summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
...
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Suppress 'git diff' noiseMichal Zidek2014-09-081-159/+159
| | | | | | | | | | | | This patch suppresses the 'git diff' noise after ifp_iface_generated.c is generated. It simply changes the file to the same form it is being automatically generated so that 'git diff' only shows changes in the code and not the differently generated ifp_iface_generated.c file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-051-1/+2
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-013-23/+167
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-013-10/+12
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
* PAM: remove ldb_result member from pam_auth_req contextSumit Bose2014-09-012-6/+6
| | | | | This member was used only in a single call where a local variable suits better.
* PAM: extract checks from parsing routinesSumit Bose2014-09-011-34/+18
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* SUDO: Use the override_space optionJakub Hrozek2014-08-132-2/+8
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 With this path, a user whose name is "space user" would match a sudo rule while using the override_default_space option. Please note that the option is only a client-side override, so the sudoUser attribute must contain the space in order to match the original name. In other words, when substituting space ( ) for underscore (_), this attribute would match: sudoUser: space user this would not: sudoUser: space_user Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Use the override_space optionJakub Hrozek2014-08-131-2/+51
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 The input of the InfoPipe responder substitutes the configured character for space and the GetUserAttrs and GetUserGroups functions substitute space for the configured character in their output. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Use the override_space optionJakub Hrozek2014-08-131-0/+8
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 When using the override_default_space option, this patch allows to log in using both the original name (space user) as well as the normalized name (space_user). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Make the space override responder-agnosticJakub Hrozek2014-08-135-13/+34
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 In order to make the override_space option usable by other responders, we need to move the override_space option to the generic responder structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Only replace space with the specified substitutionJakub Hrozek2014-08-133-24/+19
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 - make sss_replace_whitespaces only replace space (' ') not any whitespace - make sss_replace_whitespaces only replace a single char, not the whole string - rename CONFDB_NSS_OVERRIDE_DEFAULT_WHITESPACE to CONFDB_NSS_OVERRIDE_DEFAULT_SPACE - rename the override_default_whitespace option to override_space - rename sss_replace_whitespaces() to sss_replace_space() - rename sss_reverse_replace_whitespaces() to sss_reverse_replace_space() - rename nctx->override_default_wsp_str to nctx->override_space - make the return value of sss_replace_space non-const to avoid freeing the result without compilation warnings Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Ignore default_domain for netgroupsJakub Hrozek2014-08-121-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2400 Netgroups often have members that will not process correctly when we require a fully-qualified name. This patch simply ignores the default_domain setting for netgroup lookups - we ignore FQDN only domains for netgroup lookups since 1933ff17513da1d979dd22776a03478341ef5e6b anyway. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix lookups with fully-qualified namesJakub Hrozek2014-08-111-2/+2
| | | | | | | | | | | | | The Data Provider lookup code user the original input string as the lookup key instead of the parsed name component. For example, for an input joe@mydomain, the backend would have searched for: (&(cn=joe@mydomain)(objectclass=user)) This patch fixes the lookup to use the parsed name. https://fedorahosted.org/sssd/ticket/2402 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* case_sensitivity = preservingMichal Zidek2014-07-291-2/+2
| | | | | | | | | | | If case_sensitivity is set to 'preserving', getXXnam returns name attribute in the same format as stored in LDAP. Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Replace spaces with specified string in names.Lukas Slebodnik2014-07-283-1/+67
| | | | | | | | | | | | This patch add possibility to replace whitespace in user and group names with a specified string. With string "-", sssd will return the same result as winbind enabled option "winbind normalize names" Resolves: https://fedorahosted.org/sssd/ticket/1854 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* sudo: use dbus array for rules refreshPavel Březina2014-07-241-1/+15
| | | | | | | | | | D-Bus only supports 255 signatures which caused a segmentation fault when sudo responder tried to refresh more rules at once. Resolves: https://fedorahosted.org/sssd/ticket/2387 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-151-0/+1
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: touch config when changing debug level temporarilyPavel Březina2014-07-091-0/+13
| | | | | | | If we want the debug level to switch back to the value from configuration file we need to touch sssd.conf so it is reloaded. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* BUILD: Add the DBus service activationJakub Hrozek2014-07-081-0/+4
| | | | | | | | The system bus has the ability to start services on demant. This patch adds the sysbus service activation file that, currently, only calls the sss_signal tool to signal the monitor. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Provide a SBUS method to reconnect to sysbusJakub Hrozek2014-07-087-1/+44
| | | | | | | | | Introduces a new method implemented only by the IFP responder. When this method is received, the responder attempts to reconnect to the system bus, if not connected already. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Return a specific value on failure connecting to the system busJakub Hrozek2014-07-081-2/+6
| | | | | | | | We need to treat the failure to connect to the system bus as non-fatal. In this commit, we introduce a special error code and only print a DEBUG message when this error code is returned from the startup function. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix DEBUG messagesJakub Hrozek2014-07-081-7/+9
| | | | | | | The DEBUG messages in the IFP responder predated Nikolai's mass-patches and were not converted correctly. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sudo: return after tevent_req_errorPavel Reichl2014-06-271-0/+1
| | | | | | Don't call tevent_req_done after tevent_req_error (for the same request). Reviewed-by: Sumit Bose <sbose@redhat.com>
* NSS: lookup_netgr_step don't access result on ENOENTPavel Reichl2014-06-251-13/+11
| | | | | | | Don't access result if return value is not EOK. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: minor code style improvementsPavel Reichl2014-06-191-7/+9
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: fix memory leak in sysdb_getnetgrPavel Reichl2014-06-191-10/+19
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: sysdb_getnetgr refactorPavel Reichl2014-06-191-20/+46
| | | | | | Move functionality for creating cache dummies into separate function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: sysdb_getnetgr check return value firstPavel Reichl2014-06-191-5/+7
| | | | | | Output parameter was accessed before return value was checked. Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-024-2/+17
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-022-13/+27
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* IFP: Implement SSSD componentsPavel Březina2014-05-287-1/+1604
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Implement domain gettersPavel Březina2014-05-286-0/+859
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Add ListDomains and FindDomainByNameJakub Hrozek2014-05-286-0/+342
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SBUS: Implement org.freedesktop.DBus.Properties.GetAll for primitive typesJakub Hrozek2014-05-271-1/+28
| | | | | | | | | | | | This patch implements the GetAll method of the org.freedesktop.DBus.Properties interface by iterating over the available getters and putting all the results into a single getter. The patch includes a unit test that exercies all currently supported array types. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Support multiple interfaces on sysbusJakub Hrozek2014-05-231-18/+29
| | | | | | | | Instead of passing just one interface with the functions, we need to support multiple interfaces for the InfoPipe and export them all on the sysbus. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Allow Set, Get and GetAll from DBus.PropertiesJakub Hrozek2014-05-221-0/+10
| | | | | | | | | | | | The InfoPipe will support all three of: DBus.Properties.Get DBus.Properties.GetAll DBus.Properties.Set Hence it must allow these calls to be received. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add a utility function to reply with an object pathPavel Březina2014-05-222-0/+48
| | | | | Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add utility functions to escape and unescape object pathsJakub Hrozek2014-05-222-1/+134
| | | | | | | | | | | | D-Bus spec says: Each element must only contain the ASCII characters "[A-Z][a-z][0-9]_" This patch adds two utility functions to escape raw input into format suitable for DBus and conversely transform escaped paths back into raw paths. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove unused parameter from ifp_user_get_groups_replyLukas Slebodnik2014-05-201-4/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove unused parameter from ifp_user_get_attr_handle_replyLukas Slebodnik2014-05-201-4/+4
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Add a GetGroupsList methodJakub Hrozek2014-05-146-14/+225
| | | | | | | | | | | | | This patch adds a new method on the bus with the following synopsis: <method name="GetUserGroups"> <arg name="user" type="s" direction="in" /> <arg name="values" type="as" direction="out"/> </method> Its purpose is to return names of groups the user is a member of as a list of strings. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Per-attribute ACL for usersJakub Hrozek2014-05-134-2/+194
| | | | | | | | | | | Introduces a new option called user_attributes that allows to specify which user attributes are allowed to be queried from the IFP responder. By default only the default POSIX set is allowed, this option allows to either add other attributes (+attrname) or remove them from the default set (-attrname). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add GetUserAttrs callJakub Hrozek2014-05-136-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a DBus method that allows the caller to retrieve attributes of a user. The synopsis of the call is as follows: <method name="GetUserAttr"> <arg type="s" name="user" direction="in"/> <arg type="as" name="attr" direction="in"/> <arg type="a{sv}" name="values" direction="out"/> </method> The return value is an array (one attribute per array member) of dictionaries. The key of the dictionary is the attribute name, the value is a variant containing the attribute values as strings. If an attribute does not exist or is not permitted to be read, no error is returned. If the users does not exist, the method returns an error. In future patches this function will be marked as obsolete in favor of object-oriented approach. ifp_user_get_attr_unpack_msg is a separate function to allow extending it in a later patch. The function to check the cache validity duplicates quite a bit of code with the NSS responder. The refactoring would be nice to get done along with #843. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Initialize negative cache timeoutJakub Hrozek2014-05-132-0/+17
| | | | | | | | | | | | | | In order to avoid hitting the back end with repetitive requests, the InfoPipe responder needs a negative cache, too. This patch follows the convention set by other responders, where the negative cache timeouts are read from the [nss] section. This is not ideal, however, and ticket #2318 tracks moving the configuration to the [ifp] section primarily. The timeout is also a separate parameter in the NSS context. We should consider moving it to the negcache context instead (#2317). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: use a list of allowed_uids for authenticationJakub Hrozek2014-05-134-1/+75
| | | | | | | | Similar to the PAC responder, the InfoPipe uses a list of UIDs that are allowed to communicate with the IFP responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Add utility functionsJakub Hrozek2014-05-132-0/+149
| | | | | | | | | | | | | Adds a number of utility functions, most importanly ifp_req_create(). The ifp_req is a structure that will be passed along with the ifp request and would provide easy access to both the sbus_request data and per-responder data, like the ifp_ctx. Also includes a utility function to split a path prefix from a full path and add a ldb_element into a dictionary. These will be reused later. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add SBUS_CONN_TYPE_SYSBUSJakub Hrozek2014-05-131-1/+1
| | | | | | | | | We need to retrieve caller IDs for each call from the system bus. This commit adds a new SBUS connection type that identifies system bus connection. The connection is used in the IFP provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* mmap: Get errno when unlink failsMichal Zidek2014-04-251-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDERS: Add a new request sss_parse_inp_sendJakub Hrozek2014-04-222-0/+128
| | | | | | | | | The responders were copying code to parse input and on encountering an uknown domain, send the discover subdomain request. This patch adds a reusable request that can always be called in responders and in case the name can be parsed, just shortcut. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 11:46:52 +0000