summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
* SECRETS: remove unused variableLukas Slebodnik2017-04-211-5/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Use sized_domain_name to format the groups the user is a member ofJakub Hrozek2017-04-211-14/+15
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3268 Uses the common function sized_domain_name() to format a group the user is a member of to the appropriate format. To see the code is working correctly, run: dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:trusted_user Where trusted_user is a user from a trusted domain that is a member of groups from the joined domain and a trusted domain as well. The groups from the joined domain should not be qualified, the groups from the trusted domain should be qualified. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Move sized_output_name() and sized_domain_name() into responder common codeJakub Hrozek2017-04-215-99/+112
| | | | | | | | | | | | | | | | | | | | | These functions are used to format a name into a format that the user configured for output, including case sensitiveness, replacing whitespace and qualified format. They were used only in the NSS responder, which typically returns strings to the NSS client library and then the user. But it makes sense to just reuse the same code in the IFP responder as well, since it does essentially the same job. The patch also renames sized_member_name to sized_domain_name. Previously, the function was only used to format a group member, the IFP responder would use the same function to format a group the user is a member of. Related to: https://pagure.io/SSSD/sssd/issue/3268 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* responders: do not leak selinux context on clients destructionPavel Březina2017-04-031-1/+19
| | | | | | | | | | The SELinux context created in get_client_cred is not talloc bound and we were leaking it if available with each client's destruction. Resolves: https://pagure.io/SSSD/sssd/issue/3360 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* secrets: always add Content-Length headerPavel Březina2017-03-301-4/+68
| | | | | | | | | If custodia server does not reply with Content-Length header, curl may wait for non-existing body of http reply if such body does not exist (for example during POST operation when creating a container). Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: fix debug messagePavel Březina2017-03-301-1/+2
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: support HTTP basic authentication with proxy providerPavel Březina2017-03-301-0/+9
| | | | | | | | Even though configuration options auth_type = basic, username and password are read they were not used anywhere prior this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: allow to configure certificate checkPavel Březina2017-03-301-0/+55
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: remove http-parser code in proxy providerPavel Březina2017-03-301-581/+0
| | | | | | | | | | We switche to libcurl in previous patch. This just removes the unused code. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: use tcurl in proxy providerPavel Březina2017-03-303-84/+189
| | | | | | | | | | | | We switch from http-parser to libcurl for an http client. This gaves us many features for free such as tls and http basic authentication support instead of implementing it on our own. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Fix off-by-one error in secrets key parsingJakub Hrozek2017-03-301-17/+26
| | | | | | | | | | | | | | | When parsing the secrets key, the code tried to protect against malformed keys or keys that are too short, but it did an error - the UUID stringified form is 36 bytes long, so the UUID_STR_SIZE is 37 because UUID_STR_SIZE accounts for the null terminator. But the code, that was trying to assert that there are two characters after the UUID string (separator and at least a single character for the name) didn't take the NULL terminator (which strlen() doesn't return) into account and ended up rejecting all ccaches whose name is only a single character. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-303-2/+62
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Remove unneeded memory contextJakub Hrozek2017-03-301-4/+4
| | | | | | | | | Since we only store data into pam_ctx in get_public_domains(), it doesn't make sense to allow passing a separate memory context. It is always going to be pam_ctx, otherwise the memory hierarchy will cause issues anyway. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: ListByName: Don't crash when no results are foundJakub Hrozek2017-03-301-7/+9
| | | | | | | | | | | If no results were found using the List command, the results variable was undefined which resulted in a crash. Instead, only copy the results of the cache_req lookup returns EOK and we can presume that the results are valid. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* IFP: Search both POSIX and non-POSIX domainsJakub Hrozek2017-03-303-105/+194
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Changes the behaviour of the InfoPipe responder so that both application and POSIX domains are searched. In general, the IFP responder uses the CACHE_REQ_ANY_DOM lookup type because we can't presume the intention of the caller. Therefore, deployments that combine both POSIX and non-POSIX domains must use fully qualified names or select the right domain order manually. There is one change between the POSIX and non-POSIX users or groups - the object path. For the POSIX users, the object path includes the UID or GID. Because we don't have that for the non-POSIX objects, the object name is used in the path instead. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Domain type selection in cache_reqJakub Hrozek2017-03-3028-36/+195
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new enumeration cache_req_dom_type. It is a tri-state that allows the caller to select which domains can be contacted - either only POSIX, only application domains or any type. Not all plugins of cache_req have the new parameter added -- only those that are usable/useful in a non-POSIX environment. For example, it makes no sense to allow the selection for calls by ID because those are inherently POSIX-specific. Also, services or netgroups are supported only coming from POSIX domains. At the moment, the patch should not change any behaviour as all calls default to contacting POSIX domains only. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ssh: add support for certificates from non-default viewsSumit Bose2017-03-291-1/+19
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ssh: handle binary keys correctlySumit Bose2017-03-291-1/+7
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3332 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add domain_resolution_order config optionFabiano Fidêncio2017-03-292-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | This is the local equivalent of option of ipaDomainResolutionOrder and has precedence over the ones set on IPA side making the precedence order to be like: Local > View > Globally. As done for the IPA side configurations, the domains which were not explicitly set up will be apennded to the final of the domain_resolution_order list in the very same order they're presented in the "domains" option of [sssd] section in the config file. There's no guarantee of order for the subdomains though. It's also important to mention that no expansion magic is performed on our side. It means that if 'example.com' is set it does *not* stand for all its subdomains DNS wise (like 'foo.example.com', 'bar.example.com', etc). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Make use of domainResolutionOrderFabiano Fidêncio2017-03-296-37/+436
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | domainResolutionOrder has been introduced in the previous commits and allows the admin to set up a specific order which the domains will be resolved during a lookup and with this patch we can take advantage of this. In order to have it working a new structure has been added (struct domain_resolution_order) to the responder context and will be used by the cache_req to perform the lookups based on this list. As the ipaDomainResolutionOrder may be set globally on IPA or per View, SSSD does respect the following precedence order: View > Globally. The way the list is built is quite simple, basically having the domains present on ipaDomainResolutionOrder as the first domains (in that specific order) and then appending the remaining domains to this list. The final result is a completely flat list with all the domains respecting the specified order (it's important to remember that the domains not specified won't follow any specific order, they're just "random" based on the domains list present in the responder context. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Descend into subdomains on lookupsFabiano Fidêncio2017-03-2910-10/+10
| | | | | | | | | | | | | | | | | | | | | Let's make all plugins, but the "host_by_name", to descend into the subdomains on lookups. This patch basically prepares the field for the coming up patches that will allow group/user resolution in all domains (or a subset of the domains) to be possible by only using the short names without the domain component. The "host_by_name" plugin was not changed as it's a specific IPA plugin and won't find anything on its subdomains. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-291-4/+5
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KCM: Idle-terminate the responder if the secrets back end is usedJakub Hrozek2017-03-271-0/+9
| | | | | | | | | Existing with memory database would be fatal as we keep the ccaches in memory then, but if the ccaches are stored in sssd-secrets, we can just exit on idle. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Queue requests by the same UIDJakub Hrozek2017-03-276-5/+331
| | | | | | | | | In order to avoid race conditions, we queue requests towards the KCM responder coming from the same client UID. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Make the secrets ccache back end configurable, make secrets the defaultJakub Hrozek2017-03-275-11/+54
| | | | | | | | | Adds a new option 'ccache_storage' that allows to select either the memory back end or the secrets back end. The secrets back end is the default one and this option is even undocumented. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Store ccaches in secretsJakub Hrozek2017-03-273-0/+3139
| | | | | | | | Adds a new KCM responder ccache back end that forwards all requests to sssd-secrets. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Store ccaches in secrets for the KCM responderJakub Hrozek2017-03-273-11/+86
| | | | | | | | | Adds a new "hive" to the secrets responder whose base path is /kcm. Only root can contact the /kcm hive, because the KCM responder only runs as root and it must impersonate other users and store ccaches on their behalf. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Return a nicer error message on request with no PUT dataJakub Hrozek2017-03-271-0/+6
| | | | | | | | | | I managed to create this pathological situation with the tcurl tool which didn't send any PUT data. The error in sssd-secrets was quite strange (ENOMEM). This patch just adds a safeguard sooner so that we return a graceful error. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SECRETS: Create DB path before the operation itselfJakub Hrozek2017-03-271-85/+83
| | | | | | | | | | | | This is a refactoring where instead of creating the ldb path in the operation itself, we create the ldb path when creating the local db request and pass the path to the operation. This would allow us to store different kind of objects in the secrets storage later. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Implement KCM server operationsJakub Hrozek2017-03-273-9/+2141
| | | | | | | | | | | | | | | Implements the actual KCM server operations. On a high level, each operation unmarhalls the needed data from the input buffer, calls into the ccache db and marshalls a response. Only the operations that are also implemented by the MIT client are implemented by our KCM server. Resolves: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Add a in-memory credential storageJakub Hrozek2017-03-273-4/+816
| | | | | | | | Implements a simple back end for the ccache module that lets the KCM server store credentials directly in memory. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Implement an internal ccache storage and retrieval APIJakub Hrozek2017-03-275-0/+1996
| | | | | | | | | | | | In order for the KCM server to work with ccaches stored in different locations, implement a middle-man between the KCM server and the ccache storage. This module has asynchronous API because we can't assume anything about where the ccaches are stored. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: request parsing and sending a replyJakub Hrozek2017-03-272-13/+473
| | | | | | | | | | | | | | | Implements parsing the KCM client request into per-client buffers and sending a response for both the failure case and for success. The protocol is documented at: http://k5wiki.kerberos.org/wiki/Projects/KCM_client Several places don't use the sss_iobuf structure, because they don't parse variable-length data from the buffer and it's much more efficient to just allocate the needed request and reply structure on the stack. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Initial responder build and packagingJakub Hrozek2017-03-274-0/+474
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the initial build of the Kerberos Cache Manager responder (KCM). This is a deamon that is capable of holding and storing Kerberos ccaches. When KCM is used, the kerberos libraries (invoked through e.g. kinit) are referred to as a 'client' and the KCM deamon is referred to as 'server'. At the moment, only the Heimdal implementation of Kerberos implements the KCM server: https://www.h5l.org/manual/HEAD/info/heimdal/Credential-cache-server-_002d-KCM.html This patch adds a KCM server to SSSD. In MIT, only the 'client-side' support was added: http://k5wiki.kerberos.org/wiki/Projects/KCM_client This page also describes the protocol between the client and the server. The client is capable of talking to the server over either UNIX sockets (Linux, most Unixes) or Mach RPC (macOS). Our server only implements the UNIX sockets way and should be socket-activated by systemd, although can in theory be also ran explicitly. The KCM server only builds if the configuration option "--with-kcm" is enabled. It is packaged in a new subpackage sssd-kcm in order to allow distributions to enable the KCM credential caches by installing this subpackage only, without the rest of the SSSD. The sssd-kcm subpackage also includes a krb5.conf.d snippet that allows the admin to just uncomment the KCM defaults and instructs them to start the socket. The server can be configured in sssd.conf in the "[kcm]" section. By default, the server only listens on the same socket path the Heimdal server uses, which is "/var/run/.heim_org.h5l.kcm-socket". This is, however, configurable. The file src/responder/kcm/kcm.h is more or less directly imported from the MIT Kerberos tree, with an additional sentinel code and some comments. Not all KCM operations are implemented, only those that also the MIT client implements. That said, this KCM server should also be usable with a Heimdal client, although no special testing was with this hybrid. The patch also adds several error codes that will be used in later patches. Related to: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* nss: allow larger buffer for certificate based requestsSumit Bose2017-03-232-1/+21
| | | | | | | | | To make sure larger certificates can be processed as well the maximal buffer size is increased for requests by certificate. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss-idmap: add sss_nss_getlistbycert()Sumit Bose2017-03-233-0/+76
| | | | | | | | | This patch adds a getlistbycert() call to libsss_nss_idmap to make it on par with InfoPipe. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: shortcut if object is foundPavel Březina2017-03-141-0/+12
| | | | | | | | | | | If we get a cache-hit but the object is expired or needs a midpoint refresh we assume that this domain is the one the result should come from and go to data provider directly. Related: https://pagure.io/SSSD/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Check the caches firstFabiano Fidêncio2017-03-145-35/+145
| | | | | | | | | | | | | | | | | | | This patch introduces a new configurable option to define whether the responder should query all domains' caches before querying the Data Providers. This new option is called cache_first and, by default, it's disabled, meaning that, for each provider, the responder may contact the cache and the data provider in the same iteration. Co-Author: Pavel Březina <pbrezina@redhat.com> Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move cache_req_next_domain() into a new tevent requestFabiano Fidêncio2017-03-141-148/+279
| | | | | | | | | | | | | This change prepares for the upcoming patch, which will have to support more than one iteration over all domains, leaving us with a better control of the whole logic around this iteration. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move result manipulation into a separate modulePavel Březina2017-03-143-219/+254
| | | | | | | | | | | | | | This patch is preparing the field for coming up patches where new lookup logic will be added. Taking this into consideration let's move the result manipulation code into a separate module and focus purely in the lookups logic in the main module. Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Make cache_req_{create_and_,}add_result() more genericPavel Březina2017-03-141-19/+34
| | | | | | | | | | | | This patch is preparing the field for coming up patches where this function will be re-used. In order to do so, let's remove the dependency for tevent states on both cache_req_create_and_add_result() and cache_req_add_result(). Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique matchSumit Bose2017-03-103-1/+22
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: allow muliple users mapped to a certificateSumit Bose2017-03-102-59/+76
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add FindByNameAndCertificateSumit Bose2017-03-106-0/+360
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add ListByCertificateSumit Bose2017-03-106-0/+165
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: allow multiple matches for searches by certificateSumit Bose2017-03-101-2/+2
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Fix invalidating memory cache for subdomain usersJakub Hrozek2017-03-101-1/+3
| | | | | | | | get_next_domain() was called without any special flags, meaning it only iterates over main domains. We need to instead use the SSS_GND_DESCEND flag to make sure sudomains are taken into account, too. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SECRETS: Shutdown the responder in case it becomes idleFabiano Fidêncio2017-03-081-0/+5
| | | | | | | | | | | | | Similarly to what has been done for the other responders, let's shutdown the secrets responder in case it becomes idle. Resolves: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Wrap up the code to setup the idle timeoutFabiano Fidêncio2017-03-082-35/+54
| | | | | | | | | | | | | As secrets responder will make use of this very same code in the future, let's wrap it up into a new function in order to avoid code duplication. Related: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: use rctx as memory context during midpoint refreshPavel Březina2017-03-081-1/+1
| | | | | | | | Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 13:52:04 +0000