summaryrefslogtreecommitdiffstats
path: root/src/responder/common
Commit message (Collapse)AuthorAgeFilesLines
* Move sized_output_name() and sized_domain_name() into responder common codeJakub Hrozek2017-04-212-0/+111
| | | | | | | | | | | | | | | | | | | | | These functions are used to format a name into a format that the user configured for output, including case sensitiveness, replacing whitespace and qualified format. They were used only in the NSS responder, which typically returns strings to the NSS client library and then the user. But it makes sense to just reuse the same code in the IFP responder as well, since it does essentially the same job. The patch also renames sized_member_name to sized_domain_name. Previously, the function was only used to format a group member, the IFP responder would use the same function to format a group the user is a member of. Related to: https://pagure.io/SSSD/sssd/issue/3268 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* responders: do not leak selinux context on clients destructionPavel Březina2017-04-031-1/+19
| | | | | | | | | | The SELinux context created in get_client_cred is not talloc bound and we were leaking it if available with each client's destruction. Resolves: https://pagure.io/SSSD/sssd/issue/3360 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CACHE_REQ: Domain type selection in cache_reqJakub Hrozek2017-03-3021-24/+158
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new enumeration cache_req_dom_type. It is a tri-state that allows the caller to select which domains can be contacted - either only POSIX, only application domains or any type. Not all plugins of cache_req have the new parameter added -- only those that are usable/useful in a non-POSIX environment. For example, it makes no sense to allow the selection for calls by ID because those are inherently POSIX-specific. Also, services or netgroups are supported only coming from POSIX domains. At the moment, the patch should not change any behaviour as all calls default to contacting POSIX domains only. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add domain_resolution_order config optionFabiano Fidêncio2017-03-292-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | This is the local equivalent of option of ipaDomainResolutionOrder and has precedence over the ones set on IPA side making the precedence order to be like: Local > View > Globally. As done for the IPA side configurations, the domains which were not explicitly set up will be apennded to the final of the domain_resolution_order list in the very same order they're presented in the "domains" option of [sssd] section in the config file. There's no guarantee of order for the subdomains though. It's also important to mention that no expansion magic is performed on our side. It means that if 'example.com' is set it does *not* stand for all its subdomains DNS wise (like 'foo.example.com', 'bar.example.com', etc). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Make use of domainResolutionOrderFabiano Fidêncio2017-03-296-37/+436
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | domainResolutionOrder has been introduced in the previous commits and allows the admin to set up a specific order which the domains will be resolved during a lookup and with this patch we can take advantage of this. In order to have it working a new structure has been added (struct domain_resolution_order) to the responder context and will be used by the cache_req to perform the lookups based on this list. As the ipaDomainResolutionOrder may be set globally on IPA or per View, SSSD does respect the following precedence order: View > Globally. The way the list is built is quite simple, basically having the domains present on ipaDomainResolutionOrder as the first domains (in that specific order) and then appending the remaining domains to this list. The final result is a completely flat list with all the domains respecting the specified order (it's important to remember that the domains not specified won't follow any specific order, they're just "random" based on the domains list present in the responder context. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Descend into subdomains on lookupsFabiano Fidêncio2017-03-2910-10/+10
| | | | | | | | | | | | | | | | | | | | | Let's make all plugins, but the "host_by_name", to descend into the subdomains on lookups. This patch basically prepares the field for the coming up patches that will allow group/user resolution in all domains (or a subset of the domains) to be possible by only using the short names without the domain component. The "host_by_name" plugin was not changed as it's a specific IPA plugin and won't find anything on its subdomains. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-291-4/+5
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* nss: allow larger buffer for certificate based requestsSumit Bose2017-03-232-1/+21
| | | | | | | | | To make sure larger certificates can be processed as well the maximal buffer size is increased for requests by certificate. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: shortcut if object is foundPavel Březina2017-03-141-0/+12
| | | | | | | | | | | If we get a cache-hit but the object is expired or needs a midpoint refresh we assume that this domain is the one the result should come from and go to data provider directly. Related: https://pagure.io/SSSD/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Check the caches firstFabiano Fidêncio2017-03-145-35/+145
| | | | | | | | | | | | | | | | | | | This patch introduces a new configurable option to define whether the responder should query all domains' caches before querying the Data Providers. This new option is called cache_first and, by default, it's disabled, meaning that, for each provider, the responder may contact the cache and the data provider in the same iteration. Co-Author: Pavel Březina <pbrezina@redhat.com> Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move cache_req_next_domain() into a new tevent requestFabiano Fidêncio2017-03-141-148/+279
| | | | | | | | | | | | | This change prepares for the upcoming patch, which will have to support more than one iteration over all domains, leaving us with a better control of the whole logic around this iteration. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move result manipulation into a separate modulePavel Březina2017-03-143-219/+254
| | | | | | | | | | | | | | This patch is preparing the field for coming up patches where new lookup logic will be added. Taking this into consideration let's move the result manipulation code into a separate module and focus purely in the lookups logic in the main module. Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Make cache_req_{create_and_,}add_result() more genericPavel Březina2017-03-141-19/+34
| | | | | | | | | | | | This patch is preparing the field for coming up patches where this function will be re-used. In order to do so, let's remove the dependency for tevent states on both cache_req_create_and_add_result() and cache_req_add_result(). Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: allow multiple matches for searches by certificateSumit Bose2017-03-101-2/+2
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Wrap up the code to setup the idle timeoutFabiano Fidêncio2017-03-082-35/+54
| | | | | | | | | | | | | As secrets responder will make use of this very same code in the future, let's wrap it up into a new function in order to avoid code duplication. Related: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: use rctx as memory context during midpoint refreshPavel Březina2017-03-081-1/+1
| | | | | | | | Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Only search the given domain when looking up entries by UPNJakub Hrozek2017-03-031-2/+2
| | | | | | | | | | | | | | We were searching UPNs in the whole sysdb, which made cache_req think the result came in from the domain it was searching. The bug manifested when a user from a trusted domain was looked by UPN, then cache_req searched the main domain, the result from subdomain was considered as coming from the main domain and as a result, the getpwnam() output was not qualified. That is a problem, because PAM applications often sanitize the user with getpwnam, so effectively a login with UPN was shortened to just a shortname and failed. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-031-3/+4
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CACHE_REQ: Add cache_req_data_set_bypass_cache()Fabiano Fidêncio2017-03-034-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new cache_req_data method has been added because of the upcoming changes in the PAM responder. For deciding whether to contact the cache, or just query the data provider directly, PAM responder calls pam_initgr_check_timeout() which will return whether the cache entry may still be valid. The cache will be contacted only in case the cache entry is still valid, otherwise the data provider will be called. pam_initgr_check_timeout() basically checks whether the user (being looked up) is still a part of an in-memory hash table. Because the entry is a part of the hash table for really short period of time, and is automatically removed, the communication with the data provider is forced to happen quite often. As the follow-up changes should not modify this behaviour, this function was introduced so we can still call pam_initgr_check_timeout() and pass its result to the cache_req call that will perform the lookup. Related: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: use own namespace for UPNsSumit Bose2017-03-023-2/+42
| | | | | | | | | | | | | If the UPN use the same domain name as the configured domain an unsuccessful lookup by name will already create an entry in the negative cache. If the lookup by UPN would use the same namespace the lookup will immediately be finished because there would already be an entry in the negative cache. Resolves: https://pagure.io/SSSD/sssd/issue/3313 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Contact inconsistent domainsJakub Hrozek2017-02-151-3/+71
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDERJakub Hrozek2017-02-151-2/+7
| | | | | | | It makes no sense to contact the Data Provider with the files provider except when the files provider is updating itself. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Use the NEED_CHECK_DOMAIN macroJakub Hrozek2017-02-151-1/+11
| | | | | | | | This is to avoid a needless round-trip between the responder and the back end for domains that do not have a traditional back end such as local or files. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: A sbus interface to reset negatively cached users and groupsJakub Hrozek2017-02-156-0/+120
| | | | | | | | Adds two new responder sbus interface functions: ResetNegcacheUsers and ResetNegcacheGroups. These functions can be called by a Data Provider to signal to a responder that it should drop its negative cache. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Add a responder sbus interface to set domain stateJakub Hrozek2017-02-157-0/+315
| | | | | | | | | | Adds a generic responder s-bus interface that all responders implement. The interface currently contains methods that make it possible for a sssd domain to be marked as active or inconsistent by a back end. In the future, this commit will be superseded by sbus signals. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Add API to reset all users and groupsJakub Hrozek2017-02-152-0/+58
| | | | | | | | Adds a negative cache API to reset negatively cached users and groups. This will be used when the files back end finishes enumeration to make sure all results are available. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: always go to dp first when looking up hostPavel Březina2017-02-081-1/+1
| | | | | | | We need to always lookup host in DP first to update host certificates so we are consinstent during ssh authentication. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: add host by name searchPavel Březina2017-02-088-0/+357
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: move dp request to pluginPavel Březina2017-02-0823-313/+360
| | | | | | | This will allow to use cache req even for object that do not use account request such as hosts. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add api to create ldb_result from messagePavel Březina2017-02-081-19/+28
| | | | | | | | | Some sysdb methods doesn't return ldb_result as output but return ldb_message instead. Changing sysdb to be consistent is too big so I added this helper function that will wrap resulting message into ldb_result. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: search user by name with attrsPavel Březina2017-02-082-2/+42
| | | | | | | Sometime is is desirable to aquire more attribute from user object than SYSDB_PW_ATTRS set. such as user's public key. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add ability to not use default domain suffixPavel Březina2017-02-0821-1/+31
| | | | | | | This will be used in the next plugin "host by name" where it is not desirable to use default domain suffix if set. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_parse_inp_send: provide default_domain as parameterPavel Březina2017-02-083-6/+32
| | | | | | | | | | | It is not always desirable to consider default_domain from configuration but expect none instead. For example when we search host certificates. This is currently not used in this patch since host lookups parse name directly with sss_parse_name but it will be used in the next patch. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Suppres implicit-fallthrough from gcc 7Lukas Slebodnik2017-02-011-0/+1
| | | | | | | Some kind of comments are recognized by gcc7 but they are ignored with -Wimplicit-fallthrough=5 and only attributes disable the warning. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* RESPONDER: Change how client timeout is calculatedFabiano Fidêncio2017-01-232-8/+33
| | | | | | | | | | | | | | | | Taking Pavel Březina's suggestion, let's avoid always re-creating the idle timer and go for a simpler and not so precise approach where we store the time of the last operation done and then have a simple periodic timer that fires each "client_idle_time/2" and there it checks whether the "current time - last request time > client_idle_time". As said, it won't be as precise as the way done currently but it will save us lots of memory operations. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idleFabiano Fidêncio2017-01-232-1/+132
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit introduces a new option for the responders called responder_idle_timeout, which specifies the number of seconds that the responder process can be up without being used. The default value is 300 seconds (5 minutes) and can be configured per responder, being 60 seconds the minimum acceptable value. Is important to note that setting "responder_idle_timeout = 0" disables the responder timeout, which makes sense for the responders that always will be running. The shutdown timeout is activated per responder in case the responder has been {dbus,socket}-activated. In case of any commnunication with the responder the timeout is reset thereby ensuring we won't shutdown a responder that is not idle. Setting the responder's last request time is done slightly differently for socket-activated and dbus-activated responders. In both cases it's updated in any internal communication in sbus_message_handler(), but for the socket-activated responders it's also updated when the responder's socket is used. Currently it works properly with all responders but the secrets one, which has a different logic and must be treated separately in case some change is required there. Is worth to mention that this commit does not affect the responders explicitly configured in the "services" line of sssd.conf. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Don't expose client_idle_handler()Fabiano Fidêncio2017-01-232-21/+16
| | | | | | | | | | | | | It's been only used by reset_client_idle_handler(). So, no need to expose this function. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Make clear {reset_,}idle_timer() are related to clientFabiano Fidêncio2017-01-232-13/+13
| | | | | | | | | | | | | | Those public functions dealing with idle_timer are related to the client's timeout. Let's make it explicit as we will introduce more timeout handlers (this time, related to the responder itself). Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Add a time_t pointer to the sbus_connectionFabiano Fidêncio2017-01-231-1/+2
| | | | | | | | | | | | | | | | | The idea of this commit is to provide a way to update the time of the last request coming from/going to the responders through sbus. For now it's not used anywhere as all the functions that will pass their time_t to the sbus_connection are currently passing NULL. It will be used by follow-up patches. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Make responders' common code ready for socket activationFabiano Fidêncio2017-01-231-36/+34
| | | | | | | | | | | | | | | | | | | | | | | Instead of simply setting the unix socket during the process initialization, let's make it socket-activatable. It's the first step in order to have socket-activated responders and doesn't introduce any kind of regression with the current code. Also, we must avoid setting the responders fds to -1 in all cases as it may have cause the socket to be unreachable in case the administrator decides to move back from socket-activation to using the services line in sssd.conf. With this change, the responders will have to activelly set their sockets fd to -1 before calling activate_unix_sockets(), which is already done everyone but in Secrets and in one piece of PAM responder. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Introduce --dbus-activated cmd option for respondersFabiano Fidêncio2017-01-232-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Similarly to the --socket-activated cmd option, --dbus-activated cmd option is going to be used for dbus-activated responders in order to easily setup a timeout to shutdown the idle responder in case it has been socket activated and is idle. This option has been encapsulated on is_dbus_activated() function, which will always return "false" when called on platforms where systemd is not supported. For now any of the services are taking advantage of this newly introduced option/function, but later on in this series it's going to be used. In order to use it, just add SSSD_RESPONDER_OPTS to the poptOption structure. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Introduce --socket-activated cmdline option for respondersFabiano Fidêncio2017-01-232-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This option is going to be used for socket-activated responders as they are special in some ways. So, by knowing this option we can: - skip owning the debug files as it will be done by the responders' unit files; - skip "become_user()", as the process will already be started by the proper user bu the responders' unit files; - setup a timeout to shutdown the responder in case it has been socket-activated and is idle. This option has been encapsulated on is_socket_activated() function, which will always return "false" when called on platforms where systemd is not supported. For any of the services are taking advantage of this newly introduced option/function, but later on in this series it's going to be used. In order to use it, just add SSSD_RESPONDER_OPTS to the poptOption structure. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Pass the service type to the RegisterService methodFabiano Fidêncio2017-01-231-2/+2
| | | | | | | | | | | | | | | | Passing the service type to the RegisterService method will help us in the future, for socket-activation, as we will need to differentiate cases where the service being registered is still not in the services' list but is a valid case and has to be added there as it was socket-activated. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Remove unused attr_type from struct dp_id_dataLukas Slebodnik2017-01-161-4/+2
| | | | | | | | | Structure member attr_type was set to BE_ATTR_CORE on all places and there was a single place src/providers/ldap/ldap_id.c where we checked to other values. It is not used anymore; it's better to remove it. Reviewed-by: Michal Židek <mzidek@redhat.com>
* nss: rewrite nss responder so it uses cache_reqPavel Březina2016-12-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Given the size of the current nss responder it was quite impossible to simply switch into using the cache_req interface, especially because most of the code was duplication of cache lookups. This patch completely rewrites the responder from scratch. The amount of code was reduced to less than a half lines of code with no code duplication, better documentation and better maintainability and readability. All functionality should be intact. *Code organization* All protocol (parsing input message and send a reply) is placed in nss_protocol.c. Functions that deals with creating a reply packet are placed into their specific nss_protocol_$object.c files. All supported commands are placed into nss_cmd.c. Functions that deals with cache req are in nss_get_object.c and nss_enum.c. *Code flow for non-enumeration* An nss_getby_$input-type is called for each non-enumeration command. This function parses the input message, creates a cache_req_data structure and issues nss_get_object that calls cache_req. When this request is done nss_getby_done make sure a reply is sent to the client. *Comments on enumeration* I made some effort to make sure enumeration shares the same code for users, groups, services and netgroups. Netgroups now uses nss negative cache instead of implementing its own. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: do not try to contact DP with LOCAL providerPavel Březina2016-12-191-0/+22
| | | | | | | | | | | We make sure in responder dp code that we do not contact data provider if the provider is a local one. We just return success. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: unify usage of sss_cmd_send_empty and _errorPavel Březina2016-12-192-3/+2
| | | | | | | | | | | | | | | | | | | | | Originally sss_cmd_send_empty() called also sss_cmd_done() to send an empty reply packet to the cliant where as sss_cmd_send_error() did not invoke this call and required the caller to call it manually. For this reason, a possible error in users_find_by_cert_done() was not send to the caller. This patch unifies the usage of those two functions in a way that both of them only creates the reply packet but do not send it. Another sss_cmd_done() call is required to send the reply. Because sss_cmd_done() is now always called, unit tests needed to be changed to always mock a value for __wrap_sss_cmd_done. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: do not set ncache if dp request failsPavel Březina2016-12-193-10/+36
| | | | | | | | | | | We will only remember entry in the negative cache if the data provider requests succeeded because only then we can be sure that the entry does not exist. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: allow to search subdomains without fqnPavel Březina2016-12-196-10/+10
| | | | | | | | | | This patch allows plugins that do not require name qualification on multi-domain search to perform lookup also in subdomains. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: fix plugin function descriptionPavel Březina2016-12-191-2/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 15:44:52 +0000