summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* sbus: Add the sbus_request_parse_or_finish() methodStef Walter2014-03-142-64/+27
| | | | | | | | | | | | | | | | | | | | | | Some DBus types returned from dbus_message_get_args() require memory to be released when done. We automatically attach these to the talloc struct sbus_request memory context in this function. This accepts varargs similar to dbus_message_get_args(), which are rather awkward. However instead of reworking them completely, future generated marshalling code will replace most uses of these varargs. If parsing the dbus message fails, then it responds to the DBus caller with an appropriate error such as o.f.D.Error.InvalidArgs. In these cases (ie: when it returns FALSE) the sbus_request is finished. Migrated some, but not all, uses of dbus_message_get_args() to the new function. Some instances have uncommon semantics such as terminating the connection upon failure to parse a message. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Refactor how we export DBus interfacesStef Walter2014-03-143-102/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most importantly, stop using per connection private data. This doesn't scale when you have more than one thing exporting or exported on a connection. Remove struct sbus_interface and expand sbus_conn_add_interface() function. Remove various struct sbus_interface args to connection initialization functions and make callers use sbus_conn_add_interface() directly. The old method was optimized for exporting one interface on a connection. We'll have connections that export zero, one or more interfaces. To export an interface on a DBus server, call sbus_conn_add_interface() from within the sbus_server_conn_init_fn. To export an interface on a DBus client, call sbus_conn_add_interface() after sbus_new_connection() returns. As before struct sbus_interface represents an object exported via DBus. However it is now talloc allocated. One can set instance data on the struct sbus_interface. This instance data is passed to the various handlers and used in their implementation. However, we now have type safe interface exporting in the various high level sss_process_init() sss_monitor_init() and so on. Introspection support was not in use, and is now gone until we implement it using the metadata (future patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Add struct sbus_request to represent a DBus invocationStef Walter2014-03-143-362/+202
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct sbus_request represents a request from a dbus client being handled by a dbus server implementation. The struct contains the message, connection and method (and in the future teh property) which is being requested. In the future it will contain caller information as well. sbus_request is a talloc memory context, and is a good place to attach any allocations and memory specific to the request. Each handler accepts an sbus_request. If a handler returns EOK, it is assumed that the handler will finish the request. Any of the sbus_request_*finish() methods can be used to complete the request and send back a reply. sbus_request_return_and_finish() uses the same argument varargs syntax as dbus_message_append_args(), which isn't a great syntax. Document it a bit, but don't try to redesign: The marshalling work (will follow this patch set) will remove the need to use varargs for most DBus implementation code. This patch migrates the monitor and data provider dbus code to use sbus_request, but does not try to rework the talloc context's to use it. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* providers: Fix types passed to dbus varargs functionsStef Walter2014-03-142-12/+27
| | | | | | | | | | | | | | | | | | | Fix some incorrect types passed to dbus_message_get_args(), dbus_message_append_args() or functions accepting similar varargs and types. In particular sizeof(bool) != sizeof(dbus_bool_t) on most platforms. This probably only worked because the compiler was aligning stack variables and so writing off the end of one of them wasn't the end of the world. In addition fix cases where int != int32_t != uint32_t. Although these will work on many common platforms, assuming these are interchangeable is not cross platform safe. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Write SELinux usernames in the right caseJakub Hrozek2014-03-131-5/+21
| | | | | | https://fedorahosted.org/sssd/ticket/2282 Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB: Prevent dereference of a null pointerLukas Slebodnik2014-03-131-2/+4
| | | | | | | | | | | | | Reported by: scan-build krb5_free_principal(cc->context, ccprinc); ^~ warning: Access to field 'context' results in a dereference of a null pointer (loaded from variable 'cc') Variable 'cc' needn't be initialised if function sss_open_ccache_as_user fails. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Continue if sssd failes to check extra membersLukas Slebodnik2014-03-121-0/+1
| | | | | | | | | | | | | Reported by scan-build for (mi = 0; group_only[mi]; mi++) { ^~~~~~~~~~ warning: Array access (from variable 'group_only') results in a null pointer dereference It can happend if function ad_group_extra_members fails (ret != EOK) Reviewed-by: Simo Sorce <simo@redhat.com>
* IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migrationSumit Bose2014-03-121-0/+4
| | | | | | Fixes https://fedorahosted.org/sssd/ticket/2279 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Use the correct domain when processing SELinux rulesJakub Hrozek2014-03-111-10/+15
| | | | | | | | | | We blindly used the user's domain for everything. That wrong in case the user comes from a subdomain. We should use the IPA domain for accessing the SELinux rules and host data and the user domain only for the user. https://fedorahosted.org/sssd/ticket/2270 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Only connect to GC for subdomain usersJakub Hrozek2014-03-111-0/+17
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2251 By connecting to GC for users from both trusted domains and parent domain, we lose the ability to download the shell and homedir if these are used with ID mapping. This patch changes the user lookups only. Changing the logic for all lookups would break cross-domain group memberships, for example. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use GC for AD initgroup requestsSumit Bose2014-03-101-6/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix krb5 changepw when FAST-only preauth methods are used (like OTP)Nathaniel McCallum2014-03-101-34/+6
| | | | | | | | | | | | | | | | | | | | | Before this patch, a different set of options was used when calling krb5_get_init_creds_password() for the changepw principal. Because this set of options did not contain the same FAST settings as the options for normal requests, all authentication would fail when the password of a FAST-only account would expire. The two sets approach was cargo-cult from kinit where multiple requests could be issued using the same options set. However, in the case of krb5_child, only one request (or occasionally a well-defined second request) will be issued. Two option sets are therefore not required. To fix this problem we removed the second option set used for changepw requests. All requests now use a single option set which is modified, if needed, for well-defined subsequent requests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Do not save intermediate data to sysdbJakub Hrozek2014-03-051-28/+28
| | | | | | https://fedorahosted.org/sssd/ticket/2264 Reviewed-by: Sumit Bose <sbose@redhat.com>
* ipa-server-mode: use lower-case user name for home dirSumit Bose2014-03-031-1/+10
| | | | | | | | | | | In older IPA server versions where the AD users where looked up by winbind the user name component of the home directory path was always lower case. This still holds for IPA clients as well. To avoid regression this patch makes the user name component lower case as well. Fixes https://fedorahosted.org/sssd/ticket/2263 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUDO: AD providerSumit Bose2014-03-023-0/+80
| | | | | | | | | | | | | | This patch adds the sudo target to the AD provider. The main reason is to cover different default settings in the LDAP and AD provider. E.g. the default for ldap_id_mapping is True in the AD provider and False in the LDAP provider. If ldap_id_mapping was not set explicitly in the config file both components worked with different setting. Fixes https://fedorahosted.org/sssd/ticket/2256 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove unused structures.Lukas Slebodnik2014-02-261-5/+0
| | | | | | | | | | Reported by: cppcheck 'struct py_sss_transaction', 'struct resolve_get_domain_stat', 'struct sync_op_res' were defined in implementation modules, but they were not used anywhere. Reviewed-by: Michal Žídek <mzidek@redhat.com>
* KRB5: Fix condition for empty stringLukas Slebodnik2014-02-261-1/+1
| | | | | | | | | | | | Reported by: cppcheck Finding the same expression on both sides of an operator || is suspicious and might indicate a cut and paste or logic error. Resolves: https://fedorahosted.org/sssd/ticket/2258 Reviewed-by: Michal Žídek <mzidek@redhat.com>
* DP: Provide separate dp_copy_defaults functionJakub Hrozek2014-02-263-21/+42
| | | | | | https://fedorahosted.org/sssd/ticket/2257 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* OPTS: Allow using defaults for blobsJakub Hrozek2014-02-261-0/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: check ranges for collisions before saving themSumit Bose2014-02-261-20/+64
| | | | | | Fixes https://fedorahosted.org/sssd/ticket/2253 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: refactor idmap code and add testSumit Bose2014-02-262-147/+108
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Setup periodic task only once.Lukas Slebodnik2014-02-261-13/+41
| | | | | | | | | | | | | | If id provider is {ipa, ad} periodic task will be stared in sssm_{ipa,ad}_init If you enable enumeration and use different providers for id and sudo(autofs) then another periodic task will be scheduled. This can cause weird behaviour (e.g. missing members of group) Perodic tasks will be started only by id_provider. Resolves: https://fedorahosted.org/sssd/ticket/2153 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix DEBUG message formattingJakub Hrozek2014-02-252-2/+2
|
* sbus: Use constants to make dbus callsStef Walter2014-02-246-25/+14
| | | | | | | | | | | This allows us to remove duplicated information, and have the compiler check that when an method name is changed or removed the callers are updated. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sbus: Generate constants from interface definitionsStef Walter2014-02-241-0/+21
| | | | | | | | | | | | | | This is not strictly necessary, but avoids duplicating data in mulitple places, and makes the interface definitions benefit dbus callers (a little). After applying this commit you may need to 'make clean' as the codegen has changed. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sbus: Rework sbus to use interface metadata and vtablesStef Walter2014-02-247-34/+221
| | | | | | | | | | | | | | | | | | | | Previous commits added support for interface metadata and handler vtables. This commit ports sbus_dbus_connection to use them. Port the internal uses of dbus to use the new scheme in a very minimal way. Further cleanup is possible here. This commit provides basic definitions of the internal dbus interfaces. The interfaces aren't fully defined, as the handlers will continue to unpack manually, and often overload DBus methods with different arguments (which is rather unorthodox, but not the end of the world). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* nss: Stop using one DBus interface with totally different methodsStef Walter2014-02-242-1/+2
| | | | | | | | | | | | | | | This is an incorrect use of DBus, where we use a single interface name with completely different sets of methods. Easily fixed. Once the vtable stuff is in use then this would be automatically detected and fail to build. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* IPA: Don't fail if apply_subdomain_homedir returns ENOENTJakub Hrozek2014-02-201-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Don't call tevent_req_post outside _sendJakub Hrozek2014-02-201-1/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad_account_can_shortcut(): return bool instead of errnoPavel Březina2014-02-191-29/+11
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2210 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* make make_realm_upper_case() staticPavel Březina2014-02-183-20/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap: move domain related content from ldap_common.c to sdap_domain.cPavel Březina2014-02-182-176/+197
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap: move options related content from ldap_common.c to ldap_options.cPavel Březina2014-02-182-764/+787
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: move sdap_get_id_specific_filter() to sdap_utils.cPavel Březina2014-02-182-20/+20
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: move non async functions from sdap_async_connection.c to sdap_utils.cPavel Březina2014-02-182-18/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: move non async functions from sdap_async.c to sdap_utils.cPavel Březina2014-02-182-118/+142
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: default krb5_fast_principal to host/$client@$realmPavel Březina2014-02-171-3/+5
| | | | | | | | If krb5_fast_principal is not set in sssd.conf it was set to host/$client, KRB5 default realm was used which doesn't have to be the same as realm used for IPA, thus authentication failed when using FAST. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: Default to krb5_use_fast=tryJakub Hrozek2014-02-132-1/+28
| | | | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* Remove DEBUG macro support for old debug levelsNikolai Kondrashov2014-02-122-2/+2
| | | | | | | | | | | | | | Remove support for specifying old debug levels to the DEBUG macro: * remove debug_get_level function which was used for conversion, * remove debug_get_level tests, * remove mentions of old/new levels from DEBUG and DEBUG_IS_SET macro descriptions, * rename "newlevel" argument of debug_fn to just "level". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-1254-1350/+1843
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-12102-4618/+4618
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Handle errors from sdap_id_op properly in enum codeJakub Hrozek2014-02-121-1/+41
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Remove dead codeJakub Hrozek2014-02-121-8/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Only download domains that are set to enumerateJakub Hrozek2014-02-121-1/+5
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Detect the presence of POSIX attributesJakub Hrozek2014-02-128-15/+502
| | | | | | | | | | | | | | | | | | | When the schema is set to AD and ID mapping is not used, there is a one-time check ran when searching for users to detect the presence of POSIX attributes in LDAP. If this check fails, the search fails as if no entry was found and returns a special error code. The sdap_server_opts structure is filled every time a client connects to a server so the posix check boolean is reset to false again on connecting to the server. It might be better to move the check to where the rootDSE is retrieved, but the check depends on several features that are not known to the code that retrieves the rootDSE (or the connection code for example) such as what the attribute mappings are or the authentication method that should be used. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: support for subdomain_homedirPavel Reichl2014-02-051-0/+190
| | | | | | | Homedir is defaultly set accordingly to subdomain_homedir for users from AD. Resolves: https://fedorahosted.org/sssd/ticket/2169
* dyndns: Update PTR records separatelyNikolai Kondrashov2014-02-011-3/+6
| | | | | | | | | | Generate nsupdate input for sending PTR record update messages separately instead of together in nsupdate_msg_add_ptr. This fixes updates with addresses from different networks (DNS zones), as nsupdate doesn't support such updates in a single message. Fixes https://fedorahosted.org/sssd/ticket/2179
* AD: Remove unused memory contextsLukas Slebodnik2014-02-012-12/+10
| | | | | Memory context memctx was unused in functions _ad_servers_init sdap_ad_tokengroups_update_members
* LDAP: require attribute groupType for AD groupsLukas Slebodnik2014-01-291-1/+1
| | | | | | | | | Commit 8280c5213094 introduced filtering local groups for trusted/sub domains, but attribute groupType was not available with configuration id_provide ldap and ldap_schema ad. Resolves: https://fedorahosted.org/sssd/ticket/2172
* LDAP: store group if subdomain cannot be found by sidLukas Slebodnik2014-01-291-4/+6
| | | | | | | | | Domain needn't contain sid if id_provider is ldap. With enabled id mapping, group couldn't be stored, because domain couldn't be found by sid. Resolves: https://fedorahosted.org/sssd/ticket/2172
generated by cgit (git 2.34.1) at 2025-09-30 14:29:07 +0000