SDAP: Properly handle group id-collision when renaming incomplete groups Resolves: https://pagure.io/SSSD/sssd/issue/2653 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

AD: sdap_get_ad_tokengroups_done() allocate temporary data on state Related to https://pagure.io/SSSD/sssd/issue/3639 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Fix minor spelling mistakes in providers/* Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SDAP: Fix typo in debug message Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb: do not use objectClass for users and groups The majority of the object in the SSSD cache are users and groups. If there are many user and groups in the cache the index objects of the objectclass attributes 'user' and 'group' become large because the must hold references to all objects of those object classes. As a result the management of these index objects becomes costly because they must be parsed and split apart quite often. Additionally they are mostly useless because user and groups are lookup up by more specific attributes in general. Only when enumerating all user or groups this kind of index might be useful. There are two way of removing this kind of index from the user and group objects. Either by removing objectClass from the list of indexes and add a new attribute to all other type of object we want and index for. Or by replacing objectClass with a different attribute for the user and group objects. After some testing I think the latter one is the more reliable one and implemented it in this patch. Related to https://pagure.io/SSSD/sssd/issue/3503 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP/AD: Do not fail in case rfc2307bis_nested_groups_recv() returns ENOENT Commit 25699846 introduced a regression seen when an initgroup lookup is done and there's no nested groups involved. In this scenario the whole lookup fails due to an ENOENT returned by rfc2307bis_nested_groups_recv(), which leads to the user removal from sysdb causing some authentication issues. Resolves: https://pagure.io/SSSD/sssd/issue/3331 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>

LDAP: Remove unused parameter attr_type from groups_get_send Reviewed-by: Michal Židek <mzidek@redhat.com>

LDAP/AD: resolve domain local groups for remote users If a user from a trusted domain in the same forest is a direct or indirect member of domain local groups from the local domain those memberships must be resolved as well. Since those domain local groups are not valid in the trusted domain a DC from the trusted domain which is used to lookup the user data is not aware of them. As a consequence those memberships must be resolved against a local DC in a second step. Resolves https://fedorahosted.org/sssd/ticket/3206 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: Store SID members during AD initgroups with a qualified name This is to be consistent with how we name groups normally. We rename the groupnames when resolving the groups by ID anyway, but if we fail to do so, at least be consistent. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

util: make concatenate_string_array() reusable Reviewed-by: Pavel Březina <pbrezina@redhat.com>

LDAP: refactor sdap_ad_tokengroups_initgr_mapping_done() The group-processing is moved out to make it reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: make some AD specific calls public Make sdap_ad_tokengroups_get_posix_members() and sdap_ad_resolve_sids_send() reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: rename sdap_get_id_specific_filter More generic name is used now since it is not used only for id filters. Probably all references will be deleted when the code uses sdap_search_in_bases istead of custom search base iterators. Reviewed-by: Sumit Bose <sbose@redhat.com>

Fix minor typos Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

Download complete groups if ignore_group_members is set with tokengroups Resolves: https://fedorahosted.org/sssd/ticket/2644 When tokenGroups are enabled, we save groups using their SID as the RDN attribute during initgroups() and later, if the groups is requested and saved again with the full name, remove the original and save the new group entry. Saving the new group entry would break if ignore_group_members is also set, because the new group entry would lack the "member" attribute, so the member/memberof links between the new group and the user entry wouldn't be established again. This patch changes the initgroups processing so that the full group object is fetched when initgroups is enabled but together with ignore_group_members. This solution imposes some performance impact, because instead of one search for tokenGroups we also need to resolve the groups. The more systematic solution would be to get rid of removing the group entry as described in https://fedorahosted.org/sssd/ticket/2656 To reproduce the bug, set: ignore_group_members = True with a backend that uses: id_provider = ad Then run: $ id aduser@ad_domain.com $ id aduser@ad_domain.com Reviewed-by: Sumit Bose <sbose@redhat.com>

LDAP/AD: do not resolve group members during tokenGroups request During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP: Add UUID when saving incomplete groups Related to: https://fedorahosted.org/sssd/ticket/2571 Reviewed-by: Sumit Bose <sbose@redhat.com>

SDAP: Fix warning Value stored to is never read If function sdap_idmap_sid_to_unix return error code ENOTSUP then error message will be printed: "Skipping buit-in object" Processing of sids will continue an variable ret will be overridden with return code from function sdap_idmap_sid_to_unix, therefore storing EOK to variable is useless. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Use the alternative objectclass in group maps. Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

AD: process non-posix nested groups using tokenGroups When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>

SDAP: Update groups for user just once. The function sdap_ad_tokengroups_update_members finds the differences between list of groups from sysdb and list of groups from LDAP (input argument). For each new group, connections are created between user and group. The other connections are removed. The problem was that in some cases function sdap_ad_tokengroups_update_members was called twice (sdap_ad_tokengroups_initgr_posix_tg_done and sdap_ad_tokengroups_initgr_posix_sids_done). The first call created connection between user and groups resolved from tokengroups and the second call update groups from missing SIDs, but previously created connections were removed. The worst case was when there weren't any missing groups. This behaviour caused missing groups in some cases (for users in child ad domain) This patch join array of groups obtained from token group and array of groups obtained from missing SIDs. The function sdap_ad_tokengroups_update_members is called just once with single array. Resolves: https://fedorahosted.org/sssd/ticket/2407 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: Use different talloc_context for array of names It will be easier to steal whole array to another talloc context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: Immediately finish request for empty array If array of sids is empty we needn't try to resolve them and we can immediately finish request in function sdap_ad_resolve_sids_send This patch is just a small optimisation. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

ad initgroups: continue if resolved SID is still missing https://fedorahosted.org/sssd/ticket/2389 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

ad: update membership after SIDs are resolved Resolves: https://fedorahosted.org/sssd/ticket/2385 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

ad: comment ENOENT when id mapping is disabled Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SDAP: Continue resolving SID even if some fail Resolving groups obtained via Token-Groups in case of disabled ID mapping may lead to failure as non-posix groups are not resolved. This patch amends sdap_ad_resolve_sids_done() not to abruptly finish request if ENOENT is returned. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP: tokengroups do not work with id_provider=ldap With plain LDAP provider we already have a sdap_handle, so it should be possible that in the case where sdom->pvt == NULL sdap_id_op_connect_send() can be skipped and sdap_get_ad_tokengroups_send() can be already send with the sdap_handle passed to sdap_ad_tokengroups_initgr_mapping_send(). So we should only fail if sdom->pvt == NULL and sh == NULL. if find_subdomain_by_sid() failed we can check if there is only one domain in the domain list (state->domain) and in this case continue with this domain since the LDAP provider does not know about sub-domains and hence can only have one configured domain. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Update DEBUG* invocations to use new levels Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

Make DEBUG macro invocations variadic Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

AD: Remove unused memory contexts Memory context memctx was unused in functions _ad_servers_init sdap_ad_tokengroups_update_members

LDAP: Add a new error code for malformed access control filter https://fedorahosted.org/sssd/ticket/2164 The patch adds a new error code and special cases the new code so that access is denied and a nicer log message is shown.

AD: cross-domain membership fix A recent patch directed all call related to group membership lookups to the AD LDAP port to fix an issue related to missing group memberships in the Global Catalog. As a side-effect it broke cross-domain group-memberships because those cannot be resolved by the connection to the LDAP port. The patch tires to fix this by restoring the original behaviour in the top-level lookup calls in the AD provider and switching to the LDAP port only for the LDAP request which is expected to return the full group membership. Additionally this patch contains a related fix for the tokenGroups with Posix attributes patch. The original connection, typically a Global Catalog connection in the AD case is passed down the stack so that the group lookup after the tokenGroups request can run over the same connection.

AD: filter domain local groups for trusted/sub domains In Active Directory groups with a domain local scope should only be used inside of the specific domain. Since SSSD read the group memberships from LDAP server of the user's domain the domain local groups are included in the LDAP result. Those groups should be filtered out if the domain is a sub/trusted domain, i.e. is not the domain the client running SSSD is joined to. The groups will still be in the cache but marked as non-POSIX groups and no GID will be assigned. Fixes https://fedorahosted.org/sssd/ticket/2178

ad: use tokengroups even when id mapping is disabled https://fedorahosted.org/sssd/ticket/1568

ad: refactor tokengroups initgroups sdap_get_ad_tokengroups_initgroups is split into more parts so it can be reused later.

SYSDB: Drop redundant sysdb_ctx parameter from sysdb.c

SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)

SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)

Initialize sid_str to NULL to avoid freeing random data If any function before failed, sss_idmap_free_sid() might have been called with random data.

free idmapped SIDs correctly Resolves: https://fedorahosted.org/sssd/ticket/2133

ad: store group in correct tree on initgroups via tokenGroups If tokenGroups contains group from different domain than user's, we stored it under the user's domain tree in sysdb. This patch changes it so we store it under group's domain tree. Resolves: https://fedorahosted.org/sssd/ticket/2066

Fix formating of variables with type: gid_t

Fix formating of variables with type: size_t

sysdb_add_incomplete_group: store SID string is available During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.

LDAP: new SDAP domain structure Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.

Fixing critical format string issues. --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'

Add domain arg to sysdb group member functions

Add domain arguments to sysdb_add_group functions.

Add domain to sysdb_search_group_by_gid() Also remove unused sysdb_search_domgroup_by_gid()

Add domain to sysdb_search_group_by_name() Also remove unused sysdb_search_domgroup_by_name()

Add domain to sysdb_search_user_by_name() Also remove unused sysdb_search_domuser_by_name()

idmap: Silence DEBUG messages when dealing with built-in SIDs. When converting built-in SID to unix GID/UID a confusing debug message about the failed conversion was printed. This patch special cases these built-in objects. https://fedorahosted.org/sssd/ticket/1593

AD: Handle sysdb lookup failure during tokenGroups processing

AD: Optimize initgroups lookups with tokenGroups https://fedorahosted.org/sssd/ticket/1355

LDAP: Add support for AD chain matching extension in initgroups