summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* gpo: Improve debug messagesMichal Židek2017-01-251-3/+6
| | | | | | | | Improve debug messages during security filtering. It was not possible to figure out why the GPO was filtered by reading the logs, because we use the same debug message in various cases. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Skip GPOs without gPCFunctionalityVersionMichal Židek2017-01-251-3/+19
| | | | | | | | | | | | We falsely stopped GPO processing when Group Policy Container in AD did not contain gPCFunctionalityVersion. Such GPOs should be ignored by SSSD according to MS-GPOL: https://msdn.microsoft.com/en-us/library/cc232538.aspx Resolves: https://fedorahosted.org/sssd/ticket/3269 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* dp_request_table: remove unused #includesPavel Březina2017-01-251-2/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Add destructor data to sbus_connectionFabiano Fidêncio2017-01-232-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This additions has a very specific reason: unregister a service when it's shutdown. So far, we never had to do this kind of operation because the services were started during SSSD's startup when finished when SSSD finished. Now, with the socket-activation in place the game will be a little bit different as the services will have an idle timeout and will be able shut themselves down. In order to do it properly the monitor will need to "unregister" the service and there's no way to do that without adding this destructor data to the sbus_connection structure and introducing a new function to access it from the monitor (where we're going to set the destructor function to the sbus_connection for the socket-activated services). So far it's not being used anywhere as every function taking it as parameter is just receiving NULL, but it will be used in the follow up commits, by the monitor. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Add a time_t pointer to the sbus_connectionFabiano Fidêncio2017-01-232-2/+3
| | | | | | | | | | | | | | | | | The idea of this commit is to provide a way to update the time of the last request coming from/going to the responders through sbus. For now it's not used anywhere as all the functions that will pass their time_t to the sbus_connection are currently passing NULL. It will be used by follow-up patches. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Pass the service type to the RegisterService methodFabiano Fidêncio2017-01-231-1/+1
| | | | | | | | | | | | | | | | Passing the service type to the RegisterService method will help us in the future, for socket-activation, as we will need to differentiate cases where the service being registered is still not in the services' list but is a valid case and has to be added there as it was socket-activated. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SUDO: Drop logic to disable the backend in case the provider is not setFabiano Fidêncio2017-01-231-75/+0
| | | | | | | | | | | | | | | | | | | As sudo responder requires some period task in the backend, has been decided (a long time ago) to disable it in the backend unless it's explicitly configured. Following Pavel Březina's suggestion, as it's one of our main features, let's treat it exactly as we treat any other responder and in case the admins want to disable it they should explicitly use: "sudo_provider = None". Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Remove attrs_type related TODO commentsLukas Slebodnik2017-01-162-3/+0
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* DP: Remove unused attr_type from struct dp_id_dataLukas Slebodnik2017-01-1613-56/+14
| | | | | | | | | Structure member attr_type was set to BE_ATTR_CORE on all places and there was a single place src/providers/ldap/ldap_id.c where we checked to other values. It is not used anymore; it's better to remove it. Reviewed-by: Michal Židek <mzidek@redhat.com>
* DP: Remove unused constants BE_ATTR_*Lukas Slebodnik2017-01-162-4/+0
| | | | | | | | | | | | Neither BE_ATTR_MEM nor BE_ATTR_ALL are set anywhere in sssd.code. sh$ git grep -E "BE_ATTR_ALL|BE_ATTR_MEM" src/providers/data_provider.h:#define BE_ATTR_MEM 2 src/providers/data_provider.h:#define BE_ATTR_ALL 3 src/providers/data_provider/dp_target_id.c: case BE_ATTR_MEM: src/providers/data_provider/dp_target_id.c: case BE_ATTR_ALL: Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Remove unused parameter attr_type from groups_get_sendLukas Slebodnik2017-01-165-15/+4
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Removed unused attr_type from users_get_sendLukas Slebodnik2017-01-161-5/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Fix debug messages after errors in *_get_sendLukas Slebodnik2017-01-161-2/+2
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB5: Advise the user to inspect the krb5_child.log if the child fails with ↵Jakub Hrozek2017-01-121-0/+3
| | | | | | | | | | | | | | a System Error It's often not clear to admins where to look further if the krb5_child fails with a generic error. This patch just adds a DEBUG message advising the admin to look into the krb5_child.log for more information. Related: https://fedorahosted.org/sssd/ticket/2955 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* sudo: do not store usn if no rules are foundPavel Březina2016-12-081-1/+8
| | | | | | | | | | | | When ldap doesn't contain any sudorule during the initial full refresh, usn is set to 1 instead of remaining unset and we are trying to search modifyTimestamp>=1 during smart refresh which doesn't return any result on openldap servers. Resolves: https://fedorahosted.org/sssd/ticket/3257 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: fix two memory leaksSumit Bose2016-11-281-7/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: Use command line arguments instead env vars for krb5_childSumit Bose2016-11-287-131/+276
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Remove spurious warning in logsLukas Slebodnik2016-11-221-1/+1
| | | | | | | | | | The option krb5_map_user is empty by default. Therefore we should not confuse users wih warning (Fri Nov 15 09:58:49 2016) [sssd[be[example.com]]] [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty! Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Qualify ghost user attribute in case ldap_group_nesting_level is set to 0Jakub Hrozek2016-11-161-4/+11
| | | | | | | | | | | When the sssd is set to not resolve nested groups with RFC2307bis, then the LDAP provider takes a different path. We didn't qualify the ghost users in this case. Resolves: https://fedorahosted.org/sssd/ticket/3236 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa: Nested netgroups do not workMichal Židek2016-11-141-12/+3
| | | | | | | | | | | | | | | We lowercase the keys to the hash table used to store netgroups but do not lowercase it when reading the table. This results in nested netgroups not being found when they should and the processing fails. The lowercasing does not seem to be necessary anymore (not sure if it ever was) so we can skip it. Resolves: https://fedorahosted.org/sssd/ticket/3159 Reviewed-by: Petr Cech <pcech@redhat.com>
* IPA/AD: check auth ctx before using itSumit Bose2016-11-102-5/+28
| | | | | | | | | | | | | In e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483 a feature was introduced to set the 'canonicalize' option in the system-wide Kerberos configuration according to the settings in SSSD if the AD or IPA provider were used. Unfortunately the patch implied that the auth provider is the same as the id provider which might not always be the case. A different auth provider caused a crash in the backend which is fixed by this patch. Resolves https://fedorahosted.org/sssd/ticket/3234 Reviewed-by: Petr Cech <pcech@redhat.com>
* MONITOR: Remove unused shutDown sbus methodJakub Hrozek2016-11-091-1/+0
| | | | | | | The shutDown method has not been used or set for a long time. Trim the internal interface by removing all references to this internal method. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Remove deprecated pong sbus methodJakub Hrozek2016-11-091-1/+0
| | | | | | | The pong method is deprecated since we started using the watchdog. Since this is dead code, it makes sense to just remove it. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as wellJakub Hrozek2016-11-031-1/+7
| | | | | | | | | | | | | | | | | | | In cases where the domain name in sssd.conf does not match the AD domain, our previous matching process wouldn't match. This patch augments the matching as follows: - the search base is known to sysdb_try_to_find_expected_dn and is expected to be non-NULL - the existing matching is ran first - during the search base, matching, all the non-DC components are stripped from the search base to 'canonicalize' the search base - if only a single entry that matches with a non-DC DN component (matching with a DC component would mean the DN comes from a different domain) then this entry is a match and is returned Resolves: https://fedorahosted.org/sssd/ticket/3199 Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP/AD: resolve domain local groups for remote usersSumit Bose2016-10-313-7/+568
| | | | | | | | | | | | | If a user from a trusted domain in the same forest is a direct or indirect member of domain local groups from the local domain those memberships must be resolved as well. Since those domain local groups are not valid in the trusted domain a DC from the trusted domain which is used to lookup the user data is not aware of them. As a consequence those memberships must be resolved against a local DC in a second step. Resolves https://fedorahosted.org/sssd/ticket/3206 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: make some nested group related calls publicSumit Bose2016-10-312-10/+18
| | | | | | | sdap_nested_groups_store() and rfc2307bis_nested_groups_send/recv() will be reused for domain local group lookups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add parent_dom to sysdb_get_direct_parents()Sumit Bose2016-10-311-4/+7
| | | | | | | | | | Currently sysdb_get_direct_parents() only return direct parents from the same domain as the child object. In setups with sub-domains this might not be sufficient. A new option parent_dom is added which allows to specify a domain the direct parents should be lookup up in. If it is NULL the whole cache is searched. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Removing of member link from groupSumit Bose2016-10-141-0/+9
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2940 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Initialize a boolean control valueJakub Hrozek2016-10-041-1/+6
| | | | | | | | | | | | | | | | | | | | | | | without this patch, valgrind was reporting: ==30955== Conditional jump or move depends on uninitialised value(s) ==30955== at 0xDBBACC3: ipa_subdomains_slave_search_done (ipa_subdomains.c:1111) ==30955== by 0xE73B34D: sdap_search_bases_ex_done (sdap_ops.c:222) ==30955== by 0xE6FFA98: sdap_get_generic_done (sdap_async.c:1872) ==30955== by 0xE6FF4E2: generic_ext_search_handler (sdap_async.c:1689) ==30955== by 0xE6FF840: sdap_get_and_parse_generic_done (sdap_async.c:1797) ==30955== by 0xE6FEFB5: sdap_get_generic_op_finished (sdap_async.c:1579) ==30955== by 0xE6FB1D2: sdap_process_message (sdap_async.c:353) ==30955== by 0xE6FAD51: sdap_process_result (sdap_async.c:197) ==30955== by 0xE6FAA14: sdap_ldap_next_result (sdap_async.c:145) ==30955== by 0x8E157FF: tevent_common_loop_timer_delay (tevent_timed.c:341) ==30955== by 0x8E16809: epoll_event_loop_once (tevent_epoll.c:911) ==30955== by 0x8E14F09: std_event_loop_once (tevent_standard.c:114) ==30955== Resolves: https://fedorahosted.org/sssd/ticket/3213 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Fixing FQ name of user in krb5_setup()Petr Čech2016-09-224-3/+36
| | | | | | | | | | This patch fixes creation of FQ username if krb5_map_user option ise used. Resolves: https://fedorahosted.org/sssd/ticket/3188 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: proceed normally when no new server is foundPavel Březina2016-09-221-4/+21
| | | | | | | | | | | | | | | Multiple failover requests come in same time, the first one will result in collapsing the meta server but multiple resolution of SRV records are triggered. The first one finishes normally but the others won't find any new server thus ends with an error. This patch makes failover to proceed normally even in such case. Resolves: https://fedorahosted.org/sssd/ticket/3131 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-217-9/+9
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Return partial results from adminlimit exceededJakub Hrozek2016-09-141-1/+2
| | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3185 Since commit c420ce830ac0b0b288a2a887ec2cfce5c748018c we try to move to the next server on any error on the connection, which in case there is only one server sends SSSD offline. It's more graceful to try to process the results, same as we already do with sizelimit exceeded. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-131-2/+20
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Fix settig paging attribute in sdap_get_generic_ext_sendLukas Slebodnik2016-09-131-3/+3
| | | | | | | | | We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Return ERR_NETWORK_IO on clock skewJakub Hrozek2016-09-131-0/+2
| | | | | | | | | | | Adds two more return codes to the list of codes we translate to ERR_NETWORK_IO. Resolves: https://fedorahosted.org/sssd/ticket/3174 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Send the output username, not internal fqname to krb5_childJakub Hrozek2016-09-084-11/+30
| | | | | | | | | | | | | | | | | | krb5_child calls krb5_kuserok() during the access phase which checks if a particular user is allowed to authenticate as a particular principal. We used to pass the internal fqname to krb5_kuserok() which broke the functionality and all users were denied access. This patch changes that to send the 'output' username to krb5_child, because that's the username the system receives through getpwnam() or getpwuid() anyway. The patch also adds a new structure member fo the krb5child_req structure to avoid reusing the pd->user variable but have an explicit one that serves as the input for the child process. Resolves: https://fedorahosted.org/sssd/ticket/3172 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_initgr_nested_get_membership_diff: use fully-qualified namesSumit Bose2016-09-011-1/+1
| | | | | | | | | | | | I think this is a leftover from the change to use fully-qualified names in sysdb. To verify this you can create a nested group in IPA. Without this patch the id command will only show the groups the user is a direct member of. With the patch the indirect groups memberships should be shown as well. https://fedorahosted.org/sssd/ticket/3163 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* dyndns: fix typo and unify ipa with ad debug message when offPavel Březina2016-08-302-2/+2
| | | | | Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Use right name in ldap filterLukas Slebodnik2016-08-301-3/+8
| | | | | | | | | | | | We used internal fq name in ldap filter with id_provider proxy to files and auth provider ldap [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com]. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PROXY: Share common code of save_{group,user}()Fabiano Fidêncio2016-08-271-80/+65
| | | | | | | | | | | | | | | These two functions (save_user() and save_group()) share, between themselves, the code preparing the attributes that are going to be stored in the sysdb. This patch basically splits this code out of those functions and introduces the new prepare_attrs_for_saving_ops(). Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Mention that save_user()'s parameters are already qualifiedFabiano Fidêncio2016-08-271-2/+3
| | | | | | | | | | Those comments are similar to what we have in the save_group() function. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_group()Fabiano Fidêncio2016-08-271-7/+5
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->group_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_user()Fabiano Fidêncio2016-08-271-7/+7
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->user_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove lowercase attribute from save_user()Fabiano Fidêncio2016-08-271-13/+9
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply check whether we will need a lowercase name by accessing domain->case_sensitive. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Parse qualified names when guessing AD user principalJakub Hrozek2016-08-261-2/+12
| | | | | | | | | | | | | | | | | | | Most AD users store their UPN in an attribute. If they don't, or the sssd was configured (typically in earlier versions to work around a bug) to not look at the principal attribute, then sssd is supposed to guess the attribute. That currently doesn't work in 1.14, because the username is already qualified and then we also append the realm name to it. We need to parse the simple username from the qualified name first. The issue can be reproduced simply by authenticating as the Administrator account in IPA-AD trust setups. Resolves: https://fedorahosted.org/sssd/ticket/3127 Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Fixing of removing netgroup from cachePetr Cech2016-08-241-0/+16
| | | | | | | | | | There were problem with local key which wasn't properly removed. This patch fixes it. Resolves: https://fedorahosted.org/sssd/ticket/2841 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Use the fqname when converting to lowercaseFabiano Fidêncio2016-08-241-1/+1
| | | | | | | | | | | | | | When saving the user there is a comparison between the "cased alias" and the "lowercase password name". However, the first doesn't use fully qualified name while the second does, resulting in a not expected override of the "nameAlias" attribute of a stored user when trying to authenticate more than once using an alias. Resolves: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap: Skip exact duplicates when extending mapsMichal Židek2016-08-191-10/+32
| | | | | | | | | | | | | | | | | | When extending map with entry that already exists in the map in the exacty same form, then there is no need to fail. We should only fail if we try to change purpose of already used sysdb attribute. Resolves: https://fedorahosted.org/sssd/ticket/3120 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Add log message for get account infoLukas Slebodnik2016-08-171-0/+5
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-28 02:57:16 +0000