summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap
Commit message (Collapse)AuthorAgeFilesLines
...
* LDAP/IPA: add local email address to aliasesSumit Bose2016-07-291-0/+22
| | | | | | | | Adding email-addresses from the local domain to the alias names is strictly not needed by might help to speed up lookups in the NSS responder. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: include email in UPN searchesSumit Bose2016-07-292-10/+40
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-292-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: allow multiple user principalsSumit Bose2016-07-291-14/+18
| | | | | | | | | | In general a user can have multiple principals and recent IPA version added support to defined multiple principals. With this patch SSSD does not only store the first but all principals read by LDAP from a server. Resolves https://fedorahosted.org/sssd/ticket/2958 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: Fix ldap_rfc_2307_fallback_to_local_usersMichal Židek2016-07-151-0/+3
| | | | | | | | | | | | | | | We wrongly tried to store empty user attributes instead of the local user attributes with ldap_rfc_2307_fallback_to_local_users set to true. This gave us bad initgroups results and caused segfaults. Resolves: https://fedorahosted.org/sssd/ticket/3045 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: rename be_acct_req to dp_id_dataPavel Březina2016-07-154-10/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Lookup services by all protocols unless a protocol is specifiedJakub Hrozek2016-07-071-2/+5
| | | | | | | The DP refactoring changed the way we handle strings from sbus. We no longer receive NULL strings, but empty strings instead. Reviewed-by: Sumit Bose <sbose@redhat.com>
* fix some 'might be used uninitialized' warningsSumit Bose2016-07-071-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Qualify user and group names when saving the sudo usersJakub Hrozek2016-07-071-0/+62
| | | | | | | | | | | | | | | If the sudoUser values we fetch from LDAP correspond to a user or a group name per: http://www.sudo.ws/man/1.8.14/sudoers.ldap.man.html then we parse the usernames into (name,domain) tuples and store them qualified. This patch not only makes the sudo provider work with qualified names, but also makes it possible to use qualified names on the LDAP side, allowing for example AD users from different domains to access sudo rules. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: fix typoSumit Bose2016-07-071-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: The access control filter just needs the plain usernameJakub Hrozek2016-07-071-3/+2
| | | | | | | The LDAP access control code uses shortnames to construct an LDAP filter. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Delete cache entry if not found by UPNJakub Hrozek2016-07-071-0/+19
| | | | | | | | | Previously, the user account was only looked by name when the LDAP provider didn't match any entry on the server side. This patch removes the entry from the cache with the matching function, either by name or by UPN. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use FQDNs when saving incomplete groupsJakub Hrozek2016-07-071-4/+4
| | | | | | | Even incomplete groups must be stored using the internal name format instead of whatever we receive from LDAP. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use fqdns during nested RFC2307 initgroupsJakub Hrozek2016-07-071-19/+3
| | | | | | | | All user and group names are already qualified at this point, so let's remove the special case that stored users from trusted domains qualified. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: make it clear that sdap_add_incomplete_groups operates on sysdb namesJakub Hrozek2016-07-072-6/+6
| | | | | | Just provides a more descriptive name of a function parameter. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add a utility function to return a list of qualified namesJakub Hrozek2016-07-072-5/+5
| | | | | | | | Adds a utility function the LDAP provider can use. This is different from sss_create_internal_fqname_list in the sense that the LDAP provider passes in the attribute name that contains the name attribute value. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Convert RFC2307 member attribute values to FQDN-style ghostnames ↵Jakub Hrozek2016-07-071-2/+12
| | | | | | | | | | before acting on them Ghostnames must be qualified as well, same as all other name attributes across SSSD. The ghost names are used by the NSS responder during getgr* output and the domain name parsed from the name is used in the output. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: save users with FQDNJakub Hrozek2016-07-071-4/+38
| | | | | | | The username we receive from LDAP is short name. Convert it to a qualified name before saving the user. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use shortname for LDAP queriesJakub Hrozek2016-07-072-29/+103
| | | | | | | | | | When looking up users or groups by name, we need to user the plain username in the filter. The domain is typically signified by the search base. When looking up by UPN, we can keep using the raw value from the DP. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Rename DP filter value from name to filter_valueJakub Hrozek2016-07-073-63/+66
| | | | | | | filter_value is a better name, because we don't look just by name, the same variable is used to look up certificates etc. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Store SID members during AD initgroups with a qualified nameMichal Zidek2016-07-071-1/+6
| | | | | | | | This is to be consistent with how we name groups normally. We rename the groupnames when resolving the groups by ID anyway, but if we fail to do so, at least be consistent. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Save user and group aliases qualifiedMichal Zidek2016-07-075-8/+30
| | | | | | | When saving users or groups, qualify their names. Otherwise (currently netgroups), store a plain username. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Search functions don't need to construct per-domain namesJakub Hrozek2016-07-072-19/+4
| | | | | | | The names are all internally qualified already, no need to distinguish between subdomain users and main domain users. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Change the default rfc2307 autofs attribute mappingsJakub Hrozek2016-07-062-4/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2858 The default attribute mappings we used to have: ldap_autofs_map_object_class automountMap ldap_autofs_map_name ou ldap_autofs_entry_object_class automount ldap_autofs_entry_key cn ldap_autofs_entry_value automountInformation Was wrong. Instead, this patch switches to: ldap_autofs_map_object_class nisMap ldap_autofs_map_name nisMapName ldap_autofs_entry_object_class nisObject ldap_autofs_entry_key cn ldap_autofs_entry_value nisMapEntry Which are attributes that are available with servers running the default rfc2307 schema. In addition, this patch adds a syslog and DEBUG message that warns administrators to double-check their configuration. We don't warn when the autofs provider is set to AD, because that one is already correct. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Downcast to errno_t after tevent_req_is_errorLukas Slebodnik2016-06-291-5/+15
| | | | | | | | | | | | | Functions tevent_req_is_error and _tevent_req_error use type uint64_t for error code. SSSD uses errno_t which is an alias for int. Therefore complier assumes that macro TEVENT_REQ_RETURN_ON_ERROR can return 0 due to implicit down casting from uint64_t -> int. This patch makes down casting explicit and returns EINVAL if result of downcasting is 0. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Shortcut looking up for group members soonerJakub Hrozek2016-06-231-10/+53
| | | | | | | | | | | | | | | | This patch is a performance enhancement. When looking for entries to refresh, we always looked up all members in the cache, even if we ended up dereferencing the whole group. If we are about to try dereference, it makes sense to shortcut the lookups after the dereference threshold is reached. In that case, the split_members function returns a special error code and the caller just dereferences the whole group. Only if dereference fails, we fall back to looking up all members so that we can look them up one-by-one. Also adds an integration test to make sure the dereference code works. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-2013-1127/+1490
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap ops: add support for derefPavel Březina2016-06-202-0/+289
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow returning only the first replyPavel Březina2016-06-202-42/+123
| | | | | | | | | In some cases we want to cycle through all search bases but stop iterating when we get first non-empty reply. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow map to be NULLPavel Březina2016-06-201-10/+8
| | | | | | | | In some cases we do not want any attribute translations. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_backend.h to backend.hPavel Březina2016-06-2014-14/+14
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.h to be_dyndns.hPavel Březina2016-06-202-2/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_refresh.h to be_refresh.hPavel Březina2016-06-201-1/+1
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_ptask to be_ptaskPavel Březina2016-06-203-3/+3
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-181-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Decorate the hot paths in the LDAP provider with systemtap probesJakub Hrozek2016-06-105-0/+81
| | | | | | | | | | | | | During performance analysis, the LDAP provider and especially its nested group code proved to be the place where we spend the most time during account requests. Therefore, I decorated the LDAP provider with systemtap probes to be able to observe where the time is spent. The code allows passing of search properties (base, filter, ...) from marks to probes. Where applicable, the probes pass on these arguments to functions and build a human-readable string representation. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Try also the AD access control for IPA usersJakub Hrozek2016-06-031-0/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2927 If a user from an AD trusted domain is logging in, we should also check their AD lockout status. This helps cases where the user might have been disabled but is logging in with an SSH public key. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-311-16/+20
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-191-6/+6
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Failover to next server if authentication failsPavel Březina2016-05-111-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3010 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Inform about (un)successful connectionPavel Březina2016-05-111-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make sdap_process_group_send() staticJakub Hrozek2016-05-091-8/+9
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* LDAP: Print port in sdap_print_serverLukas Slebodnik2016-04-271-3/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: make concatenate_string_array() reusableSumit Bose2016-04-131-25/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: refactor sdap_ad_tokengroups_initgr_mapping_done()Sumit Bose2016-04-132-27/+57
| | | | | | The group-processing is moved out to make it reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: make some AD specific calls publicSumit Bose2016-04-132-14/+66
| | | | | | | Make sdap_ad_tokengroups_get_posix_members() and sdap_ad_resolve_sids_send() reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Recognize Windows Server 2016Jakub Hrozek2016-04-072-3/+6
| | | | | | | | | | Even though at this time the MSDN documentation at: https://msdn.microsoft.com/en-us/library/cc223272.aspx still claims that "7" is a value of DS_BEHAVIOR_WINTHRESHOLD, testing with Windows Server 2016 Preview already shows that server reporting a new value of Domain Controller Functionality. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Remove unused parameter talloc contextLukas Slebodnik2016-04-051-4/+2
| | | | | | Parameter memctx was unused in sdap_nested_group_add_ext_members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SUDO: be able to parse modifyTimestamp correctlyPavel Březina2016-03-173-17/+50
| | | | | | | | | | | | | We were unable to parse modifyTimestamp where a non-numeric part (timezone) was involved. The format is YYYYMMDDHHmmssZ. It may also contain fraction or different timezone, everytime separated from the datetime by character. This patch gets the numberic part and then appends the string part again to get value usable in filter. Resolves: https://fedorahosted.org/sssd/ticket/2970 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-111-4/+6
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 17:12:26 +0000