1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
|
/*
SSSD
Library for rule based certificate to user mapping
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2017 Red Hat
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#ifndef _SSS_CERTMAP_H_
#define _SSS_CERTMAP_H_
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/types.h>
#include <talloc.h>
/**
* @defgroup sss_certmap Allow rule-based mapping of certificates to users
* Libsss_certmap provides a mechanism to map X509 certificate to users based
* on rules.
* @{
*/
/**
* Opaque type for the idmap context
*/
struct sss_certmap_ctx;
/**
* Lowest priority of a rule
*/
#define SSS_CERTMAP_MIN_PRIO UINT32_MAX
/**
* Typedef for external debug callback
*/
typedef void (sss_certmap_ext_debug)(void *pvt,
const char *file, long line,
const char *function,
const char *format, ...);
/**
* @brief Initialize certmap context
*
* @param[in] mem_ctx Talloc memory context, may be NULL
* @param[in] debug Callback to handle debug output, may be NULL
* @param[in] debug_priv Private data for debugging callback, may be NULL
* @param[out] ctx New certmap context
*
* @return
* - 0: success
* - ENOMEM: failed to allocate internal Talloc context
* - EINVAL: ctx is NULL
*/
int sss_certmap_init(TALLOC_CTX *mem_ctx,
sss_certmap_ext_debug *debug, void *debug_priv,
struct sss_certmap_ctx **ctx);
/**
* @brief Free certmap context
*
* @param[in] ctx certmap context previously initialized with
* @ref sss_certmap_init, may be NULL
*/
void sss_certmap_free_ctx(struct sss_certmap_ctx *ctx);
/**
* @brief Add a rule to the certmap context
*
* @param[in] ctx certmap context previously initialized with
* @ref sss_certmap_init
* @param[in] priority priority of the rule, 0 is the hightest priority, the
* lowest is SSS_CERTMAP_MIN_PRIO
* @param[in] match_rule String with the matching rule
* @param[in] map_rule String with the mapping rule
* @param[in] domains NULL-terminated string array with a list of domains
* the rule should be valid for, i.e. only this domains
* should be searched for matching users
*
* @return
* - 0: success
*/
int sss_certmap_add_rule(struct sss_certmap_ctx *ctx,
uint32_t priority, const char *match_rule,
const char *map_rule, const char **domains);
/**
* @brief Check if a certificate matches any of the applied rules
*
* @param[in] ctx certmap context previously initialized with
* @ref sss_certmap_init
* @param[in] der_cert binary blog with the DER encoded certificate
* @param[in] der_size size of the certificate blob
*
* @return
* - 0: certificate matches a rule
* - ENOENT: certificate does not match
* - EINVAL: internal error
*/
int sss_certmap_match_cert(struct sss_certmap_ctx *ctx,
const uint8_t *der_cert, size_t der_size);
/**
* @brief Get the LDAP filter string for a certificate
*
* @param[in] ctx certmap context previously initialized with
* @ref sss_certmap_init
* @param[in] der_cert binary blog with the DER encoded certificate
* @param[in] der_size size of the certificate blob
* @param[out] filter LDAP filter string, caller should free the data by
* calling sss_certmap_free_filter_and_domains
* @param[out] domains NULL-terminated array of strings with the domains the
* rule applies, caller should free the data by calling
* sss_certmap_free_filter_and_domains
*
* @return
* - 0: certificate matches a rule
* - ENOENT: certificate does not match
* - EINVAL: internal error
*/
int sss_certmap_get_search_filter(struct sss_certmap_ctx *ctx,
const uint8_t *der_cert, size_t der_size,
char **filter, char ***domains);
/**
* @brief Free data returned by @ref sss_certmap_get_search_filter
*
* @param[in] filter LDAP filter strings returned by
* sss_certmap_get_search_filter
* @param[in] domains string array of domains returned by
* sss_certmap_get_search_filter
*/
void sss_certmap_free_filter_and_domains(char *filter, char **domains);
/**
* @}
*/
#endif /* _SSS_CERTMAP_H_ */
|
