LDAP: Add support for rhost access control This patch implements verification of pam_rhost against rules stored in LDAP entry of a user. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Remove unnecessary sys/param.h They are mostly required for macros MAX/MIN which were not used in these modules. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

LDAP: The access control filter just needs the plain username The LDAP access control code uses shortnames to construct an LDAP filter. Reviewed-by: Sumit Bose <sbose@redhat.com>

Rename dp_backend.h to backend.h Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

LDAP: Try also the AD access control for IPA users Resolves: https://fedorahosted.org/sssd/ticket/2927 If a user from an AD trusted domain is logging in, we should also check their AD lockout status. This helps cases where the user might have been disabled but is logging in with an SSH public key. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

LDAP: warn about lockout option being deprecated Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP: fix a typo in debug message Reviewed-by: Pavel Březina <pbrezina@redhat.com>

ldap: refactor nds_check_expired to use util func Refactor nds_check_expired() to use utility function sss_utc_to_time_t(). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

TESTS: test expiration Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: fix minor neglect in is_account_locked() It would be better to return explicit error code, although access is still denied and error message printed. Relates: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: Lock out ssh keys when account naturally expires Resolves: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: enable change phase of pw expire policy check Implement new option which does checking password expiration policy in accounting phase. This allows SSSD to issue shadow expiration warning even if alternate authentication method is used. Resolves: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com>

SDAP: log expired accounts at lower severity level Attempts to log into expired accounts were logged as SSSDBG_CRIT_FAILURE which is misleading as no real failures were happening. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

add missing '\n' in debug messages Also reformat debug strings not to exceed 80 columns long lines. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

LDAP: Always free talloc_req On failure, the subreq wasn't freed, which was not a big deal given the parent request would free the subreq anyway, but it's better to follow the usual pattern. Reviewed-by: Simo Sorce <simo@redhat.com>

LDAP: Check return value Reported by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SDAP: account lockout to restrict access via ssh key Be able to configure sssd to honor openldap account lock to restrict access via ssh key. Introduce new ldap_access_order value ('lock') for enabling/disabling this feature. Account is considered locked if pwdAccountLockedTime attribut has value of 000001010000Z. ------------------------------------------------------------------------ Quotation from man slapo-ppolicy: pwdAccountLockedTime This attribute contains the time that the user's account was locked. If the account has been locked, the password may no longer be used to authenticate the user to the directory. If pwdAccountLockedTime is set to 000001010000Z, the user's account has been permanently locked and may only be unlocked by an administrator. Note that account locking only takes effect when the pwdLockout password policy attribute is set to "TRUE". ------------------------------------------------------------------------ Also set default value for sdap_pwdlockout_dn to cn=ppolicy,ou=policies,${search_base} Resolves: https://fedorahosted.org/sssd/ticket/2364 Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: refactor AC offline checks Prepare code for other access control checks. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: don't log error on access denied Don't log error if access is denied in function sdap_access_done(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: refactor sdap_access_filter_done As preparation for ticket #2364 move code from sdap_access_filter_done() into sdap_access_done() to make its reuse possible and thus avoid code duplication. Rename check_next_rule() to sdap_access_check_next_rule(). Update definition order of tevent-using functions by time of execution. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: nitpicks in sdap_access_filter_get_access_done Fixed typo and replaced duplicated string by macro definition. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: refactor sdap_access_filter_send As preparation for ticket #2364 separate code for parsing user basedn to a new function sdap_get_basedn_user_entry(). We actually do not need to call strdup on basedn, instead we can just point to address in user_entry as it's allocated on parent memory context. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: split sdap_access_filter_get_access_done As a preparation for ticket #2364 separate code for storing user bool values into sysdb to a new function sdap_save_user_cache_bool(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Unify usage of function gethostname man gethostanme says: NOTES SUSv2 guarantees that "Host names are limited to 255 bytes". POSIX.1-2001 guarantees that "Host names (not including the terminating null byte) are limited to HOST_NAME_MAX bytes". On Linux, HOST_NAME_MAX is defined with the value 64, which has been the limit since Linux 1.0 (earlier kernels imposed a limit of 8 bytes). Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Don't use macro _XOPEN_SOURCE for function strptime We detect all necessary feature macros in configure script using AC_USE_SYSTEM_EXTENSIONS or AC_GNU_SOURCE. This patch replaces all definitions of macro _XOPEN_SOURCE with header file config.h Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

refactor calls of sss_parse_name sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Update DEBUG* invocations to use new levels Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

Make DEBUG macro invocations variadic Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

LDAP: Add a new error code for malformed access control filter https://fedorahosted.org/sssd/ticket/2164 The patch adds a new error code and special cases the new code so that access is denied and a nicer log message is shown.

responder: Set forest attribute in AD domains Resolves: https://fedorahosted.org/sssd/ticket/2160

SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)

SYSDB: Drop the sysdb_ctx parameter from the sysdb_search module

LDAP: Parse FQDN into name/domain for subdomain users Related: https://fedorahosted.org/sssd/ticket/2082 When a subdomain user logs in, the username the account request receives is a FQDN. This hackish patch parses the FQDN and only uses the name to search the LDAP.

LDAP: Amend sdap_access_check to allow any connection Related: https://fedorahosted.org/sssd/ticket/2082 Also move the check for subdomain to the handler. I think it is the job of the handler to decide which domain the request belongs to, not the request itself.

Fix formating of variables with type: time_t

Fix formating of variables with type defined in stdint.h

Fix formating of variables with type: size_t

Fix formating of variables with type: long

Replace new_subdomain() with find_subdomain_by_name() new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.

LDAP: sdap_id_ctx might contain several connections With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.

Convert sdap_access to new error codes Also simplify sdap_access_send to avoid completely fake _send() routines.

Fixed typo in debug message. C compiler did not complain, because "index" is function defined in header file <string.h>

Add realm info to sss_domain_info

Pass domain not be_req to access check functions

Remove sysdb as a be request structure member The sysdb context is already available through the 'domain' context.

Move ldap provider access functions It was confusing to see the ldap provider own handler mixed with the generic ldap access code used also by the ipa and ad providers. So move the ldap provider handler code in its own file.

Add domain argument to sysdb_set_user_attr()

Add domain argument to sysdb_get_user_attr()

Do not save HBAC rules in subdomain subtree Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the configured domain apply to all users it is sufficient to save them once in the subtree of the configured domain. Since most of the sysdb operations during a HBAC request are related to the HBAC rules and related data this patch does not change the default sysdb context but only create a special context to look up subdomain users.

Accept be_req instead if be_ctx in LDAP access provider

LDAP: Make sdap_access_send/recv public We want to consume this in the IPA provider.

LDAP: Only use paging control on requests for multiple entries The paging control can cause issues on servers that put limits on how many paging controls can be active at one time (on some servers, it is limited to one per connection). We need to reduce our usage so that we only activate the paging control when making a request that may return an arbitrary number of results. https://fedorahosted.org/sssd/ticket/1202 phase one

Cleanup: Remove unused parameters

sysdb refactoring: memory context deleted This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.

sysdb refactoring: deleted domain variables in sysdb API The patch also updates code using modified functions. Tests have also been adjusted.

Add LDAP access control based on NDS attributes

Add host access control support https://fedorahosted.org/sssd/ticket/746

Only print "no matching service rule" when appropriate

Add LDAP expire policy base RHDS/IPA attribute The attribute nsAccountLock is used by RHDS, IPA and other directory servers to indicate that the account is locked.

Add LDAP expire policy based on AD attributes The second bit of userAccountControl is used to determine if the account is enabled or disabled. accountExpires is checked to see if the account is expired.

Add timeout parameter to sdap_get_generic_send()

Add syslog messages to authorized service access check

Add syslog message to shadow access check

Add authorizedService support https://fedorahosted.org/sssd/ticket/670

Pass all PAM data to the LDAP access provider Previously we were only passing the username.

Add new account expired rule to LDAP access provider Two new options are added to the LDAP access provider to allow a broader range of access control rules to be evaluated. 'ldap_access_order' makes it possible to run more than one rule. To keep compatibility with older versions the default is 'filter'. This patch adds a new rule 'expire'. 'ldap_account_expire_policy' specifies which LDAP attribute should be used to determine if an account is expired or not. Currently only 'shadow' is supported which evaluates the ldap_user_shadow_expire attribute.

Sanitize search filters in LDAP provider

Suppress some 'may be used uninitialized' warnings Additionally the handling of errno and the errno_t return value of functions is fixed in krb5_common.c.

Dead assignments cleanup in providers code Dead assignments were deleted. Also prototype of function sdap_access_decide_offline() has been changed, since its return code was never used. Ticket: #586

Use new LDAP connection framework in LDAP access backend.

Allow ldap_access_filter values wrapped in parentheses

Add ldap_access_filter option This option (applicable to access_provider=ldap) allows the admin to set an additional LDAP search filter that must match in order for a user to be granted access to the system. Common examples for this would be limiting access to users by in a particular group, for example: ldap_access_filter = memberOf=cn=access_group,ou=Groups,dc=example,dc=com