DP: Switch to new interface Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

Rename dp_backend.h to backend.h Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: assume zero if usn is unknown When we switched to be_ptaks full_refresh_done has become obsolete since timing is handled in a better way. In case of unknown USN we assume zero which allows us to disable full refresh completely in configuration. Reviewed-by: Sumit Bose <sbose@redhat.com>

SUDO: make sudo sysdb interface more reusable Reviewed-by: Sumit Bose <sbose@redhat.com>

SUDO: make sdap_sudo_handler static Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: remove finalizer It is not used anywhere anyway. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: obtain host information when going online Resolves: https://fedorahosted.org/sssd/ticket/2672 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: fix potential memory leak in sdap_sudo_init Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: fix tevent style Rearrage and rename functions in sdap_async_sudo.c to obey tevent style and improve readability. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: simplify error handling This patch removes state->error and uses only ret instead since state->error was only duplication anyway. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: move offline check to handler We let sdap_id_op decide if we are offline or not here but we should not get to this code since ptask is disabled and we will not get through sudo handler if offline. This simplyfies the code and make it more similar to other providers. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: move refreshes from sdap_sudo.c to sdap_sudo_refresh.c sdap_sudo.c will contain only initialization and handlers. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SUDO: convert periodical refreshes to be_ptask This removes old sudo timer and simplyfies code a lot. It also allows to manage offline/online state. - Full and smart refresh are disabled when offline. - Full refresh is run immediately when sssd is back online. - Smart refresh is scheduled normally when sssd is back online. Resolves: https://fedorahosted.org/sssd/ticket/1943 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sudo: remove unused param. in ldap_get_sudo_options Remove unused talloc memory context. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sudo: replace asterisk with escape sequence in host filter Resolves: https://fedorahosted.org/sssd/ticket/2377 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Make DEBUG macro invocations variadic Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

SYSDB: Drop the sysdb_ctx parameter from the sysdb_sudo.c module

Fix formating of variables with type: time_t

sudo: continue if we are unable to resolve fqdn https://fedorahosted.org/sssd/ticket/2043

LDAP: sdap_id_ctx might contain several connections With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.

Add be_req_get_data() helper funciton. In preparation for making struct be_req opaque.

Add be_req_get_be_ctx() helper. In preparation for making be_req opaque

Remove sysdb as a be context structure member The sysdb context is already available through the 'domain' structure.

Add domain arguments to sysdb sudo functions

sudo smart refresh: fix debug message

sudo smart refresh: do not include usn in filter if no valid usn is known https://fedorahosted.org/sssd/ticket/1736 When there are no rules during first refresh, we don't have valid USN value. We use 0 in this case, but it turned out that OpenLDAP takes it as invalid time format (if modifyTimestamp is used instead of USN) and thus returns no records. Now we don't include USN/modifyTimestamp attribute in the filter if such situasion occurs.

LDAP: initialize refresh function handler

Add default section to switch statement switch statements should always have a default section. In this particular case gcc gave a "'send_fn' may be used uninitialized in this function" warning.

sudo: do full refresh when data provider is back online https://fedorahosted.org/sssd/ticket/1689 Add a online callback if the first full refresh fails due to the provider beeing offline so we can perform the refresh as soon as possible.

sudo: schedule another full refresh in short interval if the first fails https://fedorahosted.org/sssd/ticket/1689 If the first full refresh of sudo rules fails because the data provider is offline, we will schedule another one in 2, 4, ... minutes.

check dp error in sdap_sudo_full_refresh_done() https://fedorahosted.org/sssd/ticket/1689

add sdap_sudo_schedule_refresh() Reduces amount of code duplication.

sudo: don't get stuck in rules and smart refresh when offline https://fedorahosted.org/sssd/ticket/1682 The problem was in following code: if (ret != EOK || state->dp_error != DP_ERR_OK || state->error != EOK) { tevent_req_error(req, ret); return; } In situation when data provider error occurs (e.g. when offline), ret == EOK but dp_error != DP_ERR_OK and we take the true branch. This results in calling tevent_req_error(req, EOK). Unfortunately, with EOK tevent_req_error only returns false, but does not trigger callback and this tevent request hangs forever, because no tevent_req_done(req) is called.

SUDO: strdup the input variable https://fedorahosted.org/sssd/ticket/1701

fix -O3 variable may be uninitialized warnings

sudo: store rules with no sudoHost attribute https://fedorahosted.org/sssd/ticket/1640 Normal rules requires that sudoHost attribute is present. But this attribute is not mandatory for a special rule named cn=defaults. This patch modifies filter so that we store even rules that doesn't have sudoHost attribute specified. SUDO will then decide whether it is allowed or not.

sudo refresh: handle errors properly We should test both ret and (dp_error, errno) pair.

sudo: do not fail if usn value is zero but full refresh is completed https://fedorahosted.org/sssd/ticket/1596 In case that LDAP server contains zero sudo rules, the full refresh completes succussfully and stores current USN value (= 0). But then smart refresh will fail because it takes USN=0 as invalid value.

Variable in sdap_sudo_rules_refresh_send could be used, uninitialized.

Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OC It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.

sdap_sudo.c: add missing end of line in few debug messages

Fix uninitialized values https://fedorahosted.org/sssd/ticket/1379

Fix uninitialized variable Coverity #12802

sudo ldap provider: do per-host updates Add host information to LDAP filters.

sudo ldap provider: mark sdap_sudo_setup_periodical_refresh() as static

sudo ldap provider: load host filter configuration on init We need to load host information during provider initialization. Currently it loads only values from configuration files, but it is implemented as an asynchrounous request as it will later try to autodetect these settings (which will need to contact DNS).

sudo ldap provider: pass sudo_ctx instead of id_ctx I had to create a new context structure to store additional information such as ip addresses and hostnames.

sdap_sudo.c: move _recv after _done

sudo ldap provider: modify highest USN in sdap_sudo_rules_refresh_done()

sudo ldap provider: notify responder when an expired rule has been deleted When an expired rule is not present on the server server during specific rule refresh, the provider will notify the sudo responder that it has been deleted. Because there is a high probability that some other rules were deleted from the server as well, we want to remove them from sysdb as soon as possible. Once the responder is notified, it will schedule an out of band full refresh. This is issued by responder, because we already have a mechanism that prohibits creation of similar request (i.e. once the OOB full refresh is scheduled, there won't be another). The notification is done by returning: DP error = DP_ERR_OK, error = ENOENT

sudo ldap provider: return number of downloaded rules in sdap_sudo_refresh_recv()

sudo ldap provider: support periodical smart refresh When SSSD is started, then full refresh is scheduled. The smart refresh is scheduled after this full refresh, if USN (or modifyTimestamp) values are available. If full refresh interval <= smart refresh interval then full refresh will be disabled. If both refresh types are 0 then smart refresh interval is set to default value.

sudo ldap provider: add periodical smart refresh API

sudo ldap provider: add smart refresh API

sudo ldap provider: remember highest usn after full refresh

sudo ldap provider: add sdap_sudo_set_usn()

sudo ldap provider: find highest USN

sudo ldap provider: support periodical full refresh

sudo provider: remove old timer

sudo ldap provider: add support for on demand refresh of specific rules

sudo ldap provider: provide API for refresh of specific rules

sudo ldap provider: add support for on demand full refresh

sudo ldap provider: provide API for full refresh

sudo ldap provider: give sdap_sudo_refresh_send() search and purge filters

sudo ldap provider: move async routines to sdap_async_sudo.c

Add support for filtering atributes This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.

LDAP: Add attr_count return value to build_attrs_from_map() This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.

LDAP: Only use paging control on requests for multiple entries The paging control can cause issues on servers that put limits on how many paging controls can be active at one time (on some servers, it is limited to one per connection). We need to reduce our usage so that we only activate the paging control when making a request that may return an arbitrary number of results. https://fedorahosted.org/sssd/ticket/1202 phase one

Redesign purging of the sudo cache https://fedorahosted.org/sssd/ticket/1173

Do not call sudo functions if built without-sudo

Move BUILD_SUDO outside the generic LDAP source files Avoid #ifdefs in the general part of the code

LDAP: Do not fail if RootDSE check cannot determine search bases https://fedorahosted.org/sssd/ticket/1152

SUDO Integration - prepare data provider for new responder commands https://fedorahosted.org/sssd/ticket/1143

SUDO Integration - wrap data provider with tevent_req https://fedorahosted.org/sssd/ticket/1110

SUDO Integration review issues

SUDO Integration - fixed memory leak in sdap_sudo_handler()

SUDO Integration - be_sudo_req removed from sudo_ctx

SUDO integration - LDAP provider