summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* UTIL: Allow to append new line in sss_vdebug_fnLukas Slebodnik2016-03-231-1/+1
| | | | | | | | libldb is not consistent with appending line feed in debug messages. AS a result of this two messages can be on the same line in sssd log files. Which makes analyzing log files more difficult. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUDO: be able to parse modifyTimestamp correctlyPavel Březina2016-03-174-29/+62
| | | | | | | | | | | | | We were unable to parse modifyTimestamp where a non-numeric part (timezone) was involved. The format is YYYYMMDDHHmmssZ. It may also contain fraction or different timezone, everytime separated from the datetime by character. This patch gets the numberic part and then appends the string part again to get value usable in filter. Resolves: https://fedorahosted.org/sssd/ticket/2970 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: support old ipasudocmd rdnPavel Březina2016-03-141-22/+103
| | | | | | | | | FreeIPA versions older than 3.1 have rdn sudoCmd instead of ipaUniqueID. Resolves: https://fedorahosted.org/sssd/ticket/2969 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: fix typoPavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-128-2782/+1
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Fix typo in constant nameJakub Hrozek2016-03-121-1/+1
| | | | | | | On platforms without the format attribute, libhbac could not be compiled. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Add more debug messagesJakub Hrozek2016-03-121-3/+19
| | | | | | | Adding more debug messages proved to be useful during pam_hbac development. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Do not use C99Jakub Hrozek2016-03-121-4/+10
| | | | | | | | libipa_hbac can be used by external consumers like pam_hbac who run on old platforms that do not support C99. Refrain from using C99 features in that codebase. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-111-4/+6
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-093-0/+3
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-011-42/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-011-0/+10
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Add other display managers to interactive logonStephen Gallagher2016-02-291-1/+6
| | | | | | | | Gone are the days when all systems used GDM or KDM. We need to support other display managers in the default configuration to avoid issues when enrolled in AD domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Add Cockpit to the Remote Interactive defaultsStephen Gallagher2016-02-291-1/+3
| | | | | | | | | The Cockpit Project is an administrative console that is gaining in popularity and is a default component on some operating systems (such as Fedora Server). Since it is becoming more common, we should ensure that it is part of the standard mapping. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: invalidate override data if original view is missingSumit Bose2016-02-261-3/+13
| | | | | | | | | | | | | | If the idview name cannot be read from cache this either means that the cache was empty or the name wasn't written because of an error. In the case of an error SSSD would assume that the default view was used. If the new view is different from the default view the override data must be invalidated. Since the sysdb call to invalidate the override data would work with an empty cache as well and do nothing it is safe to call it on both cases. Related to https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: lookup idview name even if there is no master domain recordSumit Bose2016-02-261-35/+43
| | | | | | | | | | | | | | | Currently the IPA subdomain provider returns with a error if there is no master domain record found. Since this record contains data which is only needed to create a trust with AD, like e.g. the IPA domain SID, this record is only created by ipa-adtrust-install. But the idview name is read after the master domain record. To make the idview feature work with a plain FreeIPA setup without running ipa-adtrust-install the missing master domain record should be handled gracefully and the following lookup should run as well. Resolves https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Use the common if-else coding styleJakub Hrozek2016-02-251-4/+2
| | | | | Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Use the IPA provider interface to resolve external group membersJakub Hrozek2016-02-243-28/+654
| | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2522 Currently the approach is not optimized for performance, because each external member is resolved in a full transaction to make sure even ID views and similar information is processed. In future, we should implement https://fedorahosted.org/sssd/ticket/2943 we will again be able to process all the data in a single transaction. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add interface to call into IPA provider from LDAP providerJakub Hrozek2016-02-246-1/+342
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2522 Adds a pluggable interface that is able to resolve the IPA group's external members. At the moment, the request calls the full be_ interface to make sure all corner cases like id-views are handled internally. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-244-0/+6
| | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com>
* subdomains: inherit ldap_krb5_keytabSumit Bose2016-02-231-0/+1
| | | | | | | | | | If a non-default keytab is configured for the parent domain the subdomains will still use the default keytab because the alternative keytab is not inherited. As a consequence SSSD might not be able to connect to services in the subdomain because the default keytab is either not present or does not have suitable keys. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Check format string in hbac log functionLukas Slebodnik2016-02-232-1/+9
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: log real hbac functionLukas Slebodnik2016-02-233-2/+5
| | | | | | | The string "hbac" wsa logged previously. Real hbac function will be logged with this patch. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use sss_vdebug_fn in hbac_debug_messagesLukas Slebodnik2016-02-231-12/+1
| | | | | | | This patch reduce unnecessary memory allocations for log messages from libhbac. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Use prefix for debug functionLukas Slebodnik2016-02-231-2/+2
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Fix typos reported by lintianLukas Slebodnik2016-02-232-2/+2
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* krb5_child: Warn if user cannot read krb5.confLukas Slebodnik2016-02-191-0/+24
| | | | | | | | | | | | | | | | | | Attached patch should siplify troubleshoting of issues with permission of krb5.conf. It's not clear from krb5_child.log even with full debug level. [sss_get_ccache_name_for_principal] (0x4000): Location: [FILE:/tmp/krb5cc_12069_XXXXXX] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243] [Can't find client principal user@EXAMPLE.COM in cache collection] [create_ccache] (0x0020): 735: [13][Permission denied] Resolves: https://fedorahosted.org/sssd/ticket/2931 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PAM: Pass account lockout status and display messagePavel Reichl2016-02-171-0/+19
| | | | | | | | | Tested against Windows Server 2012. Resolves: https://fedorahosted.org/sssd/ticket/2839 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Add return code ERR_ACCOUNT_LOCKEDPavel Reichl2016-02-173-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add code to distinquish state when account is locked in Active Directory server. Tested against Windows Server 2012 This patch is best effort only as decision whether account is actually locked is based on parsing error message returned by AD. The format and content of this error message might be subject of change in future releases and also can be modified by AD administrators. If account is locked bind operation is expected to return following error message: ----------------------------------------------------------------------- Invalid credentials(49), 80090308: LdapErr: DSID-0C0903C5, comment: AcceptSecurityContext error, data 775, v23f0 ----------------------------------------------------------------------- Where sub string 'data 775' implies that account is locked (ERROR_ACCOUNT_LOCKED_OUT) [1]. However the 80090308 (error code 0x80090308, SEC_E_INVALID_TOKEN) is the only guaranteed part of error string [2]. Error message is described in further detail as [3]: ----------------------------------------------------------------------- When the server fails an LDAP operation with an error, and the server has sufficient resources to compute a string value for the errorMessage field of the LDAPResult, it includes a string in the errorMessage field of the LDAPResult (see [RFC2251] section 4.1.10). The string contains further information about the error. The first eight characters of the errorMessage string are a 32-bit integer, expressed in hexadecimal. Where protocol specifies the extended error code "<unrestricted>" there is no restriction on the value of the 32-bit integer. It is recommended that implementations use a Windows error code for the 32-bit integer in this case in order to improve usability of the directory for clients. Where protocol specifies an extended error code which is a Windows error code, the 32-bit integer is the specified Windows error code. Any data after the eighth character is strictly informational and used only for debugging. Conformant implementations need not put any value beyond the eighth character of the errorMessage field. ----------------------------------------------------------------------- [1] https://msdn.microsoft.com/en-us/library/windows/desktop/ms681386%28v=vs.85%29.aspx [2] https://social.msdn.microsoft.com/Forums/en-US/e1d600c8-60b7-4ed0-94cb-20ddd6c1a1c6/msadts-user-locking-password-policies?forum=os_windowsprotocols [3] MS-ADTS 3.1.1.3.1.9 https://msdn.microsoft.com/en-us/library/cc223253.aspx Resolves: https://fedorahosted.org/sssd/ticket/2839 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Just return NULL if tevent_req_create() failsSumit Bose2016-02-111-2/+1
| | | | | | | | | In general we just return NULL if tevent_req_create() fails because there is nothing we can do with the request anyway. Especially tevent_req_error() should not be called because it tries to dereference req. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Add error code to debug messagePavel Reichl2016-02-091-2/+4
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* FAILOVER: Improve reporting of errorsLukas Slebodnik2016-01-281-7/+13
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IDMAP: Add support for automatic adding of rangesPavel Reichl2016-01-205-5/+15
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Make it possible to silence errors from dereferenceJakub Hrozek2016-01-193-10/+28
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2791 When a modern IPA client is connected to an old (3.x) IPA server, the attribute dereferenced during the ID views lookup does not exist, which triggers an error during the dereference processing and also a confusing syslog message. This patch suppresses the syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* sdap_connect_send: fail if uri or sockaddr is NULLPavel Březina2016-01-191-0/+6
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2904 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: try to use current server in the renewal taskSumit Bose2016-01-191-3/+23
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FO: add be_fo_get_active_server_name()Sumit Bose2016-01-192-0/+20
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FO: add fo_get_active_server()Sumit Bose2016-01-192-0/+7
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: add task to renew the machine account password if neededSumit Bose2016-01-194-0/+386
| | | | | | | | | | | | | | | | | | AD expects its clients to renew the machine account password on a regular basis, be default every 30 days. Even if a client does not renew the password it might not cause issues because AD does not enforce the renewal. But the password age might be used to identify unused machine accounts in large environments which might get disabled or deleted automatically. With this patch SSSD calls an external program to check the age of the machine account password and renew it if needed. Currently 'adcli' is used as external program which is able to renew the password since version 0.8.0. Resolves https://fedorahosted.org/sssd/ticket/1041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP_TASK: add be_ptask_get_timeout()Sumit Bose2016-01-192-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: allow to skip default options for child processesSumit Bose2016-01-192-2/+2
| | | | | | | | | | | | | Currently the SSSD default options like e.g. --debug-level are added unconditionally to the command line options of a child process when started with the child helper functions. If a binary from a different source should be started as a child by SSSD those options might not be known or used differently. This patch adds an option to exec_child_ex() which allows to skip the default options and only add specific options. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-193-0/+17
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: simplify usn filterPavel Březina2016-01-192-11/+5
| | | | | | usn >= current && usn != currect is equivalent to usn >= current + 1 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: remember usn as number instead of stringPavel Březina2016-01-194-28/+31
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: allow disabling full refreshPavel Březina2016-01-191-1/+1
| | | | | | | | This condition always disabled smart refresh when full refresh interval was set to zero and thus disabling periodic refresh functionality completelely. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: assume zero if usn is unknownPavel Březina2016-01-194-30/+13
| | | | | | | | When we switched to be_ptaks full_refresh_done has become obsolete since timing is handled in a better way. In case of unknown USN we assume zero which allows us to disable full refresh completely in configuration. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: remove full_refresh_in_progressPavel Březina2016-01-194-10/+0
| | | | | | When we switched to be_ptask this variable has become obsolete. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: sdap_sudo_set_usn() do not steal usnPavel Březina2016-01-192-3/+10
| | | | | | This is less error prone. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement smart refreshPavel Březina2016-01-193-7/+438
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Add sdap_or_filtersPavel Březina2016-01-192-7/+27
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-27 02:51:31 +0000