summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--Makefile.am2
-rw-r--r--src/config/etc/sssd.api.d/sssd-ipa.conf1
-rw-r--r--src/man/sssd-ipa.5.xml19
-rw-r--r--src/providers/ipa/ipa_common.c26
-rw-r--r--src/providers/ipa/ipa_common.h2
-rw-r--r--src/providers/ipa/ipa_init.c38
-rw-r--r--src/providers/ipa/ipa_opts.h1
-rw-r--r--src/providers/ipa/ipa_subdomains.c319
-rw-r--r--src/providers/ipa/ipa_subdomains.h39
9 files changed, 447 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am
index 303264c5..67149635 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -392,6 +392,7 @@ dist_noinst_HEADERS = \
src/providers/ipa/ipa_selinux_maps.h \
src/providers/ipa/ipa_auth.h \
src/providers/ipa/ipa_dyndns.h \
+ src/providers/ipa/ipa_subdomains.h \
src/providers/ipa/ipa_id.h \
src/providers/ipa/ipa_hostid.h \
src/providers/ipa/ipa_opts.h \
@@ -1192,6 +1193,7 @@ libsss_ipa_la_SOURCES = \
src/providers/ipa/ipa_access.c \
src/providers/ipa/ipa_dyndns.c \
src/providers/ipa/ipa_hosts.c \
+ src/providers/ipa/ipa_subdomains.c \
src/providers/ipa/ipa_hbac_hosts.c \
src/providers/ipa/ipa_hbac_private.h \
src/providers/ipa/ipa_hbac_rules.c \
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index c7c877e7..850b9dbd 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -6,6 +6,7 @@ ipa_dyndns_update = bool, None, false
ipa_dyndns_iface = str, None, false
ipa_hbac_search_base = str, None, false
ipa_host_search_base = str, None, false
+ipa_subdomains_search_base = str, None, false
ldap_uri = str, None, false
ldap_search_base = str, None, false
ldap_schema = str, None, false
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index b5bd2816..9b8a140c 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -196,6 +196,25 @@
</varlistentry>
<varlistentry>
+ <term>ipa_subdomains_search_base (string)</term>
+ <listitem>
+ <para>
+ Optional. Use the given string as search base for
+ trusted domains.
+ </para>
+ <para>
+ See <quote>ldap_search_base</quote> for
+ information about configuring multiple search
+ bases.
+ </para>
+ <para>
+ Default: the value of
+ <emphasis>cn=trusts,%basedn</emphasis>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>krb5_validate (boolean)</term>
<listitem>
<para>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 5d2f7987..225c9786 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -143,6 +143,9 @@ static errno_t ipa_parse_search_base(TALLOC_CTX *mem_ctx,
case IPA_SELINUX_SEARCH_BASE:
class_name = "IPA_SELINUX";
break;
+ case IPA_SUBDOMAINS_SEARCH_BASE:
+ class_name = "IPA_SUBDOMAINS";
+ break;
default:
DEBUG(SSSDBG_CONF_SETTINGS,
("Unknown search base type: [%d]\n", class));
@@ -487,6 +490,29 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
&ipa_opts->id->service_search_bases);
if (ret != EOK) goto done;
+ if (NULL == dp_opt_get_string(ipa_opts->basic,
+ IPA_SUBDOMAINS_SEARCH_BASE)) {
+ value = talloc_asprintf(tmpctx, "cn=trusts,%s", basedn);
+ if (value == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = dp_opt_set_string(ipa_opts->basic, IPA_SUBDOMAINS_SEARCH_BASE, value);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ DEBUG(SSSDBG_CONF_SETTINGS, ("Option %s set to %s\n",
+ ipa_opts->basic[IPA_SUBDOMAINS_SEARCH_BASE].opt_name,
+ dp_opt_get_string(ipa_opts->basic,
+ IPA_SUBDOMAINS_SEARCH_BASE)));
+ }
+ ret = ipa_parse_search_base(ipa_opts, ipa_opts->basic,
+ IPA_SUBDOMAINS_SEARCH_BASE,
+ &ipa_opts->subdomains_search_bases);
+ if (ret != EOK) goto done;
+
ret = sdap_get_map(ipa_opts->id, cdb, conf_path,
ipa_attr_map,
SDAP_AT_GENERAL,
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index d29cf92d..9232260e 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -41,6 +41,7 @@ enum ipa_basic_opt {
IPA_HBAC_SEARCH_BASE,
IPA_HOST_SEARCH_BASE,
IPA_SELINUX_SEARCH_BASE,
+ IPA_SUBDOMAINS_SEARCH_BASE,
IPA_KRB5_REALM,
IPA_HBAC_REFRESH,
IPA_HBAC_DENY_METHOD,
@@ -123,6 +124,7 @@ struct ipa_options {
struct sdap_search_base **host_search_bases;
struct sdap_search_base **hbac_search_bases;
struct sdap_search_base **selinux_search_bases;
+ struct sdap_search_base **subdomains_search_bases;
struct ipa_service *service;
/* id provider */
diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index fca23f34..90acb108 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -37,6 +37,7 @@
#include "providers/ipa/ipa_dyndns.h"
#include "providers/ipa/ipa_session.h"
#include "providers/ldap/sdap_access.h"
+#include "providers/ipa/ipa_subdomains.h"
struct ipa_options *ipa_options = NULL;
@@ -74,6 +75,11 @@ struct bet_ops ipa_hostid_ops = {
};
#endif
+struct bet_ops ipa_subdomains_ops = {
+ .handler = ipa_subdomains_handler,
+ .finalize = NULL
+};
+
int common_ipa_init(struct be_ctx *bectx)
{
const char *ipa_servers;
@@ -513,3 +519,35 @@ int sssm_ipa_autofs_init(struct be_ctx *bectx,
return EOK;
#endif
}
+
+int sssm_ipa_subdomains_init(struct be_ctx *bectx,
+ struct bet_ops **ops,
+ void **pvt_data)
+{
+ int ret;
+ struct ipa_subdomains_ctx *subdomains_ctx;
+ struct ipa_id_ctx *id_ctx;
+
+ subdomains_ctx = talloc_zero(bectx, struct ipa_subdomains_ctx);
+ if (subdomains_ctx == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero failed.\n"));
+ return ENOMEM;
+ }
+
+ ret = sssm_ipa_id_init(bectx, ops, (void **) &id_ctx);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("sssm_ipa_id_init failed.\n"));
+ goto done;
+ }
+ subdomains_ctx->sdap_id_ctx = id_ctx->sdap_id_ctx;
+ subdomains_ctx->search_bases = id_ctx->ipa_options->subdomains_search_bases;
+
+ *ops = &ipa_subdomains_ops;
+ *pvt_data = subdomains_ctx;
+
+done:
+ if (ret != EOK) {
+ talloc_free(subdomains_ctx);
+ }
+ return ret;
+}
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 2cdb8dbb..20f57fca 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -38,6 +38,7 @@ struct dp_option ipa_basic_opts[] = {
{ "ipa_hbac_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING},
{ "ipa_host_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ipa_selinux_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+ { "ipa_subdomains_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING},
{ "ipa_hbac_refresh", DP_OPT_NUMBER, { .number = 5 }, NULL_NUMBER },
{ "ipa_hbac_treat_deny_as", DP_OPT_STRING, { "DENY_ALL" }, NULL_STRING },
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
new file mode 100644
index 00000000..da9785f2
--- /dev/null
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -0,0 +1,319 @@
+/*
+ SSSD
+
+ IPA Subdomains Module
+
+ Authors:
+ Sumit Bose <sbose@redhat.com>
+
+ Copyright (C) 2011 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "providers/ldap/sdap_async.h"
+#include "providers/ipa/ipa_subdomains.h"
+#include "providers/ipa/ipa_common.h"
+
+#define SUBDOMAINS_FILTER "objectclass=ipaNTTrustedDomain"
+#define IPA_CN "cn"
+#define IPA_FLATNAME "ipaNTFlatName"
+#define IPA_SID "ipaNTTrustedDomainSID"
+
+static void ipa_subdomains_reply(struct be_req *be_req, int dp_err, int result)
+{
+ be_req->fn(be_req, dp_err, result, NULL);
+}
+
+static errno_t ipa_subdomains_parse_results(
+ struct be_get_subdomains_req *sd_data,
+ size_t count,
+ struct sysdb_attrs **reply)
+{
+ struct subdomain_info **new_domain_list = NULL;
+ const char *value;
+ size_t c;
+ int ret;
+
+ new_domain_list = talloc_array(sd_data, struct subdomain_info *, count + 1);
+ if (new_domain_list == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_array failed.\n"));
+ return ENOMEM;
+ }
+
+ for (c = 0; c < count; c++) {
+ new_domain_list[c] = talloc_zero(new_domain_list,
+ struct subdomain_info);
+ if (new_domain_list[c] == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_zero failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = sysdb_attrs_get_string(reply[c], IPA_CN, &value);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));
+ goto done;
+ }
+ new_domain_list[c]->name = talloc_strdup(new_domain_list[c], value);
+ if (new_domain_list[c]->name == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = sysdb_attrs_get_string(reply[c], IPA_FLATNAME, &value);
+ if (ret == EOK) {
+ new_domain_list[c]->flat_name = talloc_strdup(new_domain_list[c],
+ value);
+ if (new_domain_list[c]->flat_name == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+ } else if (ret != ENOENT) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));
+ goto done;
+ }
+
+ ret = sysdb_attrs_get_string(reply[c], IPA_SID, &value);
+ if (ret == EOK) {
+ new_domain_list[c]->id = talloc_strdup(new_domain_list[c], value);
+ if (new_domain_list[c]->id == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+ } else if (ret != ENOENT) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));
+ goto done;
+ }
+ }
+ new_domain_list[c] = NULL;
+
+ ret = EOK;
+
+done:
+ if (ret == EOK) {
+ talloc_free(sd_data->domain_list);
+ sd_data->domain_list = new_domain_list;
+ } else {
+ talloc_free(new_domain_list);
+ }
+
+ return ret;
+}
+
+struct ipa_subdomains_req_ctx {
+ struct be_req *be_req;
+ struct ipa_subdomains_ctx *sd_ctx;
+ struct sdap_id_op *sdap_op;
+ struct be_get_subdomains_req *sd_data;
+
+ char *current_filter;
+
+ struct sdap_search_base **search_bases;
+ int search_base_iter;
+
+ size_t reply_count;
+ struct sysdb_attrs **reply;
+};
+
+static void ipa_subdomains_get_conn_done(struct tevent_req *req);
+static errno_t ipa_subdomains_handler_next(struct ipa_subdomains_req_ctx *ctx);
+static void ipa_subdomains_handler_done(struct tevent_req *req);
+
+void ipa_subdomains_handler(struct be_req *be_req)
+{
+ struct tevent_req *req;
+ struct ipa_subdomains_req_ctx *ctx = NULL;
+ int ret;
+
+ ctx = talloc(be_req, struct ipa_subdomains_req_ctx);
+ if (ctx == NULL) {
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ ctx->be_req = be_req;
+ ctx->sd_ctx = talloc_get_type(
+ be_req->be_ctx->bet_info[BET_SUBDOMAINS].pvt_bet_data,
+ struct ipa_subdomains_ctx);
+ ctx->sd_data = talloc_get_type(be_req->req_data,
+ struct be_get_subdomains_req);
+
+ ctx->search_base_iter = 0;
+ ctx->search_bases = ctx->sd_ctx->search_bases;
+ ctx->current_filter = NULL;
+ ctx->reply_count = 0;
+ ctx->reply = NULL;
+
+ ctx->sdap_op = sdap_id_op_create(ctx,
+ ctx->sd_ctx->sdap_id_ctx->conn_cache);
+ if (ctx->sdap_op == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_create failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+
+ req = sdap_id_op_connect_send(ctx->sdap_op, ctx, &ret);
+ if (req == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_connect_send failed: %d(%s).\n",
+ ret, strerror(ret)));
+ goto fail;
+ }
+
+ tevent_req_set_callback(req, ipa_subdomains_get_conn_done, ctx);
+
+ return;
+
+fail:
+ talloc_free(ctx);
+ ipa_subdomains_reply(be_req, DP_ERR_FATAL, ret);
+}
+
+static void ipa_subdomains_get_conn_done(struct tevent_req *req)
+{
+ int ret;
+ int dp_error = DP_ERR_FATAL;
+ struct be_req *be_req;
+ struct ipa_subdomains_req_ctx *ctx = tevent_req_callback_data(req,
+ struct ipa_subdomains_req_ctx);
+ ret = sdap_id_op_connect_recv(req, &dp_error);
+ talloc_zfree(req);
+ if (ret) {
+ if (dp_error == DP_ERR_OFFLINE) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ ("No IPA server is available, cannot get the "
+ "subdomain list while offline\n"));
+
+/* FIXME: return saved results ?? */
+ } else {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Failed to connect to IPA server: [%d](%s)\n",
+ ret, strerror(ret)));
+ }
+
+ goto fail;
+ }
+
+ ret = ipa_subdomains_handler_next(ctx);
+ if (ret != EOK && ret != EAGAIN) {
+ goto fail;
+ }
+
+ return;
+
+fail:
+ be_req = ctx->be_req;
+ talloc_free(ctx);
+ ipa_subdomains_reply(be_req, dp_error, ret);
+}
+
+static errno_t ipa_subdomains_handler_next(struct ipa_subdomains_req_ctx *ctx)
+{
+ struct tevent_req *req;
+ struct sdap_search_base *base;
+ const char *attrs[] = {"cn",
+ "ipaNTFlatName",
+ "ipaNTTrustedDomainSID",
+ NULL};
+
+ base = ctx->search_bases[ctx->search_base_iter];
+ if (base == NULL) {
+ return EOK;
+ }
+
+ talloc_free(ctx->current_filter);
+ ctx->current_filter = sdap_get_id_specific_filter(ctx, SUBDOMAINS_FILTER,
+ base->filter);
+ if (ctx->current_filter == NULL) {
+ return ENOMEM;
+ }
+
+ req = sdap_get_generic_send(ctx, ctx->be_req->be_ctx->ev,
+ ctx->sd_ctx->sdap_id_ctx->opts,
+ sdap_id_op_handle(ctx->sdap_op),
+ base->basedn, base->scope,
+ ctx->current_filter, attrs, NULL, 0,
+ dp_opt_get_int(ctx->sd_ctx->sdap_id_ctx->opts->basic,
+ SDAP_SEARCH_TIMEOUT), false);
+
+ if (req == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send failed.\n"));
+ return ENOMEM;
+ }
+
+ tevent_req_set_callback(req, ipa_subdomains_handler_done, ctx);
+
+ return EAGAIN;
+}
+
+static void ipa_subdomains_handler_done(struct tevent_req *req)
+{
+ int ret;
+ struct be_req *be_req;
+ size_t reply_count;
+ struct sysdb_attrs **reply = NULL;
+ struct ipa_subdomains_req_ctx *ctx = tevent_req_callback_data(req,
+ struct ipa_subdomains_req_ctx);
+
+ be_req = ctx->be_req;
+
+ ret = sdap_get_generic_recv(req, ctx, &reply_count, &reply);
+ talloc_zfree(req);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send request failed.\n"));
+ goto done;
+ }
+
+ if (reply_count) {
+ ctx->reply = talloc_realloc(ctx, ctx->reply, struct sysdb_attrs *,
+ ctx->reply_count + reply_count);
+ if (ctx->reply == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ memcpy(ctx->reply+ctx->reply_count, reply,
+ reply_count * sizeof(struct sysdb_attrs *));
+ ctx->reply_count += reply_count;
+ }
+
+ ctx->search_base_iter++;
+ ret = ipa_subdomains_handler_next(ctx);
+ if (ret == EAGAIN) {
+ return;
+ } else if (ret != EOK) {
+ goto done;
+ }
+
+ ret = ipa_subdomains_parse_results(ctx->sd_data, ctx->reply_count, ctx->reply);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ipa_subdomains_parse_results request failed.\n"));
+ goto done;
+ }
+
+ ret = sysdb_update_subdomains(ctx->sd_ctx->sdap_id_ctx->be->sysdb,
+ ctx->sd_data->domain_list);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_subdomains failed.\n"));
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ talloc_free(ctx);
+ ipa_subdomains_reply(be_req, (ret == EOK ? DP_ERR_OK : DP_ERR_FATAL), ret);
+}
diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
new file mode 100644
index 00000000..be62b152
--- /dev/null
+++ b/src/providers/ipa/ipa_subdomains.h
@@ -0,0 +1,39 @@
+/*
+ SSSD
+
+ IPA Subdomains Module
+
+ Authors:
+ Sumit Bose <sbose@redhat.com>
+
+ Copyright (C) 2011 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _IPA_SUBDOMAINS_H_
+#define _IPA_SUBDOMAINS_H_
+
+#include "providers/dp_backend.h"
+#include "providers/ldap/ldap_common.h"
+
+struct ipa_subdomains_ctx {
+ struct sdap_id_ctx *sdap_id_ctx;
+ struct sdap_search_base **search_bases;
+};
+
+
+void ipa_subdomains_handler(struct be_req *be_req);
+
+#endif /* _IPA_SUBDOMAINS_H_ */