summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa/ipa_subdomains.c
Commit message (Collapse)AuthorAgeFilesLines
* IPA/AD: globally set krb5 canonicalization flagSumit Bose2016-07-061-2/+5
| | | | | | | | | | | If Kerberos principal canonicalization is configured in SSSD, currently it is the default for the IPA provider, a configuration snippet is generated for the system-wide libkrb5 configuration so that all kerberized applications will use canonicalization by default. Resolves https://fedorahosted.org/sssd/ticket/3041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-201-739/+854
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: terminate properly if view name lookup failsSumit Bose2016-04-221-7/+1
| | | | | | | | | | | Since commit 5a5f1e1053415efaa99bb4d5bc7ce7ac0a95b757 the view name lookup is the last step in the subdomain lookup request. In case of an error the request should be finished and no previous step should be called again. Resolves https://fedorahosted.org/sssd/ticket/2993 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: invalidate override data if original view is missingSumit Bose2016-02-261-3/+13
| | | | | | | | | | | | | | If the idview name cannot be read from cache this either means that the cache was empty or the name wasn't written because of an error. In the case of an error SSSD would assume that the default view was used. If the new view is different from the default view the override data must be invalidated. Since the sysdb call to invalidate the override data would work with an empty cache as well and do nothing it is safe to call it on both cases. Related to https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: lookup idview name even if there is no master domain recordSumit Bose2016-02-261-35/+43
| | | | | | | | | | | | | | | Currently the IPA subdomain provider returns with a error if there is no master domain record found. Since this record contains data which is only needed to create a trust with AD, like e.g. the IPA domain SID, this record is only created by ipa-adtrust-install. But the idview name is read after the master domain record. To make the idview feature work with a plain FreeIPA setup without running ipa-adtrust-install the missing master domain record should be handled gracefully and the following lookup should run as well. Resolves https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Make it possible to silence errors from dereferenceJakub Hrozek2016-01-191-1/+5
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2791 When a modern IPA client is connected to an old (3.x) IPA server, the attribute dereferenced during the ID views lookup does not exist, which triggers an error during the dereference processing and also a confusing syslog message. This patch suppresses the syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: rename sdap_get_id_specific_filterPavel Březina2016-01-191-2/+2
| | | | | | | | More generic name is used now since it is not used only for id filters. Probably all references will be deleted when the code uses sdap_search_in_bases istead of custom search base iterators. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Reduce code duplication in the callback handlersJakub Hrozek2015-12-101-1/+1
| | | | | | | Instead of calling sbus_request_return_and_finish() directly with the same checks copied over, add a be_sbus_reply() helper instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-231-2/+2
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-211-1/+1
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Always re-fetch the keytab from the IPA serverJakub Hrozek2015-08-141-2/+2
| | | | | | | | | | Even if a keytab for one-way trust exists, re-fetch the keytab again and try to use it. Fall back to the previous one if it exists. This is in order to allow the admin to re-establish the trust keytabs with a simple sssd restart. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: prepare for LOCAL viewPavel Březina2015-07-271-1/+2
| | | | | | | | | | | | Objects doesn't have to have overrideDN specified when using LOCAL view. Since the view is not stored on the server we do not want to contact LDAP therefore we special case LOCAL view saying that it is OK that this attribute is missing. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-021-3/+2
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Make constructing an IPA server mode context asyncJakub Hrozek2015-06-141-6/+30
| | | | | | | Refactoring in preparation for requesting the keytab in future patches. Currently it's a fake async that just marks the request as done. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Read forest name for trusted forest roots as wellJakub Hrozek2015-06-141-0/+15
| | | | | | | | | This will reduce special-casing when establishing forest roots as all domains will contain the forest name. Additionally, AD subdomains already contain the forest name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Include ipaNTTrustDirection in the attribute set for trusted domainsJakub Hrozek2015-06-141-21/+56
| | | | | | | | | | | Allows to distinguish the trust directions for trusted domains. For domains where we don't know the direction in server mode, we assume two-way trusts. Member domains do not have the direction, but rather the forest root direction is used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Split two functions to new module ipa_subdomains_utils.cJakub Hrozek2015-06-141-42/+5
| | | | | | | | | These functions will be later reused by the subdomains_server.c module. Splitting them into a separate subdomains_utils.c module will make sure there are no cyclic dependencies and the functions are testable in isolation. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Move server-mode functions to a separate moduleJakub Hrozek2015-06-141-311/+5
| | | | | | | | There is already quite a few functions that are server-mode specific and there will be even more with one-way trusts. Split the server-mode specific functions into a separate module. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Also update master domain when initializing subdom handlerJakub Hrozek2015-06-141-0/+9
| | | | | | | Updating master domain record from sysdb will ensure the flat name of the master domain record is up-to-date. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fold ipa_subdom_enumerates into ipa_subdom_storeJakub Hrozek2015-06-141-15/+10
| | | | | | Reduced code duplication Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Check master domain record before subdomain recordsJakub Hrozek2015-06-141-14/+28
| | | | | | | | | | | | | | | | | | | | For one-way trusts we need to know the flat name of the IPA domain when we process subdomains, hence we need to swap the processing order and read the master domain record sooner. Previsouly the order was: - ranges - subdomains - if on client, views - master Now the order is: - ranges - master - subdomains - if on client, views Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add ipa_subdomains_handler_get_{start,cont} wrappersJakub Hrozek2015-06-141-13/+34
| | | | | | | | | | Previously it was error-prone to move code around, because the functions that started next subdomain request were scattered together with moving to next base or assigning next base. This patch creates a wrappers for better readability. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-141-1/+10
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-141-1/+1
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* subdomains: Inherit cleanup period and tokengroup settings from parent domainJakub Hrozek2015-06-051-0/+4
| | | | | | | | | | | Allows the administrator to extend the functionality of ldap_purge_cache_timeout, ldap_user_principal and ldap_use_tokengroups to the subdomains. This is a less intrusive way of achieving: https://fedorahosted.org/sssd/ticket/2627 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: do not fail if view name lookup failed on older versionsSumit Bose2015-05-121-1/+8
| | | | | | | | | | | | | | Depending on the version 389ds return a different error code if the search for the view name failed because our dereference attribute ipaAssignedIDView is not known. Newer version return LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which is returned as EIO. In both cases we have to assume that the server is not view aware and keep the view name unset. Resolves https://fedorahosted.org/sssd/ticket/2650 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* subdom: Remove unused function get_flat_name_from_subdomain_nameJakub Hrozek2015-04-161-21/+0
| | | | | | | The function was added in 70eaade10feedd7845e39170d0b7eebf3a030af1 and is unused since b8d703cf3aba81800cf1b8ccca64bb00ef0b30f7 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-171-3/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: support for AD site overridePavel Reichl2015-01-261-1/+5
| | | | | | | | | Override AD site found during DNS discovery. Resolves: https://fedorahosted.org/sssd/ticket/2486 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: only update view data if it really changedSumit Bose2014-12-021-50/+66
| | | | | | https://fedorahosted.org/sssd/ticket/2510 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: make krb5 provider view awareSumit Bose2014-12-021-0/+13
| | | | | | https://fedorahosted.org/sssd/ticket/2510 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: allow view name change at startupSumit Bose2014-11-251-16/+81
| | | | | | | | | | Currently some manual steps are needed on a FreeIPA to switch from one view to another. With this patch the IPA provider checks at startup if the view name changed and does the needed steps automatically. Besides saving the new view name this includes removing the old view data and marking the user and group entries as invalid. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD/IPA: add krb5_confd_path configuration optionSumit Bose2014-11-251-0/+8
| | | | | | | | | With this new parameter the directory where Kerberos configuration snippets are created can be specified. Fixes https://fedorahosted.org/sssd/ticket/2473 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: inherit ldap_user_extra_attrs to AD subdomainsSumit Bose2014-11-051-0/+31
| | | | | | | | | | | | | | Currently the component of the IPA provider which reads the AD user and group attributes in ipa-server-mode uses default settings for the LDAP related attributes. As a result even if ldap_user_extra_attrs is defined in sssd.conf no extra attributes are read from AD. With the patch the value if ldap_user_extra_attrs is inherited to the AD subdomains to allow them to read extra attributes as well. Related to https://fedorahosted.org/sssd/ticket/2464 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa_subdomains_handler_master_done: initialize reply_countSumit Bose2014-10-221-1/+1
| | | | | | | | This patch should mainly silence a false-positive Coverity warning but since further processing depends on this variable I think it is a good idea anyways. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ipa: fix issues with older servers not supporting viewsSumit Bose2014-10-221-1/+13
| | | | | | | | | Older FreeIPA servers which do not know about the ipaAssignedIDView attribute will return an error during the LDAP dereference request because SSSD marks LDAP extensions as critical. In this case we keep the view name empty and skip override lookups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Always write capathsJakub Hrozek2014-10-161-3/+1
| | | | | | | | | We used to only generate the [capaths] section on the IPA server itself, when running in a trusted setup. But we also found out that the capaths are often required to make SSO fully work, so it's better to always generate them. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: add view support and get view nameSumit Bose2014-10-161-10/+183
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-221-1/+1
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: check ranges for collisions before saving themSumit Bose2014-02-261-20/+64
| | | | | | Fixes https://fedorahosted.org/sssd/ticket/2253 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-87/+87
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Pass a private context to enumeration ptask instead of hardcoded ↵Jakub Hrozek2014-01-291-3/+5
| | | | | | | | | | connection Previously, the sdap-domain enumeration request used a single connection context to download all the data. Now we'd like to use different connections to download different objects, so the ID context is passed in and the request itself decides which connection to use for the sdap-domain enumeration.
* responder: Set forest attribute in AD domainsPavel Reichl2014-01-091-1/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2160
* IPA: fix for recent AD group membership changesSumit Bose2014-01-081-0/+2
|
* IPA: Call ipa_ad_subdom_refresh when server mode is initializedJakub Hrozek2013-12-191-6/+14
| | | | | | ipa_ad_subdom_refresh was called before IPA server context was initialized. On IPA server, this caused the code to dereference a NULL pointer and crash.
* IPA: Refresh subdomain data structures on startupJakub Hrozek2013-12-181-19/+32
| | | | | Write domain-mappings at startup and initialize internal data structures on provider startup, not only during updates.
* SUBDOMAINS: Reuse cached results if DP is offlineJakub Hrozek2013-12-091-2/+6
| | | | | | | | | | If Data Provider was unable to refresh the subdomain list, the sss_domain_info->subdomains list was NULL. Which meant that no DP request matched any known domain and hence offline authentication was not working correctly. Resolves: https://fedorahosted.org/sssd/ticket/2168
* ipa: destroy cleanup task when subdomain is removedPavel Březina2013-10-251-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/1968
* dp: free sdap domain if subdomain is removedPavel Březina2013-10-251-0/+4
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/1968
* dp: make subdomains refresh interval configurablePavel Březina2013-10-251-3/+4
| | | | | | | | | | This patch makes the refresh of available subdomains configurable. New option: subdomain_refresh_interval (undocumented) Resolves: https://fedorahosted.org/sssd/ticket/1968
generated by cgit (git 2.34.1) at 2024-09-27 00:00:12 +0000