summaryrefslogtreecommitdiffstats
path: root/src/db/sysdb_ops.c
Commit message (Collapse)AuthorAgeFilesLines
* SYSDB: convert sysdb_group_membership_mod to operate on qualified namesMichal Zidek2016-07-071-2/+22
| | | | | | | This patch infers the member domain from the FQDN to allow the function to add group members from different domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use ldb_result as output in sysdb_search_ts_{users,groups}Lukas Slebodnik2016-07-061-8/+38
| | | | | | | | | | | | | Passing address of unsigned to the output argument size_t causes access out of boundaries for type unsigned and and wrong data on big endian. It looks like functions sysdb_search_ts_{users,groups} need to store results in structure ldb_result anyway for further processing. Therefore it will be better to convert output arguments size_t* + ldb_message*** into structure ldb_result and avoid using additional helper variable with type size_t before each invocation of these functions. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Only update user attributes if neededJakub Hrozek2016-06-231-0/+35
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2602 Uses the same logic as previously used for updating group entries to only update user attributes if the group entry actually changed. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Refactor sysdb_store_userJakub Hrozek2016-06-231-64/+136
| | | | | | | Splits sysdb_store_user internals to two functions because the original function either creates a new user or updates an existing one. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Check if group attributes differ before saving a groupJakub Hrozek2016-06-231-7/+13
| | | | | | | | | | | Adds a new function sysdb_entry_attrs_diff() used in group saving code. This function is used to check if the result of updating a group would result in actually changing the sysdb entry -- often, we would try to dump the same data to the cache during update. If that's the case, the update code now only updates the timestamp cache, avoiding costly writes. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: If modifyTimestamp is the same, only update the TS cacheJakub Hrozek2016-06-231-36/+519
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2602 If the entry being saved contains the original modifyTimestamp attribute and the modifyTimestamp attribute is the same as the one we already saved to the timestamp cache, only the expire timestamps in the asynchronous timestamp cache will be bumped and the sysdb code will avoid writes to the main cache completely. If the modifyTimestamp is either missing or differs, we assume the entry had changed and do a full write to the main cache. Also amends the generic sysdb_set_attrs* and similar functions that their results is also reflected in the timestamps cache. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search the timestamp caches in addition to the sysdb cacheJakub Hrozek2016-06-231-27/+162
| | | | | | | | | | | | | | | When a sysdb entry is searched, the sysdb cache is consulted first for users or groups. If an entry is found in the sysdb cache, the attributes from the timestamp cache are merged to return the full and up-to-date set of attributes. The merging is done with a single BASE search which is a direct lookup into the underlying key-value database, so it should be relatively fast. More complex merging is done only for enumeration by filter which is currently done only via the IFP back end and should be quite infrequent, so I hope we can justify a more complex merging there. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Wrap sysdb_store_group in a transaction and split it into smaller ↵Jakub Hrozek2016-06-231-42/+107
| | | | | | | | | | | | | | functions sysdb_store_group can do several things -- add, rename or update a group. It's important they are all done in a single transaction (even though the caller should typically start a transaction of his own). Also split the sysdb_store_group function into two, one that only stores a new group and one that changes attributes of an existing group to keep the flow easy and avoid two labels in a single function. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_ulong()Fabiano Fidêncio2016-05-311-11/+7
| | | | | | | | | | | | | | | | | | | | | | As the add_ulong() convenience can add, replace or remove a unsigned long according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_ulong(), sysdb_replace_ulong() and sysdb_delete_ulong(). These new functions are basically wrappers of add_ulong() (now sysdb_ldb_msg_ulong_helper()), calling it using the proper flag according to each function. Any code previously using add_ulong() is now adapted to use these brand new functions. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_ulong() convenience to sysdb.cFabiano Fidêncio2016-05-311-13/+0
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_ulong() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_string()Fabiano Fidêncio2016-05-311-16/+14
| | | | | | | | | | | | | | | | | | | | | | As the add_string() convenience can add, replace or delete a string according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_string(), sysdb_replace_string() and sysdb_delete_string(). These new functions are basically wrappers of add_string() (now sysdb_ldb_msg_string_helper()), calling it using the proper flag according to each function. Any code previously using add_string() is now adapted to use these brand new functions. Resolves: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_string() convenience to sysdb.cFabiano Fidêncio2016-05-311-13/+0
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_string() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-011-0/+45
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
* nss: fix UPN lookups for sub-domain usersSumit Bose2015-10-081-1/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* fix ldb_search usageSumit Bose2015-10-081-8/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: add support for UPNPavel Březina2015-10-081-18/+53
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add function to expire entryMichal Židek2015-09-031-0/+72
| | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 Added function to expire entry in sysdb using its DN. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Minor code improvementsPavel Reichl2015-07-061-1/+0
| | | | | | | | pam_helpers.h had to be included after util.h. Removed exara empty line. Fixed code alignment Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add sysdb_search_user_by_cert() and sysdb_search_object_by_cert()Sumit Bose2015-06-191-0/+35
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Do not print verbose DEBUG messages from providers that don't set UUIDJakub Hrozek2015-06-041-1/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2666 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* 2FA offline authSumit Bose2015-05-081-2/+75
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_cache_password_ex()Sumit Bose2015-05-081-3/+22
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: Add cache_expire to the default sysdb_search_object_by_str_attr setJakub Hrozek2015-04-241-1/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap: properly handle binary objectGuid attributeSumit Bose2015-03-201-0/+52
| | | | | | | | | | | | | | Although in the initial processing SSSD treats the binary value right at some point it mainly assumes that it is a string. Depending on the value this might end up with the correct binary value stored in the cache but in most cases there will be only a broken entry in the cache. This patch converts the binary value into a string representation which is described in [MS-DTYP] and stores the result in the cache. Resolves https://fedorahosted.org/sssd/ticket/2588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Log reason in debug message why ldb_modify failedLukas Slebodnik2015-03-111-1/+27
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: use sysdb_user/group_dnPavel Březina2015-03-091-10/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Add UUID when saving incomplete groupsJakub Hrozek2015-01-301-0/+6
| | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2571 Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: remove ghosts in all sub-domains as wellSumit Bose2015-01-231-2/+3
| | | | | | | | | | | | | If a user is a member is a group in a different sub-domain, e.g with universal groups in AD, the ghost attribute might not be properly removed from the group object if the user is resolved. The reason is that only groups from the domain of the user were search for ghost attributes. This patch increases the search-base to all sub-domains of the configured SSSD domain. Resolves https://fedorahosted.org/sssd/ticket/2567 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: sysdb_search_object_by_sid returns ENOENTPavel Reichl2014-12-171-59/+9
| | | | | | | | | | | | sysdb_search_object_by_sid returns ENOENT if no results are found. Part od solution for: https://fedorahosted.org/sssd/ticket/1991 Fixes: https://fedorahosted.org/sssd/ticket/2520 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: retain external membersPavel Reichl2014-12-131-0/+83
| | | | | | | | | | | | When processing group membership check sysdb for group members from extern domain and include them in newly processed group membership as extern members are curently found only when initgroups() is called. Resolves: https://fedorahosted.org/sssd/ticket/2492 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: add sysdb_search_object_by_uuid()Sumit Bose2014-11-201-0/+77
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sid2name: return name without views appliedSumit Bose2014-10-201-0/+1
| | | | | | | Make sure that the original name of an object without any overrides applied is returned by sid2name requests. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sysdb: sysdb_search_group_by_name should work like sysdb_search_user_by_nameSumit Bose2014-09-171-43/+42
| | | | | | | | | | | | Currently sysdb_search_group_by_name uses an optimization which might fail in case-insensitive environments. The DN of the group object is generated with the help of the given name. Since the DN is case-sensitive a group lookup will fail if different cases are used. sysdb_search_user_by_name already handles case-insensitive searches well and sysdb_search_group_by_name should use the same scheme. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Write additional attrs in sysdb_add_userDaniel Gollub2014-09-171-1/+2
| | | | | | | | In the uid=0 case (to obtain new free id) only uidNumber and gidNumber attributes got written, but not the additonal provided attributes like alias or others. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: SSS_LDB_SEARCH - macro around ldb_searchPavel Reichl2014-09-051-51/+0
| | | | | | | | | | | | | This patch amends previous patch 5153e8b9793dea1e212ca08af0f77ea1d023cbb7. Macro SSS_LDB_SEARCH is used instead of using fuction sss_ldb_search as a wrapper around ldb_search which could lead to premature expansion of variadic parameters. Part of solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Clarify sss_ldb_modify_permissive returns ldb error codeJakub Hrozek2014-08-191-0/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: augmented logging when adding new groupPavel Reichl2014-07-151-14/+79
| | | | | | | | | | | This patch adds some more log messages to functionality of storing groups into sysdb. As these functions are low level and failures are often handled on higher levels the commonly chosen level is SSSDBG_TRACE_LIBS. Resolves: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: sss_ldb_search - wrapper around ldb_searchPavel Reichl2014-06-251-0/+51
| | | | | | | | | | | Make sure that if no results were found ENOENT is returned rather than just empty list of results. Resolves: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Modify declaration of sysdb_search_entryLukas Slebodnik2014-06-231-1/+1
| | | | | | | | | | Type of parameter scope was changed s/int/enum ldb_scope/ This patch fixes warning from static analysers: src/db/sysdb_ops.c:228: mixed_enum_type: enumerated type mixed with another type Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sysdb: add sysdb_search_user_by_upn() with testsSumit Bose2014-06-201-0/+60
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: sysdb_search_custom fix memory leakPavel Reichl2014-06-201-5/+17
| | | | | | Add temporally talloc context to allocate basedn on. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SYSDB: sysdb_search_entry fix memory leakPavel Reichl2014-06-201-9/+20
| | | | | | | Allocate res on tmp_ctx instead of on mem_ctx. Also use '_' prefix convention for output parameters. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SDAP: augmented logging for group savingPavel Reichl2014-04-141-0/+3
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-76/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-153/+153
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use lower-case name for case-insensitive searchesSumit Bose2013-12-191-3/+5
| | | | | | | | | | | | The patch makes sure that a completely lower-cased version of a fully qualified name is used for case insensitive searches. Currently there are code paths where the domain name was used as configured and was not lower-cased. To make sure this patch does not break with old entries in the cache or case sensitive domains a third template was added to the related filters templates which is either filled with a completely lower-cased version or with the old version. The other two template values are unchanged.
* SYSDB: missing conversion of LDB error to errnoPavel Reichl2013-12-181-0/+1
|
* SYSDB: typos & debug macro constantsPavel Reichl2013-12-181-2/+3
|
* SYSDB: Sanitize filter before removing ghost attrsLukas Slebodnik2013-11-281-1/+8
| | | | | | | | | | | sysdb_add_user fails with EIO if enumeration is disabled and user contains backslashes. We try to remove ghost attributes from groups with disabled enumeration, but unsanitized filter is used to find ghost attributes "(|(ghost=usr\\\\002)" and ldb cannot parse this filter. Resolves: https://fedorahosted.org/sssd/ticket/2163
* SYSDB: Sanitize filter before sysdb_search_groupsLukas Slebodnik2013-11-281-1/+8
| | | | | | | | | | sysdb_delete_user fails with EIO if user does not exist and contains backslashes. ldb could not parse filter (&(objectclass=group)(ghost=usr\\\\001)), because ghost value was not sanitized Resolves: https://fedorahosted.org/sssd/ticket/2163
generated by cgit (git 2.34.1) at 2024-05-27 11:46:22 +0000