summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* DP: Introduce new interface for backendPavel Březina2016-06-2023-0/+3628
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Terminology: * Backend: Implemenation of domain * Data Provider: interface between backend and responders * Module: ldap/ipa/ad/... dlopened library that implements dp interface * Target: id/autofs/sudo/... functionality of module Benefits over current code: * data provider is a black box completely separated from backend * method handlers are just simple tevent requests on backend side * no need of spy on be_client * simplified and error proof adding of new responders * simplified adding of new methods * reply to D-Bus message is completely handled by DP code * each target can have several methods defined * properties can be added on objects * each method can have output parameters * modules now support constructor * improved debugging * clear memory hierarchy * ability to chain requests * type safe private data Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap ops: add support for derefPavel Březina2016-06-202-0/+289
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow returning only the first replyPavel Březina2016-06-202-42/+123
| | | | | | | | | In some cases we want to cycle through all search bases but stop iterating when we get first non-empty reply. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow map to be NULLPavel Březina2016-06-201-10/+8
| | | | | | | | In some cases we do not want any attribute translations. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_backend.h to backend.hPavel Březina2016-06-2038-37/+37
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.c to be_dyndns.cPavel Březina2016-06-201-0/+0
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.h to be_dyndns.hPavel Březina2016-06-2010-9/+9
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_refresh.c to be_refresh.cPavel Březina2016-06-201-0/+0
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_refresh.h to be_refresh.hPavel Březina2016-06-205-4/+4
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_ptask to be_ptaskPavel Březina2016-06-2011-10/+10
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-184-5/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Decorate the hot paths in the LDAP provider with systemtap probesJakub Hrozek2016-06-105-0/+81
| | | | | | | | | | | | | During performance analysis, the LDAP provider and especially its nested group code proved to be the place where we spend the most time during account requests. Therefore, I decorated the LDAP provider with systemtap probes to be able to observe where the time is spent. The code allows passing of search properties (base, filter, ...) from marks to probes. Where applicable, the probes pass on these arguments to functions and build a human-readable string representation. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* STAP: Add helper functions to for human-readable account request representationJakub Hrozek2016-06-101-0/+2
| | | | | | | | The caller of the systemtap script would be able to see what kind of account request sssd received with a string representation, not just the cryptic hexadecimal number. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow lookups by cert in sub-domains on the clientSumit Bose2016-06-093-9/+41
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: read user certificate if availableSumit Bose2016-06-091-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: save cert as blob in the cacheSumit Bose2016-06-091-2/+17
| | | | | | | | The IPA extdom plugin returns the user certificate base64 encoded. Before the IPA client can store it in the cache it must be decoded so that it is stored as a binary as the certificate from other sources. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: add support for certificate overridesSumit Bose2016-06-094-0/+33
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: use krb5_keytab for subdomain initializationSumit Bose2016-06-094-15/+22
| | | | | | | | | | During the initialization of AD subdomains parameters like the SASL auth id are determined. Since subdomains use a default set of the AD specific configuration options the default keytab will be used. If krb5_keytab is set in sssd.conf for the AD domain this keytab should be used for the subdomains (domains of the same AD forest) as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD_PROVIDER: Fix constant char *Petr Cech2016-06-071-1/+1
| | | | | | | | This patch fixes loading of ad_domain option. It is declared like const, co we should use dp_opt_get_cstring() instead of dp_opt_get_string(). Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Add "polkit-1" to ad_gpo_map_allowStephen Gallagher2016-06-031-1/+3
| | | | | | | | | | | Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Try also the AD access control for IPA usersJakub Hrozek2016-06-031-0/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2927 If a user from an AD trusted domain is logging in, we should also check their AD lockout status. This helps cases where the user might have been disabled but is logging in with an SSH public key. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-316-74/+93
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: Do not leak file descriptors during machine password renewalJakub Hrozek2016-05-311-13/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3017 The AD renewal task was opening a pipe to write to the child process but never closed it, leaking the fd. This patch uses a desctructor we already use for pipes towards other child processes. Reviewed-by: Petr Cech <pcech@redhat.com>
* IPA: use forest name when looking up the Global CatalogSumit Bose2016-05-241-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3015 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Do not schedule the machine renewal task if adcli is not executableJakub Hrozek2016-05-191-0/+9
| | | | | | | | | | | Before scheduling the adcli renewal task, check if the renewal program (typically adcli) is accessible. If not, do dot schedule the renewal task at all. Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-195-37/+33
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Failover to next server if authentication failsPavel Březina2016-05-111-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3010 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Inform about (un)successful connectionPavel Březina2016-05-111-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make sdap_process_group_send() staticJakub Hrozek2016-05-091-8/+9
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* GPO: Add "unity" to ad_gpo_map_interactiveStephen Gallagher2016-05-061-1/+2
| | | | | | | | | | | Ubuntu systems use "unity" as their screen-locker. Without this in the defaults, people often get locked out of their machines when the screen locks. Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Print port in sdap_print_serverLukas Slebodnik2016-04-271-3/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: terminate properly if view name lookup failsSumit Bose2016-04-221-7/+1
| | | | | | | | | | | Since commit 5a5f1e1053415efaa99bb4d5bc7ce7ac0a95b757 the view name lookup is the last step in the subdomain lookup request. In case of an error the request should be finished and no previous step should be called again. Resolves https://fedorahosted.org/sssd/ticket/2993 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_auth_store_creds: silence spurious debug messageSumit Bose2016-04-191-1/+5
| | | | | | | | | | | During a pre-authentication request there are always messages like: ... [krb5_auth_store_creds] (0x0010): unsupported PAM command [249]. ... [krb5_auth_store_creds] (0x0010): password not available, offline auth may not work. This patch removes them. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA_SUDO: Prevent dereference of NULL pointerLukas Slebodnik2016-04-181-0/+5
| | | | | | | | | | | | | | | | | | | | Error: NULL_RETURNS (CWE-476): [#def31] sssd-1.13.4/src/providers/ipa/ipa_sudo_conversion.c:964: returned_null: "ipa_sudo_conv_lookup" returns null. sssd-1.13.4/src/providers/ipa/ipa_sudo_conversion.c:149:9: return_null: Explicitly returning null. sssd-1.13.4/src/providers/ipa/ipa_sudo_conversion.c:964: var_assigned: Assigning: "cmdgroup" = null return value from "ipa_sudo_conv_lookup". sssd-1.13.4/src/providers/ipa/ipa_sudo_conversion.c:966: dereference: Dereferencing a null pointer "cmdgroup". # 964| cmdgroup = ipa_sudo_conv_lookup(conv->cmdgroups, listitem->dn); # 965| # 966|-> ret = add_strings_lists(mem_ctx, values, cmdgroup->expanded, # 967| false, discard_const(&values)); # 968| if (ret != EOK) { Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dp_ptask: Fix memory leak in synchronous ptaskLukas Slebodnik2016-04-131-0/+2
| | | | | | | structure be_ptask_sync_ctx was not released anywhere when be_ptask_create_sync was used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: resolve PAC for trusted users on IPA clientsSumit Bose2016-04-133-1/+225
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: ipa_s2n_get_list_send() allow other list typesSumit Bose2016-04-131-20/+72
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: rename ipa_s2n_get_fqlist* to ipa_s2n_get_list*Sumit Bose2016-04-131-49/+49
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: process PAC during initgroups requestSumit Bose2016-04-134-8/+878
| | | | | | | | | If there is a recently attached PAC blob in the cached user entry the PAC data is used to update the group memberships data of the user. If there is no PAC attached or if it is too old the other configured methods will be used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* util: make concatenate_string_array() reusableSumit Bose2016-04-131-25/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: refactor sdap_ad_tokengroups_initgr_mapping_done()Sumit Bose2016-04-132-27/+57
| | | | | | The group-processing is moved out to make it reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: make some AD specific calls publicSumit Bose2016-04-132-14/+66
| | | | | | | Make sdap_ad_tokengroups_get_posix_members() and sdap_ad_resolve_sids_send() reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Check RDN in ipa_add_ad_memberships_get_nextLukas Slebodnik2016-04-121-1/+7
| | | | | | | | | | | | | | | | | LDB functions ldb_dn_get_component_val and ldb_dn_get_rdn_val validate dn before returning component value. It should be valid DN according to RFC4514. IPA/389ds might return problematic DN due to replication conflicts. e.g. "cn=System: Read Service Delegations+nsuniqueid=b0736336-d06e11e5-8e8acabe-ce8d458d,cn=permissions,dc=example,dc=com" It's better to check return value of these LDb function rather than crash because of dereference of NULL pointer. Resolves: https://fedorahosted.org/sssd/ticket/2980 Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Process GPOS in offline mode if ldap search failedLukas Slebodnik2016-04-121-0/+20
| | | | | | | | | | | | | | | | | Initgroup requests use global catalog for LDAP queries. Only port for global catalog is marked as offline if request fails due to problems with connection. However, GPO code uses standard LDAP port for retrieving of target DNs and other information. Previously, GPOs were processed in offline mode only if there were issues with connection to AD server. But connection can be cached and ldap search can still fail. Resolves: https://fedorahosted.org/sssd/ticket/2964 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO_CHILD: Create directories in gpo_cache with right permissionsLukas Slebodnik2016-04-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The parent directory has to have execute bit if we want to create subdirectories or read files there. sh-4.3$ mkdir dir sh-4.3$ echo "test" > dir/test_file sh-4.3$ chmod 644 dir/ sh-4.3$ ls dir/ test_file sh-4.3$ cat dir/test_file cat: dir/test_file: Permission denied It was not probelm for sssd in root mode because root has by default capbilities DAC_OVERRIDE and DAC_READ_SEARCH which bypass file read, write, and execute permission checks and directory read and execute permission checks Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: Soften umask in gpo_childLukas Slebodnik2016-04-071-4/+12
| | | | | | | | | | | | | | | | | | The default umask(0177) inherited from sssd_be is to strict for gpo_child in non-root mode. mkdir creates directories with only "rw" permission for owner. The man 1 chmod says: "execute (or search for directories) (x)" In another words, execute bit is required for directories. sh-4.3$ mkdir dir sh-4.3$ chmod 600 dir/ sh-4.3$ mkdir dir/subdir mkdir: cannot create directory ‘dir/subdir’: Permission denied Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Recognize Windows Server 2016Jakub Hrozek2016-04-072-3/+6
| | | | | | | | | | Even though at this time the MSDN documentation at: https://msdn.microsoft.com/en-us/library/cc223272.aspx still claims that "7" is a value of DS_BEHAVIOR_WINTHRESHOLD, testing with Windows Server 2016 Preview already shows that server reporting a new value of Domain Controller Functionality. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Remove unused parameter talloc contextLukas Slebodnik2016-04-051-4/+2
| | | | | | Parameter memctx was unused in sdap_nested_group_add_ext_members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Remove unused parameter from ipa_ext_group_member_checkLukas Slebodnik2016-04-051-2/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: log specific ini parse error messagesMichal Židek2016-03-232-2/+40
| | | | | | | | We should log error messages generated by libini if there are problems with parsing gpo files. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-27 12:59:35 +0000