sssd.git/src/responder/pam, branch certificate_mapping

PAM: Make PAM responder socket-activatable

2017-01-23T17:46:37+00:00

As part of the effort of making all responder socket-activatable, let's
make PAM responder ready for this by providing its systemd's units.

In case the administrators want to use PAM responder taking advantage
of socket-activation they will need to enable sssd-pam.socket and after
a restart of the sssd service, the PAM socket will be ready waiting for
any activity in order to start the PAM responder. Also, the PAM
responder must be removed from the services line on sssd.conf.

The PAM responder service is binded to the SSSD service, which means
that the responder will be restarted in case SSSD is restarted and
shutdown in case SSSD is shutdown/crashes.

PAM responder, differently from the others, is a special case as it has
two sockets and its private sockets must be owned by root and must have
a specifc permission (0600). It's not new, though, and it's following
what has been already done in the project..

Related:
https://fedorahosted.org/sssd/ticket/2243

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

RESPONDER: Make responders' common code ready for socket activation

2017-01-23T17:46:37+00:00

Instead of simply setting the unix socket during the process
initialization, let's make it socket-activatable. It's the first step in
order to have socket-activated responders and doesn't introduce any kind
of regression with the current code.

Also, we must avoid setting the responders fds to -1 in all cases as it
may have cause the socket to be unreachable in case the administrator
decides to move back from socket-activation to using the services line
in sssd.conf. With this change, the responders will have to activelly
set their sockets fd to -1 before calling activate_unix_sockets(), which
is already done everyone but in Secrets and in one piece of PAM
responder.

Related:
https://fedorahosted.org/sssd/ticket/2243

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

UTIL: Introduce --socket-activated cmdline option for responders

2017-01-23T17:46:37+00:00

This option is going to be used for socket-activated responders as they
are special in some ways. So, by knowing this option we can:
- skip owning the debug files as it will be done by the responders' unit
files;
- skip "become_user()", as the process will already be started by the
proper user bu the responders' unit files;
- setup a timeout to shutdown the responder in case it has been
socket-activated and is idle.

This option has been encapsulated on is_socket_activated() function,
which will always return "false" when called on platforms where systemd
is not supported.

For any of the services are taking advantage of this newly introduced
option/function, but later on in this series it's going to be used.

In order to use it, just add SSSD_RESPONDER_OPTS to the poptOption
structure.

Related:
https://fedorahosted.org/sssd/ticket/2243

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

responders: remove checks that are handled inside cache_req

2016-12-19T22:26:22+00:00

Those checks were redundant, since they are already part of cache_req.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník

cache_req: encapsulate output data into structure

2016-12-19T22:22:54+00:00

In enumeration calls we want to get objects from all domains, not
only from the first matched domain. We move the cache search result
into a structure that contains combination of domain and ldb_result.

This is preparation for enumeration support inside cache_req.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník

MONITOR: Remove unused shutDown sbus method

2016-11-09T12:32:32+00:00

The shutDown method has not been used or set for a long time. Trim the
internal interface by removing all references to this internal method.

Reviewed-by: Lukáš Slebodník

MONITOR: Remove deprecated pong sbus method

2016-11-09T12:32:27+00:00

The pong method is deprecated since we started using the watchdog. Since
this is dead code, it makes sense to just remove it.

Reviewed-by: Lukáš Slebodník

PAM: add pam_response_filter option

2016-11-02T10:30:20+00:00

Currently the main use-case for this new option is to not set the
KRB5CCNAME environment varible for services like 'sudo-i'.

Resolves https://fedorahosted.org/sssd/ticket/2296

Reviewed-by: Jakub Hrozek

PAM: add a test for filter_responses()

2016-11-02T10:30:15+00:00

Reviewed-by: Jakub Hrozek

cache_req: switch to new code

2016-10-20T07:56:38+00:00

This patch switch the old switch-based cache req code to
the new plugin-based.

Reviewed-by: Jakub Hrozek