summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSumit Bose <sbose@redhat.com>2012-11-13 21:21:38 +0100
committerJakub Hrozek <jhrozek@redhat.com>2012-11-14 10:42:34 +0100
commit778491bebee536a196afc29b0d9953843a5374b2 (patch)
tree947d73e6623bad45ac9710753c8a2037b45c24a5
parent032d0980dfe5a27a5954f44f9d519e03fc7d1ced (diff)
downloadsssd-778491bebee536a196afc29b0d9953843a5374b2.tar.gz
sssd-778491bebee536a196afc29b0d9953843a5374b2.tar.bz2
sssd-778491bebee536a196afc29b0d9953843a5374b2.zip
Always start PAC responder if IPA ID provider is configured
Since the PAC responder is used during the authentication of users from trusted realms it is started automatically if the IPA ID provider is configured for a domain to simplify the configuration. Fixes https://fedorahosted.org/sssd/ticket/1613
-rw-r--r--src/man/sssd-ipa.5.xml6
-rw-r--r--src/monitor/monitor.c72
-rw-r--r--src/util/util.h6
3 files changed, 84 insertions, 0 deletions
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index db6aecf8..da5a2ffb 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -58,6 +58,12 @@
refer to freeipa.org for more information about HBAC. No configuration
of access provider is required on the client side.
</para>
+ <para>
+ The IPA provider will use the PAC responder if the Kerberos tickets
+ of users from trusted realms contain a PAC. To make configuration
+ easier the PAC responder is started automatically if the IPA ID
+ provider is configured.
+ </para>
</refsect1>
<refsect1 id='file-format'>
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 956efb13..caa15713 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -804,6 +804,71 @@ static int check_local_domain_unique(struct sss_domain_info *domains)
return EOK;
}
+static errno_t add_implicit_services(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx,
+ char ***_services)
+{
+ int ret;
+ char **domain_names;
+ TALLOC_CTX *tmp_ctx;
+ size_t c;
+ char *conf_path;
+ char *id_provider;
+ bool add_pac = false;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_new failed.\n"));
+ return ENOMEM;
+ }
+
+ ret = confdb_get_string_as_list(cdb, tmp_ctx,
+ CONFDB_MONITOR_CONF_ENTRY,
+ CONFDB_MONITOR_ACTIVE_DOMAINS,
+ &domain_names);
+ if (ret == ENOENT) {
+ DEBUG(SSSDBG_OP_FAILURE, ("No domains configured!\n"));
+ goto done;
+ }
+
+ for (c = 0; domain_names[c] != NULL; c++) {
+ conf_path = talloc_asprintf(tmp_ctx, CONFDB_DOMAIN_PATH_TMPL,
+ domain_names[c]);
+ if (conf_path == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_asprintf failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = confdb_get_string(cdb, tmp_ctx, conf_path,
+ CONFDB_DOMAIN_ID_PROVIDER, NULL, &id_provider);
+ if (ret == EOK) {
+ if (strcasecmp(id_provider, "IPA") == 0) {
+ add_pac = true;
+ }
+ } else {
+ DEBUG(SSSDBG_OP_FAILURE, ("Failed to get id_provider for " \
+ "domain [%s], trying next domain.\n",
+ domain_names[c]));
+ }
+ }
+
+ if (BUILD_WITH_PAC_RESPONDER && add_pac &&
+ !string_in_list("pac", *_services, false)) {
+ ret = add_string_to_list(mem_ctx, "pac", _services);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("add_string_to_list failed.\n"));
+ goto done;
+ }
+ }
+
+ ret = EOK;
+
+done:
+ talloc_free(tmp_ctx);
+
+ return ret;
+}
+
static char *check_services(char **services)
{
const char *known_services[] = { "nss", "pam", "sudo", "autofs", "ssh",
@@ -857,6 +922,13 @@ int get_monitor_config(struct mt_ctx *ctx)
return EINVAL;
}
+ ret = add_implicit_services(ctx->cdb, ctx->service_ctx, &ctx->services);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Failed to add implicit configured " \
+ "services. Some functionality might " \
+ "be missing"));
+ }
+
badsrv = check_services(ctx->services);
if (badsrv != NULL) {
DEBUG(0, ("Invalid service %s\n", badsrv));
diff --git a/src/util/util.h b/src/util/util.h
index 56e7e0be..2d63e733 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -588,4 +588,10 @@ errno_t sss_br_lock_file(int fd, size_t start, size_t len,
#endif /* le32toh */
+#ifdef HAVE_PAC_RESPONDER
+#define BUILD_WITH_PAC_RESPONDER true
+#else
+#define BUILD_WITH_PAC_RESPONDER false
+#endif
+
#endif /* __SSSD_UTIL_H__ */