ipa_init.c revision 6ef14c5c9e16c4a660b5029cd2b6220496a36407
/*
SSSD
IPA Provider Initialization functions
Authors:
Simo Sorce <ssorce@redhat.com>
Copyright (C) 2009 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <unistd.h>
#include <fcntl.h>
#include "util/child_common.h"
#include "providers/ipa/ipa_common.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_init_shared.h"
#include "providers/ipa/ipa_auth.h"
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_hostid.h"
#include "providers/ipa/ipa_dyndns.h"
#include "providers/ipa/ipa_selinux.h"
#include "providers/ldap/sdap_access.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ipa/ipa_subdomains.h"
#include "providers/be_dyndns.h"
#include "providers/ipa/ipa_session.h"
#define DNS_SRV_MISCONFIGURATION "SRV discovery is enabled on the IPA " \
"server while using custom dns_discovery_domain. DNS discovery of " \
"trusted AD domain will likely fail. It is recommended not to use " \
"SRV discovery or the dns_discovery_domain option for the IPA " \
"domain while running on the server itself\n"
#define PREAUTH_INDICATOR_ERROR "Failed to create preauth indicator file, " \
"special password prompting might not be available.\n"
struct ipa_init_ctx {
struct ipa_options *options;
struct ipa_id_ctx *id_ctx;
struct ipa_auth_ctx *auth_ctx;
};
{
struct ipa_init_ctx *ipa_init_ctx;
return NULL;
}
}
static bool srv_in_server_list(const char *servers)
{
int ret = 0;
bool has_srv = false;
if (!tmp_ctx) {
return false;
}
/* split server parm into a list */
goto done;
}
for (int i = 0; list[i]; i++) {
if (has_srv == true) {
break;
}
}
done:
return has_srv;
}
struct ipa_options **_ipa_options)
{
struct ipa_options *ipa_options;
const char *ipa_servers;
const char *ipa_backup_servers;
return ret;
}
&ipa_options->service);
return ret;
}
return EOK;
}
struct ipa_options *ipa_options,
struct ipa_id_ctx **_ipa_id_ctx)
{
if (ipa_id_ctx == NULL) {
goto done;
}
if (sdap_id_ctx == NULL) {
goto done;
}
&sdap_id_ctx->opts);
goto done;
}
done:
}
return ret;
}
struct ipa_options *ipa_options)
{
bool enabled;
return ret;
}
if (!enabled) {
return EOK;
}
/* Perform automatic DNS updates when the IP address changes.
* Register a callback for successful LDAP reconnections.
* This is the easiest way to identify that we have gone online.
*/
"Dynamic DNS updates are on. Checking for nsupdate...\n");
ret = be_nsupdate_check();
"dynamic DNS updates will not work\n");
return EOK;
}
"Failure setting up automatic DNS update\n");
/* We will continue without DNS updating */
}
return EOK;
}
struct ipa_options *ipa_options,
struct ipa_id_ctx *ipa_id_ctx)
{
const char *ipa_servers;
const char *dnsdomain;
const char *hostname;
bool sites_enabled;
return ENOMEM;
}
return ret;
}
"SRV resolution or IPA site discovery to locate IPA servers. "
"On IPA server itself, it is recommended that SSSD is "
"configured to only connect to the IPA server it's running at. ");
/* If SRV discovery is enabled on the server and
* dns_discovery_domain is set explicitly, then
* the current failover code would use the dns_discovery
* domain to try to find AD servers and fail.
*/
}
return ret;
}
return EOK;
} else {
/* In server mode we need to ignore the dns_discovery_domain if set
* and only discover servers based on AD domains. */
NULL);
"dns_discovery_domain, trusted AD domains discovery "
"might fail. Please remove dns_discovery_domain "
"from the config file and restart the SSSD\n");
} else {
"will be ignored in ipa_server_mode\n");
}
}
return EOK;
}
struct ipa_options *ipa_options,
struct ipa_id_ctx *ipa_id_ctx)
{
struct ipa_srv_plugin_ctx *srv_ctx;
const char *ipa_domain;
const char *hostname;
bool sites_enabled;
&ipa_id_ctx->view_name);
"Will do online lookup later.\n");
return ret;
}
if (sites_enabled) {
/* use IPA plugin */
return ENOMEM;
}
} else {
/* fall back to standard plugin on clients. */
return ret;
}
}
return EOK;
}
struct ipa_options *ipa_options,
struct ipa_id_ctx *ipa_id_ctx,
struct ipa_auth_ctx **_ipa_auth_ctx)
{
struct ipa_auth_ctx *ipa_auth_ctx;
if (ipa_auth_ctx == NULL) {
return ENOMEM;
}
return ret;
}
return EOK;
}
struct ipa_options *ipa_options,
struct krb5_ctx **_krb5_auth_ctx)
{
struct krb5_ctx *krb5_auth_ctx;
bool server_mode;
if (krb5_auth_ctx == NULL) {
return ENOMEM;
}
&krb5_auth_ctx->opts);
return ret;
}
return EOK;
}
struct ipa_options *ipa_options,
struct sdap_auth_ctx **_sdap_auth_ctx)
{
struct sdap_auth_ctx *sdap_auth_ctx;
if (sdap_auth_ctx == NULL) {
return ENOMEM;
}
return EINVAL;
}
return EOK;
}
static void cleanup_ipa_preauth_indicator(void)
{
int ret;
"Failed to remove preauth indicator file [%s] %d [%s].\n",
}
}
static errno_t create_ipa_preauth_indicator(void)
{
int fd;
return ENOMEM;
}
0644);
if (fd < 0) {
"Failed to create preauth indicator file [%s].\n",
goto done;
}
"Preauth indicator file [%s] already exists. "
"Maybe it is left after an unplanned exit. Continuing.\n",
} else {
}
}
done:
return ret;
}
static struct sdap_ext_member_ctx *
struct ipa_id_ctx *id_ctx)
{
return NULL;
}
return ext_ctx;
}
struct ipa_options *ipa_options,
struct ipa_id_ctx *id_ctx,
struct ipa_auth_ctx **_auth_ctx)
{
struct sdap_auth_ctx *sdap_auth_ctx;
struct ipa_auth_ctx *ipa_auth_ctx;
struct krb5_ctx *krb5_auth_ctx;
return ret;
}
goto done;
}
goto done;
}
goto done;
}
/* Initialize features needed by the krb5_child */
goto done;
}
}
done:
}
return ret;
}
static bool ipa_check_fqdn(const char *str)
{
}
struct ipa_options *ipa_options,
struct ipa_id_ctx *ipa_id_ctx,
struct sdap_id_ctx *sdap_id_ctx)
{
IPA_HOSTNAME))) {
"ipa_hostname is not Fully Qualified Domain Name.\n");
}
return ret;
}
return ret;
}
"Could not initialize ID mapping. In case ID mapping properties "
"changed on the server, please remove the SSSD database\n");
return ret;
}
return ret;
}
ret = sdap_setup_child();
return ret;
}
return ret;
}
} else {
return ret;
}
}
}
return ENOMEM;
}
"Failed to initialized certificate mapping.\n");
return ret;
}
return EOK;
}
struct data_provider *provider,
const char *module_name,
void **_module_data)
{
struct ipa_init_ctx *init_ctx;
return ENOMEM;
}
/* Always initialize options since it is needed everywhere. */
goto done;
}
/* Always initialize id_ctx since it is needed everywhere. */
goto done;
}
/* Setup miscellaneous things. */
goto done;
}
/* Initialize auth_ctx only if one of the target is enabled. */
goto done;
}
}
*_module_data = init_ctx;
done:
}
return ret;
}
void *module_data,
struct dp_method *dp_methods)
{
struct ipa_init_ctx *init_ctx;
struct ipa_id_ctx *id_ctx;
struct sdap_id_ctx, void, struct dp_reply_std);
return EOK;
}
void *module_data,
struct dp_method *dp_methods)
{
struct ipa_init_ctx *init_ctx;
struct ipa_auth_ctx *auth_ctx;
return EOK;
}
void *module_data,
struct dp_method *dp_methods)
{
}
void *module_data,
struct dp_method *dp_methods)
{
struct ipa_access_ctx *access_ctx;
struct ipa_init_ctx *init_ctx;
struct ipa_id_ctx *id_ctx;
if (access_ctx == NULL) {
return ENOMEM;
}
goto done;
}
goto done;
}
done:
}
return ret;
}
void *module_data,
struct dp_method *dp_methods)
{
#if defined HAVE_SELINUX && defined HAVE_SELINUX_LOGIN_DIR
struct ipa_selinux_ctx *selinux_ctx;
struct ipa_init_ctx *init_ctx;
struct ipa_options *opts;
if (selinux_ctx == NULL) {
return ENOMEM;
}
return EOK;
#else
"built without SSH support, ignoring\n");
return EOK;
#endif
}
void *module_data,
struct dp_method *dp_methods)
{
#ifdef BUILD_SSH
struct ipa_hostid_ctx *hostid_ctx;
struct ipa_init_ctx *init_ctx;
if (hostid_ctx == NULL) {
return ENOMEM;
}
return EOK;
#else
"built without SSH support, ignoring\n");
return EOK;
#endif
}
void *module_data,
struct dp_method *dp_methods)
{
#ifdef BUILD_AUTOFS
struct ipa_init_ctx *init_ctx;
#else
"built without autofs support, ignoring\n");
return EOK;
#endif
}
void *module_data,
struct dp_method *dp_methods)
{
struct ipa_init_ctx *init_ctx;
}
void *module_data,
struct dp_method *dp_methods)
{
#ifdef BUILD_SUDO
struct ipa_init_ctx *init_ctx;
#else
"built without sudo support, ignoring\n");
return EOK;
#endif
}
void *module_data,
struct dp_method *dp_methods)
{
struct ipa_session_ctx *session_ctx;
struct ipa_init_ctx *init_ctx;
struct ipa_id_ctx *id_ctx;
if (session_ctx == NULL) {
return ENOMEM;
}
goto done;
}
done:
}
return ret;
}