/+9
| | | | | | | | | | | | | | | | | | | | | | During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_handle_acct_req_send: remove be_reqPavel Březina2015-03-081-14/+10
| | | | | | | | | | | be_req was used only as a talloc context for subreq. This memory context was replace by state of the parent request which is more suitable for tevent coding style. This change will allow us to use this function in be_refresh where none be_req is available. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Conditional jump depends on uninitialised valueLukas Slebodnik2015-02-231-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | ==31767== at 0x5B66CFC: users_get_posix_check_done (ldap_id.c:346) ==31767== by 0x4DCC6AA: _tevent_req_notify_callback (tevent_req.c:112) ==31767== by 0x4DCC724: tevent_req_finish (tevent_req.c:149) ==31767== by 0x4DCC782: _tevent_req_error (tevent_req.c:167) ==31767== by 0x5B7ED43: sdap_posix_check_done (sdap_async.c:2486) ==31767== by 0x4DCC6AA: _tevent_req_notify_callback (tevent_req.c:112) ==31767== by 0x4DCC724: tevent_req_finish (tevent_req.c:149) ==31767== by 0x4DCC782: _tevent_req_error (tevent_req.c:167) ==31767== by 0x5B7DE37: sdap_get_generic_op_finished (sdap_async.c:1523) ==31767== by 0x5B7D62B: sdap_process_result (sdap_async.c:357) ==31767== by 0x4DCFC1C: tevent_common_loop_timer_delay (tevent_timed.c:341) ==31767== by 0x4DD0E12: epoll_event_loop_once (tevent_epoll.c:911) ==31767== by 0x4DCF23E: std_event_loop_once (tevent_standard.c:114) ==31767== by 0x4DCB38F: _tevent_loop_once (tevent.c:530) ==31767== by 0x4DCB58B: tevent_common_loop_wait (tevent.c:634) ==31767== by 0x4DCF1BE: std_event_loop_wait (tevent_standard.c:140) ==31767== by 0x4DCB627: _tevent_loop_wait (tevent.c:653) ==31767== by 0x489AB98: server_loop (server.c:668) ==31767== by 0x10D035: main (data_provider_be.c:2915) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: use GC for SID requests as wellSumit Bose2015-01-301-10/+28
| | | | | | | | | If a universal group is looked up by SID the cross-domain members must be resolved with the help of the Global Catalog. Related to https://fedorahosted.org/sssd/ticket/2514 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: add support for lookups by UUIDSumit Bose2014-11-201-5/+53
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-151-6/+12
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: If extra_value is 'U' do a UPN searchSumit Bose2014-09-011-2/+13
| | | | | | | | | | | Besides the name the responders always send an extra string attribute to the backends which is so far mostly empty. Since the only difference in the processing of a request for a user name or a user principal name is a different search attribute in the LDAP provider this extra value can be used to indicate the type of the name. Providers which do not support UPN lookup can just ignore this attribute. Related to https://fedorahosted.org/sssd/ticket/1749
* Revert "IPA: new attribute map for non-posix groups"Jakub Hrozek2014-08-191-7/+1
| | | | This reverts commit 4c560e7b98e7ab71d22be24d2fbc468396cb634f.
* IPA: new attribute map for non-posix groupsPavel Reichl2014-08-191-1/+7
| | | | | | | | | Create new set of attributes to be used when processing non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Rename label in users_get_send/groups_get_sendPavel Reichl2014-06-181-32/+30
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2209 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-021-1/+2
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-34/+34
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Detect the presence of POSIX attributesJakub Hrozek2014-02-121-8/+150
| | | | | | | | | | | | | | | | | | | When the schema is set to AD and ID mapping is not used, there is a one-time check ran when searching for users to detect the presence of POSIX attributes in LDAP. If this check fails, the search fails as if no entry was found and returns a special error code. The sdap_server_opts structure is filled every time a client connects to a server so the posix check boolean is reset to false again on connecting to the server. It might be better to move the check to where the rootDSE is retrieved, but the check depends on several features that are not known to the code that retrieves the rootDSE (or the connection code for example) such as what the attribute mappings are or the authentication method that should be used. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Don't abort request if no id mapping domain matchesJakub Hrozek2014-01-241-5/+37
| | | | | | | | | If an ID was requested from the back end, but no ID mapping domain matched, the request ended with a scary error message. It's better to treat the request as if no such ID was found in the domain Related: https://fedorahosted.org/sssd/ticket/2200
* Remove unused parameter from sdap_save_userLukas Slebodnik2013-11-271-2/+1
|
generated by cgit (git 2.34.1) at 2025-09-01 01:26:43 +0000