summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* LDAP: Delete cache entry if not found by UPNJakub Hrozek2016-07-071-0/+19
| | | | | | | | | Previously, the user account was only looked by name when the LDAP provider didn't match any entry on the server side. This patch removes the entry from the cache with the matching function, either by name or by UPN. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use FQDNs when saving incomplete groupsJakub Hrozek2016-07-071-4/+4
| | | | | | | Even incomplete groups must be stored using the internal name format instead of whatever we receive from LDAP. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use fqdns during nested RFC2307 initgroupsJakub Hrozek2016-07-071-19/+3
| | | | | | | | All user and group names are already qualified at this point, so let's remove the special case that stored users from trusted domains qualified. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: make it clear that sdap_add_incomplete_groups operates on sysdb namesJakub Hrozek2016-07-072-6/+6
| | | | | | Just provides a more descriptive name of a function parameter. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add a utility function to return a list of qualified namesJakub Hrozek2016-07-074-14/+49
| | | | | | | | Adds a utility function the LDAP provider can use. This is different from sss_create_internal_fqname_list in the sense that the LDAP provider passes in the attribute name that contains the name attribute value. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Convert RFC2307 member attribute values to FQDN-style ghostnames ↵Jakub Hrozek2016-07-071-2/+12
| | | | | | | | | | before acting on them Ghostnames must be qualified as well, same as all other name attributes across SSSD. The ghost names are used by the NSS responder during getgr* output and the domain name parsed from the name is used in the output. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: save users with FQDNJakub Hrozek2016-07-071-4/+38
| | | | | | | The username we receive from LDAP is short name. Convert it to a qualified name before saving the user. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use shortname for LDAP queriesJakub Hrozek2016-07-072-29/+103
| | | | | | | | | | When looking up users or groups by name, we need to user the plain username in the filter. The domain is typically signified by the search base. When looking up by UPN, we can keep using the raw value from the DP. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Rename DP filter value from name to filter_valueJakub Hrozek2016-07-073-63/+66
| | | | | | | filter_value is a better name, because we don't look just by name, the same variable is used to look up certificates etc. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SSH: Use a qualified name for user searches in the SSH responderJakub Hrozek2016-07-072-2/+10
| | | | | | | The name is converted from whatever we receive on input to the internal format before processing the data further. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Use qualified names internally in the PAM responderJakub Hrozek2016-07-073-47/+113
| | | | | | | The name is converted from whatever we receive on input to the internal format before processing the data further. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Start fixing the PAM responder tests for fully qualified names in sysdbMichal Zidek2016-07-071-11/+21
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS; orig_name does not need to be expanded to sysdb formatSumit Bose2016-07-071-21/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Fix domain for UPN based lookupsSumit Bose2016-07-071-0/+29
| | | | | | | Since sysdb_search_user_by_upn() searches the whole cache we have to set the domain so that it matches the result. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Fix NSS responder to cope with fully-qualified usernamesJakub Hrozek2016-07-072-857/+1028
| | | | | | | | | | | | | | | | | | | | | | | | Adds a utility function sized_output_name() which wraps the output_name() function and returns the sized_struct structure. This function is used when formatting the output name for the client, but also when saving/deleting the memory cache entries. Its sister function sized_member_name() is very similar, but infers the domain name from memberuid or ghost attribute. Because all names internally are used in the same format, the logic to append domain or format the usename for output in the fill_XXX() family of functions is much simpler. In general, adding a domain suffix no longer relies in the domain being a subdomain, but only the dom->fqnames The parse_member() function was removed because it is no longer required. The nss test was amended to store names in the internal fqdn format on input and checks for either shortnames or qualified names with the right format created using sss_tc_fqname() on output. Reviewed-by: Sumit Bose <sbose@redhat.com>
* NCACHE: Store FQDNs internaly, check for shortnames in filesJakub Hrozek2016-07-074-59/+216
| | | | | | | | When storing users and groups by their name in the negative cache, store them fully qualfied so that the responder only has to track the name in the internal format once the input is converted. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Start fixing the NSS test for fully qualified names in sysdbMichal Zidek2016-07-071-61/+130
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Fix the nested group tests to cope with FQDNsJakub Hrozek2016-07-071-43/+132
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: expand_homedir_template manages usernames internallyJakub Hrozek2016-07-076-27/+41
| | | | | | | | | expand_homedir_template() can be considered an outward-facing interface, therefore the function and its input structure will accept the internal name format and parse it internally into a username and domain component. Reviewed-by: Sumit Bose <sbose@redhat.com>
* RESPONDER: Add a helper function sss_resp_create_fqnameJakub Hrozek2016-07-072-0/+50
| | | | | | | | | | | | | When looking up entries in the responders that have not been yet converted to the cache_req API, we need to perform some common operations all the time. These include converting the name to the right case, reverse-replacing whitespace and converting the name to the qualified format for that domain. This patch adds a function that performs these steps to avoid code duplication. Reviewed-by: Sumit Bose <sbose@redhat.com>
* RESPONDER: Use fqnames for cache_req lookups of users and groupsJakub Hrozek2016-07-072-77/+200
| | | | | | | When looking up users or groups by name, qualify the name into the internal format before the lookup. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Convert the simple access provider to cmockaJakub Hrozek2016-07-072-686/+692
| | | | | | | | Using a cmocka-based test allows us to initialize the domain using the common helper functions which in turn allows us to set different properties with confdb, same as sssd itself does. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SIMPLE: Make the simple access provider work with qualified namesJakub Hrozek2016-07-071-19/+19
| | | | | | | | | | | | | | | | This patch adds a behaviour change to the simple access provider - the simple access list is parsed on the access check itself, which is when the name contexts of all domains have already been established and we are already able to parse the names in the config files with sss_parse_names. We need to support "input names" in the simple access provider because it needs to support flat names which rely on knowing the details about a domain. The simple_access_obtain_filter_lists is intentionally made non-static in order to be called from tests which initialize the name contexts on their own. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Amend sysdb_view tests for the FQDN schemaJakub Hrozek2016-07-071-49/+77
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Start converting the sysdb views tests to the fqname formatMichal Zidek2016-07-071-14/+35
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Fix sysdb tests to work with the new formatJakub Hrozek2016-07-071-767/+797
| | | | | | | | | | The sysdb tests now user the qualified name to store users and groups. To avoid the sysdb interface being tied too tightly to our specific format, all names are constructed using a function, not hardcoded. Just swapping the functions that create or parse the names for a different format should not make the test fail. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: First pass on converting the sysdb tests to the fqname formatMichal Zidek2016-07-071-97/+206
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Fix the ldap_id_cleanup test for using qualified names in sysdbMichal Zidek2016-07-071-6/+32
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Store SID members during AD initgroups with a qualified nameMichal Zidek2016-07-071-1/+6
| | | | | | | | This is to be consistent with how we name groups normally. We rename the groupnames when resolving the groups by ID anyway, but if we fail to do so, at least be consistent. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Save user and group aliases qualifiedMichal Zidek2016-07-075-8/+30
| | | | | | | When saving users or groups, qualify their names. Otherwise (currently netgroups), store a plain username. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Search functions don't need to construct per-domain namesJakub Hrozek2016-07-072-19/+4
| | | | | | | The names are all internally qualified already, no need to distinguish between subdomain users and main domain users. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: add_name_and_aliases_for_name_override no longer needs to special ↵Jakub Hrozek2016-07-071-40/+5
| | | | | | | | | | case subdomain users All user and group names use the same unified format in the cache, so there's no need to special-case subdomains and create different names for the main domain and a subdomain. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search functions don't need to construct per-domain namesMichal Zidek2016-07-071-30/+3
| | | | | | | All user and group names are standardized to be fully qualified, so there's no need to provide per-domain names anymore. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: convert sysdb_group_membership_mod to operate on qualified namesMichal Zidek2016-07-071-2/+22
| | | | | | | This patch infers the member domain from the FQDN to allow the function to add group members from different domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add a utility function sss_output_nameJakub Hrozek2016-07-073-0/+79
| | | | | | | | | | Adds a convenience function that will help reduce the amount of code duplication in the responders. All responders need to parse the username from the internal format, lower-case the name, if the domain is case-insensitive and then replace spaces if the responder is configured to do so. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add a utility function to create a list of qualified namesJakub Hrozek2016-07-073-0/+72
| | | | | | | Adds a convenience wrapper around sss_create_fqname that qualifies a list of names into the format used internally in sssd. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Add a test for sss_create_internal_fqnameJakub Hrozek2016-07-071-0/+29
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add function to create internal fqnameMichal Zidek2016-07-072-0/+31
| | | | | | | Add function to create internal fqname in format shortname@domname where domain portion is lowercased. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add a test for sss_parse_internal_fqnameJakub Hrozek2016-07-071-6/+69
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add function to parse internal fqname formatMichal Zidek2016-07-074-0/+64
| | | | | | | | Add lightweight function to parse internal fqname format (shortname@domain). This function does not require the sss_names to be initialized. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove misleading commentMichal Zidek2016-07-071-1/+0
| | | | | | | Function entry_has_objectclass is not used just for users. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA/AD: globally set krb5 canonicalization flagSumit Bose2016-07-065-11/+65
| | | | | | | | | | | If Kerberos principal canonicalization is configured in SSSD, currently it is the default for the IPA provider, a configuration snippet is generated for the system-wide libkrb5 configuration so that all kerberized applications will use canonicalization by default. Resolves https://fedorahosted.org/sssd/ticket/3041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add sss_write_krb5_snippet_common()Sumit Bose2016-07-061-23/+47
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* localauth: make plugin non-authoritative on failuresSumit Bose2016-07-061-1/+6
| | | | | | | | | | | | According to the documentation in localauth_plugin.h "aname will be considered authorized if at least one module returns 0 and all other modules return KRB5_PLUGIN_NO_HANDLE." So it is safe to always return KRB5_PLUGIN_NO_HANDLE because a different plugin has to return 0 to allow access to the given principal. Resolves https://fedorahosted.org/sssd/ticket/2788 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* localauth: remove enable_only sssd from config snippetSumit Bose2016-07-061-2/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2788 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use ldb_result as output in sysdb_search_ts_{users,groups}Lukas Slebodnik2016-07-064-38/+53
| | | | | | | | | | | | | Passing address of unsigned to the output argument size_t causes access out of boundaries for type unsigned and and wrong data on big endian. It looks like functions sysdb_search_ts_{users,groups} need to store results in structure ldb_result anyway for further processing. Therefore it will be better to convert output arguments size_t* + ldb_message*** into structure ldb_result and avoid using additional helper variable with type size_t before each invocation of these functions. Reviewed-by: Sumit Bose <sbose@redhat.com>
* test_sysdb_ts_cache: Do not use wrong pointer for output argumentLukas Slebodnik2016-07-061-2/+5
| | | | | | | | | | | | | | | | | | The function sysdb_search_groups expects pointer to size_t as an output argument msgs_count. However, struct ldb_result has type unsigned for element count. The size of unsigned is lower then size of size_t on some platforms. Therefore we should not cast to pointer to size_t if we want to write count of messages into struct ldb_result -> count. The valgrind did not detect write out of boundary for the element count because it is the 1st element in structure ldb_result. It didn't cause any problem on little endian because the most significant part of size_t was properly stored to type unsigned. We firstly store to output argument _msgs_count and then to output argument _msgs in the function sysdb_cache_search_entry therefore element msgs was not damaged and contained correct data. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sssctl: remove also ccachePavel Březina2016-07-061-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: restart SSSD when removing cachePavel Březina2016-07-061-21/+40
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3066 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Change the default rfc2307 autofs attribute mappingsJakub Hrozek2016-07-063-11/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2858 The default attribute mappings we used to have: ldap_autofs_map_object_class automountMap ldap_autofs_map_name ou ldap_autofs_entry_object_class automount ldap_autofs_entry_key cn ldap_autofs_entry_value automountInformation Was wrong. Instead, this patch switches to: ldap_autofs_map_object_class nisMap ldap_autofs_map_name nisMapName ldap_autofs_entry_object_class nisObject ldap_autofs_entry_key cn ldap_autofs_entry_value nisMapEntry Which are attributes that are available with servers running the default rfc2307 schema. In addition, this patch adds a syslog and DEBUG message that warns administrators to double-check their configuration. We don't warn when the autofs provider is set to AD, because that one is already correct. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-19 20:45:44 +0000