summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* sysdb: add certmap related callsSumit Bose2017-03-233-0/+712
| | | | | | | | | | Add sysdb calls to write and read data for the certificate mapping library to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-237-18/+75
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: always store the certificate from the requestSumit Bose2017-03-236-9/+27
| | | | | | | | | | Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_get_users_send(): new argument mapped_attrsSumit Bose2017-03-239-7/+111
| | | | | | | | | | | | | | | | mapped_attrs can be a list of sysdb_attrs which are not available on the server side but should be store with the cached user entry. This is needed e.g. when the input to look up the user in LDAP is not an attribute which is stored in LDAP but some data where LDAP attributes are extracted from. The current use case is the certificate mapping library which can create LDAP search filters based on content of the certificate. To allow upcoming cache lookup to use the input directly it is stored in the user object in the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_attrs_copy()Sumit Bose2017-03-233-0/+112
| | | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* certmap: add placeholder for OpenSSL implementationSumit Bose2017-03-232-3/+37
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* certmap: add new library libsss_certmapSumit Bose2017-03-2315-1/+5454
| | | | | | | | | | | | | | | | With this library it would be possible to map certificates and users not only by adding the full certificate to the user's LDAP object but by adding e.g. only parts like the issuer and subject name. Additionally the library is also able to flexible select/match certificates based on values in the certificate. Details about mapping and matching rules can be found in the included man page. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* util: move string_in_list to util_extSumit Bose2017-03-232-20/+22
| | | | | | | | | | To be able to include string_in_list() without additional dependencies it is moved into a separate file. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* split_on_separator: move to a separate fileSumit Bose2017-03-232-93/+121
| | | | | | | | | | To be able to include split_on_separator() without additional dependencies (only talloc), it is moved into a separate file. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Mention sssd-secrets in "SEE ALSO" sectionLukas Slebodnik2017-03-221-0/+6
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3344 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Typo in commentMichal Židek2017-03-171-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Updating the translations for the 1.15.2 releasesssd-1_15_2Jakub Hrozek2017-03-1517-8724/+10611
|
* MAN: Add trusted domain section man entryMichal Židek2017-03-151-0/+22
| | | | | | | | | | Add note about trusted domain section in the sssd.conf man page. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUBDOMAINS: Allow options ad(_backup)_serverMichal Židek2017-03-152-2/+12
| | | | | | | | | | | Allow following options in the subdomain section: ad_server ad_backup_server Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUBDOMAINS: Configurable search basesMichal Židek2017-03-155-148/+250
| | | | | | | | | | | Added new trusted domain section in the sssd.conf were the search bases for the trusted domain can be specified. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* data_provider: Fix typo in DEBUG messageMichal Židek2017-03-151-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Don't call chown on NSS service's ExecStartPreFabiano Fidêncio2017-03-151-1/+0
| | | | | | | | | | | | | | | | The sssd-nss.service attempts to chown its log file to ensure it has the correct owner. Unfortunately, when this happens, it enters in a loop trying to call into the name-service switch and hangs forever. For now the approach taken is to just remove the ExecStartPre from the NSS service. Resolves: https://pagure.io/SSSD/sssd/issue/3322 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Ensure the NSS socket is started before any other services' socketsFabiano Fidêncio2017-03-151-0/+1
| | | | | | | | | | | | | | Although I didn't have any problem with this before I'd like to ensure that the NSS socket is always up _before_ any other (SSSD) services' sockets as they may trigger initgroups calls as some of them have SocketUser and SocketGroup set to the "sssd" user. Related: https://pagure.io/SSSD/sssd/issue/3322 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Don't set SocketUser/SocketGroup as "sssd" in sssd-nss.socketFabiano Fidêncio2017-03-151-2/+0
| | | | | | | | | | | | | | | | | | | | NSS service is always run as root, so there's no need to change its socket ownership to the sssd user. More than that, by setting up the SocketUser and SocketGroup to "sssd" a loop would be caused as the "sssd" would trigger an initgroups call during the NSS socket setup. The problem was found when starting up a machine with SSSD built with "--with-sssd-user=sssd" and having "sss" before "files" in the name-service switch. Related: https://pagure.io/SSSD/sssd/issue/3322 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove duplicit users from groupPetr Čech2017-03-151-4/+149
| | | | | | | | | | It is possible to have duplicit members in local files (/etc/group). This patch removes duplicity in groups in proxy provider. Resolves: https://pagure.io/SSSD/sssd/issue/3314 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: test the curl wrapper with a command-line toolJakub Hrozek2017-03-144-1/+374
| | | | | | | | | In order to test the curl integration code, this patch adds a command-line tool and tests that it's possible to drive a conversation with the secrets responder using the tool. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a libtevent libcurl wrapperJakub Hrozek2017-03-142-0/+1044
| | | | | | | | | Adds a request that enables the caller to issue an asynchronous request with libcurl. Currently only requests towards UNIX sockets are supported. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Detect libcurl during configureJakub Hrozek2017-03-141-0/+38
| | | | | | | Currently libcurl is optional and if not present, just silently skipped. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a generic iobuf moduleJakub Hrozek2017-03-143-0/+518
| | | | | | | | | | | | | | | | | The KCM responder reads bytes and writes bytes from a buffer of bytes. Instead of letting the caller deal with low-level handling using the SAFEALIGN macros, this patch adds a new iobuf.c module with more high-level functions. The core is a iobuf struct that keeps track of the buffer, its total capacity and a current read or write position. There are helper function to read or write a generic buffer with a set length. Later, we will also add convenience functions to read C data types using the SAFEALIGN macros. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a new macro SAFEALIGN_MEMCPY_CHECKJakub Hrozek2017-03-141-0/+6
| | | | | | | We will use it later in the KCM server Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CACHE_REQ: shortcut if object is foundPavel Březina2017-03-141-0/+12
| | | | | | | | | | | If we get a cache-hit but the object is expired or needs a midpoint refresh we assume that this domain is the one the result should come from and go to data provider directly. Related: https://pagure.io/SSSD/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Check the caches firstFabiano Fidêncio2017-03-1411-35/+168
| | | | | | | | | | | | | | | | | | | This patch introduces a new configurable option to define whether the responder should query all domains' caches before querying the Data Providers. This new option is called cache_first and, by default, it's disabled, meaning that, for each provider, the responder may contact the cache and the data provider in the same iteration. Co-Author: Pavel Březina <pbrezina@redhat.com> Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move cache_req_next_domain() into a new tevent requestFabiano Fidêncio2017-03-141-148/+279
| | | | | | | | | | | | | This change prepares for the upcoming patch, which will have to support more than one iteration over all domains, leaving us with a better control of the whole logic around this iteration. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Move result manipulation into a separate modulePavel Březina2017-03-144-219/+255
| | | | | | | | | | | | | | This patch is preparing the field for coming up patches where new lookup logic will be added. Taking this into consideration let's move the result manipulation code into a separate module and focus purely in the lookups logic in the main module. Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Make cache_req_{create_and_,}add_result() more genericPavel Březina2017-03-141-19/+34
| | | | | | | | | | | | This patch is preparing the field for coming up patches where this function will be re-used. In order to do so, let's remove the dependency for tevent states on both cache_req_create_and_add_result() and cache_req_add_result(). Related: https://pagure.io/sssd/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IPA: get overrides for all users found by certificateSumit Bose2017-03-101-28/+132
| | | | | | | | | Lookups by certificates can return more than one result. With this patch the IPA provider will check for overrides for all returned users. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique matchSumit Bose2017-03-103-1/+22
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: allow muliple users mapped to a certificateSumit Bose2017-03-104-59/+166
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add FindByNameAndCertificateSumit Bose2017-03-106-0/+360
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add ListByCertificateSumit Bose2017-03-106-0/+165
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: allow multiple matches for searches by certificateSumit Bose2017-03-101-2/+2
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: allow multiple results for searches by certificateSumit Bose2017-03-102-7/+43
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util-test: Extend unit test for sss_filter_sanitize_exLukas Slebodnik2017-03-101-0/+18
| | | | | | | Related-to: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_utils: Add test coverage for %l in override_homedirLukas Slebodnik2017-03-101-2/+9
| | | | | | | Related-to: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Fix invalidating memory cache for subdomain usersJakub Hrozek2017-03-101-1/+3
| | | | | | | | get_next_domain() was called without any special flags, meaning it only iterates over main domains. We need to instead use the SSS_GND_DESCEND flag to make sure sudomains are taken into account, too. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Allow manual start for sssd-ifpJakub Hrozek2017-03-081-1/+0
| | | | | | | This change is needed so that the InfoPipe responder can be socket activated. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Fixed typo in debug outputThorsten Scherf2017-03-081-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_cache: User/groups invalidation in domain cachePetr Čech2017-03-085-8/+173
| | | | | | | | | | | | | | | | | | When a group/users are invalidated from sss_cache, the group/user information in domain and timestamps cache are inconsistent with regard to dataExpireTimestamp attribute. This patch fixes the problem by explicitly invalidating the domain cache's entry when the timestamp cache entry is invalidated by sss_cache call. There is one new function: * sysdb_invalidate_cache_entry() provided for this purpose and used only in sss_cache utility. Resolves: https://fedorahosted.org/sssd/ticket/3164 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Shutdown the responder in case it becomes idleFabiano Fidêncio2017-03-082-0/+6
| | | | | | | | | | | | | Similarly to what has been done for the other responders, let's shutdown the secrets responder in case it becomes idle. Resolves: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Wrap up the code to setup the idle timeoutFabiano Fidêncio2017-03-082-35/+54
| | | | | | | | | | | | | As secrets responder will make use of this very same code in the future, let's wrap it up into a new function in order to avoid code duplication. Related: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: use rctx as memory context during midpoint refreshPavel Březina2017-03-081-1/+1
| | | | | | | | Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: first letter of user name template for override_homedirIgnacio Reguero2017-03-072-0/+21
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_secrets: Fail in child if sssd_secrets cannot startLukas Slebodnik2017-03-071-12/+19
| | | | | | | | | | | | | | | If there is a problem to execute sssd_secrets then exception is raised. Test will not continue in parent process because it is waiting for socket for a second. The child process will continue in execution of tests because parent process will kill child in teardown after test execution. This patch makes starting of secret service more robust and immediately fail child process when there was a problem to start sssd_secrets. It also adds few assertions for ensuring that setup passed as it should. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Add dyndns_auth optionJustin Stephenson2017-03-072-0/+30
| | | | | | | Add the dyndns_auth option into the AD or IPA provider man pages for more configuration information of nsupdate behavior. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Sanitize newline and carriage return characters.Victor Tapia2017-03-071-0/+10
| | | | | | | | | | Introducing valid usernames with a trailing newline character triggers the removal of valid LDB cache entries. Resolves: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 02:36:01 +0000