summaryrefslogtreecommitdiffstats
path: root/src/responder/pam
Commit message (Collapse)AuthorAgeFilesLines
* PAM: Add application servicesJakub Hrozek2017-03-303-2/+62
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Remove unneeded memory contextJakub Hrozek2017-03-301-4/+4
| | | | | | | | | Since we only store data into pam_ctx in get_public_domains(), it doesn't make sense to allow passing a separate memory context. It is always going to be pam_ctx, otherwise the memory hierarchy will cause issues anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CACHE_REQ: Domain type selection in cache_reqJakub Hrozek2017-03-301-1/+4
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new enumeration cache_req_dom_type. It is a tri-state that allows the caller to select which domains can be contacted - either only POSIX, only application domains or any type. Not all plugins of cache_req have the new parameter added -- only those that are usable/useful in a non-POSIX environment. For example, it makes no sense to allow the selection for calls by ID because those are inherently POSIX-specific. Also, services or netgroups are supported only coming from POSIX domains. At the moment, the patch should not change any behaviour as all calls default to contacting POSIX domains only. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: allow muliple users mapped to a certificateSumit Bose2017-03-102-59/+76
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Improve debugging on smartcard creds forwardSumit Bose2017-03-031-0/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* PAM: Use cache_req to perform initgroups lookupsFabiano Fidêncio2017-03-032-388/+83
| | | | | | | | | | | | | | PAM responder has been already taking advantage of the cache_req interface, so this patch is just replacing some code that performs initgroups lookups by using cache_req to do so. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-231-7/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: return name of PKCS#11 module and key id to pam_sssSumit Bose2017-02-233-10/+90
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: forward Smartcard credentials to backendsSumit Bose2017-02-232-23/+82
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: store user object in the preq contextSumit Bose2017-02-232-6/+7
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Make PAM responder socket-activatableFabiano Fidêncio2017-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As part of the effort of making all responder socket-activatable, let's make PAM responder ready for this by providing its systemd's units. In case the administrators want to use PAM responder taking advantage of socket-activation they will need to enable sssd-pam.socket and after a restart of the sssd service, the PAM socket will be ready waiting for any activity in order to start the PAM responder. Also, the PAM responder must be removed from the services line on sssd.conf. The PAM responder service is binded to the SSSD service, which means that the responder will be restarted in case SSSD is restarted and shutdown in case SSSD is shutdown/crashes. PAM responder, differently from the others, is a special case as it has two sockets and its private sockets must be owned by root and must have a specifc permission (0600). It's not new, though, and it's following what has been already done in the project.. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Make responders' common code ready for socket activationFabiano Fidêncio2017-01-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Instead of simply setting the unix socket during the process initialization, let's make it socket-activatable. It's the first step in order to have socket-activated responders and doesn't introduce any kind of regression with the current code. Also, we must avoid setting the responders fds to -1 in all cases as it may have cause the socket to be unreachable in case the administrator decides to move back from socket-activation to using the services line in sssd.conf. With this change, the responders will have to activelly set their sockets fd to -1 before calling activate_unix_sockets(), which is already done everyone but in Secrets and in one piece of PAM responder. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Introduce --socket-activated cmdline option for respondersFabiano Fidêncio2017-01-231-16/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This option is going to be used for socket-activated responders as they are special in some ways. So, by knowing this option we can: - skip owning the debug files as it will be done by the responders' unit files; - skip "become_user()", as the process will already be started by the proper user bu the responders' unit files; - setup a timeout to shutdown the responder in case it has been socket-activated and is idle. This option has been encapsulated on is_socket_activated() function, which will always return "false" when called on platforms where systemd is not supported. For any of the services are taking advantage of this newly introduced option/function, but later on in this series it's going to be used. In order to use it, just add SSSD_RESPONDER_OPTS to the poptOption structure. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: remove checks that are handled inside cache_reqPavel Březina2016-12-191-7/+0
| | | | | | | | | Those checks were redundant, since they are already part of cache_req. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: encapsulate output data into structurePavel Březina2016-12-191-8/+6
| | | | | | | | | | | | | In enumeration calls we want to get objects from all domains, not only from the first matched domain. We move the cache search result into a structure that contains combination of domain and ldb_result. This is preparation for enumeration support inside cache_req. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Remove unused shutDown sbus methodJakub Hrozek2016-11-091-1/+0
| | | | | | | The shutDown method has not been used or set for a long time. Trim the internal interface by removing all references to this internal method. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Remove deprecated pong sbus methodJakub Hrozek2016-11-091-1/+0
| | | | | | | The pong method is deprecated since we started using the watchdog. Since this is dead code, it makes sense to just remove it. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: add pam_response_filter optionSumit Bose2016-11-022-8/+106
| | | | | | | | | Currently the main use-case for this new option is to not set the KRB5CCNAME environment varible for services like 'sudo-i'. Resolves https://fedorahosted.org/sssd/ticket/2296 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add a test for filter_responses()Sumit Bose2016-11-022-2/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: switch to new codePavel Březina2016-10-201-1/+1
| | | | | | | This patch switch the old switch-based cache req code to the new plugin-based. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* p11: return a fully-qualified nameSumit Bose2016-09-161-11/+9
| | | | | | Related to https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: only set PKCS11_LOGIN_TOKEN_NAME if gdm-smartcard is usedSumit Bose2016-09-161-13/+20
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Remove old data provider interfacePavel Březina2016-08-162-14/+3
| | | | | | | | | Reverse data provider interface is moved to a better location in NSS responder. All responders now can have an sbus interface defined per data provider connection. The unused old data provider interface is removed. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Do not act on ldb_message in case of a failureJakub Hrozek2016-08-081-15/+18
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Fix domain for UPN based lookupsSumit Bose2016-07-291-0/+17
| | | | | | | Since sysdb_search_user_by_upn() searches the whole cache we have to set the domain so that it matches the result. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: continue with UPN/email search if name was not foundSumit Bose2016-07-291-0/+39
| | | | | | | | Currently we only search for UPNs if the domain part of the name was not know, with Kerberos aliases and email addresses we have to do this even if the domain name is a know domain. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Use qualified names internally in the PAM responderJakub Hrozek2016-07-072-19/+40
| | | | | | | The name is converted from whatever we receive on input to the internal format before processing the data further. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Responders: Make the client context more genericSimo Sorce2016-06-292-7/+13
| | | | | | | | | | | | | | | This is useufl to allow reusing the responder code with other protocols. Store protocol data and responder state data behind opaque pointers and use tallog_get_type to check they are of the right type. This also allows to store per responder state_ctx so that, for example, the autofs responder does not have to carry useless variables used only by the nss responder. Resolves: https://fedorahosted.org/sssd/ticket/2918 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: New interface for client registrationPavel Březina2016-06-201-3/+1
| | | | | | | | | | | | | | | | This is just a beginning of new responder interface to data provider and it is just to make the client registration work. It needs further improvement. The idea is to take the existing interface and make it work better with further extensions of data provider. The current interface has several disadvantages such as it is originally build only for account requests and doesn't take different set of output parameters. It also doesn't work well with integration into tevent-made responders. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-181-18/+18
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* p11: add PKCS11_LOGIN_TOKEN_NAME environment variableSumit Bose2016-06-091-0/+25
| | | | | | | The PKCS11_LOGIN_TOKEN_NAME environment variable is e.g. used by the Gnome Settings Daemon to determine the name of the token used for login. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-311-19/+25
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-191-8/+6
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Removing ncache from pam_ctxPetr Cech2016-05-113-18/+8
| | | | | | This patch switches ncache from pam_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from pam responderPetr Cech2016-05-113-9/+1
| | | | | | | | | | | | It removes neg_timeout parameter from struct pam_ctx. Timeout is handled by context of negative cache internally. This patch additioanlly removes neg_timeout from struct cache_req_state. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Removing timeout from sss_ncache_check_*Petr Cech2016-05-111-4/+2
| | | | | | | | | | | | | | | | It removes timeout parameter from check functions of negative cache. Timeout is set ny init function and it is handled internally. API change: * int sss_ncache_check_...(struct sss_nc_ctx *ctx, int ttl, <----- timeout vanished struct sss_domain_info *dom, ...); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Adding timeout to struct sss_nc_ctxPetr Cech2016-05-111-1/+5
| | | | | | | | | | | | | | | | | | | It adds timeout of negative cache to handling struct sss_nc_ctx. There is one change in API of negatice cache: * int sss_ncache_init(TALLOC_CTX *memctx, uint32_t timeout, <----- new struct sss_nc_ctx **_ctx); There is also one new function in common/responder: * errno_t responder_get_neg_timeout_from_confdb(struct confdb_ctx *cdb, uint32_t *ncache_timeout); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Fix typos reported by lintianLukas Slebodnik2016-02-231-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: Pass account lockout status and display messagePavel Reichl2016-02-171-8/+23
| | | | | | | | | Tested against Windows Server 2012. Resolves: https://fedorahosted.org/sssd/ticket/2839 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Improve code to get connection credentialsSimo Sorce2016-01-281-13/+10
| | | | | | | | | | Adds support to get SELINUX context and make code more abstract so that struct ucred (if availale) can be used w/o redefining uid,gid,pid to int32. Also gives a layer of indirection that may come handy if we want to improve the code further in the future. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* p11: add gnome-screensaver to list of allowed servicesSumit Bose2016-01-201-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2925 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: allow to skip default options for child processesSumit Bose2016-01-191-1/+1
| | | | | | | | | | | | | Currently the SSSD default options like e.g. --debug-level are added unconditionally to the command line options of a child process when started with the child helper functions. If a binary from a different source should be started as a child by SSSD those options might not be known or used differently. This patch adds an option to exec_child_ex() which allows to skip the default options and only add specific options. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: enable ocsp checksSumit Bose2015-11-263-8/+28
| | | | | | | | | | | This patch enables the Online Certificate Status Protocol in NSS and adds an option to disable it if needed. To make further tuning of certificate verification more easy it is not an option on its own but an option to the new certificate_verification configuration option. Resolves https://fedorahosted.org/sssd/ticket/2812 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam-srv-tests: Add UT for cached 'online' auth.Pavel Reichl2015-11-122-1/+6
| | | | | | | | | Extend PAM responder unit test to check 'online' cached authentication. Resolves: https://fedorahosted.org/sssd/ticket/2697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-231-3/+3
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: remove unused parameter cdbPavel Reichl2015-10-201-6/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* REFACTOR: SCKT_RSP_UMASK constant in responder codePetr Cech2015-10-141-1/+1
| | | | | | | | | | This patch adds new SCKT_RSP_UMASK constant which stands for 0111. And it replaces all occurances in responder code. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* REFACTOR: DFL_RSP_UMASK constant in responder codePetr Cech2015-10-141-1/+2
| | | | | | | | | | There is DFL_RSP_UMASK constant for very secure umask in responder code. This patch replaces occurances of value 0177 with this constant. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: only allow missing user name for certificate authenticationSumit Bose2015-10-021-3/+9
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2811 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 00:06:36 +0000