summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccacheJakub Hrozek2017-03-306-22/+99
| | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 The following changes were done to the Kerberos authentication code in order to support authentication in a non-POSIX environment: - delayed authentication is disabled in non-POSIX domains - when a user logs in in a non-POSIX domain, SSSD uses a MEMORY:$username ccache and destroys is then krb5_child finishes so that just the numeric result is used - krb5_child doesn't drop privileges in this configuration because there is nothing to drop privileges to Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Relax search filters in application domainsJakub Hrozek2017-03-303-13/+66
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a request comes towards an application domain, we can drop the part of the filter that asserts that the object has a valid UID/GID. Instead, we just search by name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: save non-POSIX users in application domainsJakub Hrozek2017-03-301-15/+57
| | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 If a user being saved by the LDAP provider does not have a UID or GID and the domain type is application, we save the user entry as non-POSIX. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: enable AD user lookup by certificateSumit Bose2017-03-291-0/+1
| | | | | | | | | Without this the lookup by certificate for AD users on an IPA client will just error out. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: lookup AD users by certificates on IPA clientsSumit Bose2017-03-291-4/+105
| | | | | | | | | | Get a list of users mapped to a certificate back from the IPA server, look them up and store them together with the certificate used for the search as mapped attribute to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: add mapped attributes to user from trusted domainsSumit Bose2017-03-291-9/+24
| | | | | | | | | Allow the usage of the mapped attribute for the lookup of AD users on IPA clients as already used for the normal LDAP lookup. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: return to responder that pkinit is not availableSumit Bose2017-03-291-4/+13
| | | | | | | | | | | If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from IPA ID ViewFabiano Fidêncio2017-03-291-0/+182
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA_SUBDOMAINS: Rename _refresh_view() to _refresh_view_name()Fabiano Fidêncio2017-03-291-3/+4
| | | | | | | | | | | | | This method got renamed in order to match better with what it does currently. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Get ipaDomainsResolutionOrder from ipaConfigFabiano Fidêncio2017-03-291-12/+156
| | | | | | | | | | | | | | | | | | | | | | ipaDomainsResolutionOrder provides a list of domains that have to be looked up firstly during cache_req searches. This commit only fetches this list from the server and stores its value at sysdb so we can make use of it later on this patch series. There are no tests for newly introduced sysdb methods are those are basically only calling sysdb_update_domain_resolution_order(), sysdb_get_domain_resolution_order() and sysdb_get_use_domain_resolution_order() which are have tests written for. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-292-5/+8
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Introduce subdomain_create_conf_path()Michal Židek2017-03-294-17/+2
| | | | | | | | | | This is a utility function that replaces the create_subdom_conf_path(). Differently than the latter, it only takes one parameter and is going to be used in a few different places (thus adding it to util.h). Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* IPA: Enhance debug logging for ipa s2n operationsJustin Stephenson2017-03-231-0/+28
| | | | | | | | | | | | | Add log messages to provide useful debug logging surrounding IPA client extended operations to the IPA Server during AD trust requests to retrieve information. Print more details about the objects requested and received during the ipa_s2n operations. This will improve log analysis and troubleshooting efforts during AD trust user and group resolution failures on IPA clients, such as missing groups. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add s2n request to string functionJustin Stephenson2017-03-231-0/+16
| | | | | | | | Add a function to convert request_types to string allowing the ability to print request type information for ipa_s2n functions during IPA client operations. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: add certmap supportSumit Bose2017-03-235-1/+367
| | | | | | | | | | Read certificate mapping data from the IPA server and configure the certificate mapping library accordingly. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-232-2/+2
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: always store the certificate from the requestSumit Bose2017-03-231-1/+18
| | | | | | | | | | Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_get_users_send(): new argument mapped_attrsSumit Bose2017-03-237-7/+47
| | | | | | | | | | | | | | | | mapped_attrs can be a list of sysdb_attrs which are not available on the server side but should be store with the cached user entry. This is needed e.g. when the input to look up the user in LDAP is not an attribute which is stored in LDAP but some data where LDAP attributes are extracted from. The current use case is the certificate mapping library which can create LDAP search filters based on content of the certificate. To allow upcoming cache lookup to use the input directly it is stored in the user object in the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SUBDOMAINS: Allow options ad(_backup)_serverMichal Židek2017-03-152-2/+12
| | | | | | | | | | | Allow following options in the subdomain section: ad_server ad_backup_server Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUBDOMAINS: Configurable search basesMichal Židek2017-03-154-118/+228
| | | | | | | | | | | Added new trusted domain section in the sssd.conf were the search bases for the trusted domain can be specified. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* data_provider: Fix typo in DEBUG messageMichal Židek2017-03-151-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PROXY: Remove duplicit users from groupPetr Čech2017-03-151-4/+149
| | | | | | | | | | It is possible to have duplicit members in local files (/etc/group). This patch removes duplicity in groups in proxy provider. Resolves: https://pagure.io/SSSD/sssd/issue/3314 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IPA: get overrides for all users found by certificateSumit Bose2017-03-101-28/+132
| | | | | | | | | Lookups by certificates can return more than one result. With this patch the IPA provider will check for overrides for all returned users. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: allow muliple users mapped to a certificateSumit Bose2017-03-101-0/+6
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fixed typo in debug outputThorsten Scherf2017-03-081-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-033-3/+3
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Use cache_req to perform initgroups lookupsFabiano Fidêncio2017-03-031-1/+0
| | | | | | | | | | | | | | PAM responder has been already taking advantage of the cache_req interface, so this patch is just replacing some code that performs initgroups lookups by using cache_req to do so. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: allow pkinit pre-authenticationSumit Bose2017-02-233-13/+297
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-232-1/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/proxy: tell frontend that Smartcard auth is not supportedSumit Bose2017-02-232-1/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FILES: Remove unnecessary checkLukas Slebodnik2017-02-221-1/+1
| | | | | | | | | "grp_iter->gr_mem" is an array of strings and not just a string. We tried to compare first string to NULL (acctually '\0') But after that we iterated over the array to find count of members and we check for NULL one more time. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* FILES: Fix reallocation logicJakub Hrozek2017-02-221-2/+7
| | | | | | | | | | | There were two bugs in the files provider reallocation logic: 1) the reallocated array was not NULL-terminated properly 2) talloc_get_size was used in place of talloc_array_length This bug could have resulted in a crash when the passwd or groups file contained more than FILES_REALLOC_CHUNK entries. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* check_duplicate: check name member before using itSumit Bose2017-02-221-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3231 Reviewed-by: Petr Cech <pcech@redhat.com>
* sdap_extend_map: make sure memory can be freedSumit Bose2017-02-222-2/+23
| | | | | | | | | | If there is an error after calling talloc_realloc() the caller cannot free the memory properly because neither src_map nor _map were pointing to a valid memory location. With this patch _map will always point to the current valid location so that it can always be used with talloc_free(). Reviewed-by: Petr Cech <pcech@redhat.com>
* DYNDNS: Correct debug log message of realmJustin Stephenson2017-02-221-1/+5
| | | | | | | | | | If the realm is not added to the nsupdate message, the SSSD Debug log message should inform about utilizing autodiscovered realm. Resolves: https://fedorahosted.org/sssd/ticket/3220 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* DYNDNS: Update PTR record after non-fatal errorJustin Stephenson2017-02-221-3/+0
| | | | | | | | | | Continue to send PTR record update in situations where the nsupdate child forward zone updates are successful but nsupdate returns non-zero Resolves: https://fedorahosted.org/sssd/ticket/3227 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IPA_SUDO: Unused value fixPetr Čech2017-02-161-1/+0
| | | | | | | | | Unused value was immediately overwritten. Resolves: https://fedorahosted.org/sssd/ticket/3309 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* FILES: Add the files providerJakub Hrozek2017-02-154-0/+1146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a new provider type "files". The provider watches the UNIX password and group databases for changes using inotify and propagates its contents to the sysdb. The files provider is only built on platforms that support the inotify interface, polling or loading the entries on-deman is not supported. During initialization, the files are loaded from the environment variables SSS_FILES_PASSWD and SSS_FILES_GROUP, defaulting to /etc/passwd and /etc/group respectively. Loading the files from environment variables is mostly implemented for tests that need to load nss_wrapped files. The files provider is a bit different from other provider types in the sense that it always enumerates full contents of the database. Therefore, the requests from Data Provider are always just replied to with success. Enumerating the contents is done in full at the moment, all users and all groups are removed and added anew. Modifying the passwd and group databses should be rare enough for this to be justified and we can optimize the code later. Since with large databases, the cache update might take a bit of time, we signal the responders to disable the files domain once we receive the inotify notification and re-enable the files domain after the update is finished. The idea is that the NSS configuration would still contain "files" after "sss" so that if the domain is disabled, libc would fall back to a direct "files" lookup. Resolves: https://fedorahosted.org/sssd/ticket/3262 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Contact inconsistent domainsJakub Hrozek2017-02-151-0/+5
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add internal interface to invalidate memory cache from DPJakub Hrozek2017-02-152-0/+39
| | | | | | | Adds an interfae to the Data Provider that allows the DP to notify the NSS responder to invalidate its memory cache records. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add internal interface to reset negative cache from DPJakub Hrozek2017-02-152-1/+69
| | | | | | | Adds a an interface that allows the Data Provider to notify responders to drop their negative cache. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add internal DP interface to set domain stateJakub Hrozek2017-02-152-0/+98
| | | | | | | | Adds functions to the interface Data Provider publishes towards back ends that allows the back ends to notify responders that a domain has been enabled or disabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add a new domain state called DOM_INCONSISTENTJakub Hrozek2017-02-151-1/+3
| | | | | | | | | | | | This is a new domain state that indicates to the responder that it should always send a DP request because the provider is rebuilding the cache. Currently it will be only used by the files provider when it is updating the cache to make sure sssd always returns current data and updating the cache from files is not as racy. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Use ad_domain to match forest root domain, not the configured domain ↵Jakub Hrozek2017-02-081-2/+11
| | | | | | | | | | | | | | | | | | | | from sssd.conf If the sssd.conf domain name was different from the joined domain name, but sssd was joined to the forest root, the AD subdomains code considered sssd joined to a non-root domain and tried to discover the forest root. This could be reproduced by joining sssd to a domain, for example win.trust.test but calling the sssd.conf domain otherwise, for example: [domain/addomain] ad_domain = win.trust.test This is/was a frequent use-case in the RHEL world, where authconfig often names the sssd.conf domain 'default'. Without the patch, the trusted domains were not detected. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Removing of sysdb_try_to_find_expected_dn()Petr Čech2017-02-083-8/+30
| | | | | | | | | | | | | | | | Currently in order to match multiple LDAP search results we use two different functions - we have sysdb_try_to_find_expected_dn() but also sdap_object_in_domain(). This patch removes sysdb_try_to_find_expected_dn() and add new sdap_search_initgr_user_in_batch() based on sdap_object_in_domain(). This function covers necessary logic. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Better logging messagePetr Čech2017-02-081-1/+2
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUDO: Add skip_entry boolean to sudo conversionsJustin Stephenson2017-02-071-14/+41
| | | | | | | | | | | Add boolean to convert_attributes function and pass boolean as argument to sudo conversion functions to add logic for skipping unexpected entries like replication conflicts. Resolves: https://fedorahosted.org/sssd/ticket/3288 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FAILOVER: Improve port status log messagesJustin Stephenson2017-02-061-1/+7
| | | | | | | | It should be more clear to administrators that when SSSD internal port status is set as PORT_NOT_WORKING, this does not directly relate to an assumed network port-related issue. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: Fix use after freeLukas Slebodnik2017-02-011-9/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case on any krb5 related error, we tried to send string interpretation of krb5 error tb parrent in prepare_response. However, we cannot use global krb5 context (krb5_error_ctx) because the context is every time released in done section of ldap_child_get_tgt_sync. This patch rather return duplicated string to prevent use after free. Backtrace: #0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100 100 ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory. Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)): #0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100 No locals. #1 0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm", code=-1765328230, err_fmt=<optimized out>) at kerrs.c:152 buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10, space = 128, len = 0} p = <optimized out> s = 0xdededededededede <Address 0xdededededededede out of bounds> #2 krb5_get_error_message (ctx=<optimized out>, code=code@entry=-1765328230) at kerrs.c:184 std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm" #3 0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=<optimized out>, ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424 No locals. #4 0x00007fc96cb1fbb0 in prepare_response (rsp=<synthetic pointer>, kerr=-1765328230, expire_time=0, ccname=0x0, mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553 ret = <optimized out> r = 0x7fc96d1cd8b0 krb5_msg = 0x0 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-02-015-0/+8
| | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-20 00:16:33 +0000