providers/ipa/ipa_session.c

f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio/*
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    SSSD
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    IPA Backend Module -- Session Management
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    Authors:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        Fabiano Fidêncio <fidencio@redhat.com>
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    Copyright (C) 2017 Red Hat
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    This program is free software; you can redistribute it and/or modify
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    it under the terms of the GNU General Public License as published by
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    the Free Software Foundation; either version 3 of the License, or
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    (at your option) any later version.
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    This program is distributed in the hope that it will be useful,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    but WITHOUT ANY WARRANTY; without even the implied warranty of
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    GNU General Public License for more details.
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    You should have received a copy of the GNU General Public License
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    along with this program.  If not, see <http://www.gnu.org/licenses/>.
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio*/
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include <security/pam_modules.h>
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "util/child_common.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ldap/sdap_async.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_common.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_config.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_hosts.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_subdomains.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_session.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_rules_common.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_deskprofile_private.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_deskprofile_config.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_deskprofile_rules.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#include "providers/ipa/ipa_deskprofile_rules_util.h"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio/* Those here are used for sending a message to the deskprofile client
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio * informing that our side is done. */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#define SSS_FLEETCOMMANDERCLIENT_BUS "org.freedesktop.FleetCommanderClient"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#define SSS_FLEETCOMMANDERCLIENT_PATH "/org/freedesktop/FleetCommanderClient"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio#define SSS_FLEETCOMMANDERCLIENT_IFACE "org.freedesktop.FleetCommanderClient"
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio#define MINUTE_IN_SECONDS 60
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostruct ipa_fetch_deskprofile_state {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_context *ev;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct be_ctx *be_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sdap_id_ctx *sdap_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_session_ctx *session_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sdap_id_op *sdap_op;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct dp_option *ipa_options;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sdap_search_base **search_bases;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    const char *username;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Hosts */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_common_entries *hosts;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sysdb_attrs *ipa_host;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Rules */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_common_entries *rules;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sysdb_attrs *config;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    uint16_t priority;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio};
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t ipa_fetch_deskprofile_retry(struct tevent_req *req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void ipa_fetch_deskprofile_connect_done(struct tevent_req *subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t ipa_fetch_deskprofile_hostinfo(struct tevent_req *req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void ipa_fetch_deskprofile_hostinfo_done(struct tevent_req *subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void ipa_fetch_deskprofile_config_done(struct tevent_req *subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void ipa_fetch_deskprofile_rules_done(struct tevent_req *subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic struct tevent_req *
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_send(TALLOC_CTX *mem_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                           struct tevent_context *ev,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                           struct be_ctx *be_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                           struct ipa_session_ctx *session_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                           const char *username)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    time_t now;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    time_t refresh_interval;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    time_t request_interval;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    time_t next_request;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    bool offline;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_create(mem_ctx, &state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                            struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (req == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->ev = ev;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->be_ctx = be_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->session_ctx = session_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->sdap_ctx = session_ctx->sdap_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->ipa_options = session_ctx->ipa_options;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->search_bases = session_ctx->deskprofile_search_bases;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->username = username;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->hosts = talloc_zero(state, struct ipa_common_entries);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (state->hosts == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->rules = talloc_zero(state, struct ipa_common_entries);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (state->rules == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (state->search_bases == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "No Desktop Profile search base found.\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EINVAL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->sdap_op = sdap_id_op_create(state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                       state->sdap_ctx->conn->conn_cache);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (state->sdap_op == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create() failed\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    now = time(NULL);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    request_interval = dp_opt_get_int(state->ipa_options,
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio                                      IPA_DESKPROFILE_REQUEST_INTERVAL);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    /* This value is in minutes ... */
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    request_interval *= MINUTE_IN_SECONDS;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    if (state->session_ctx->no_rules_found &&
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        now < session_ctx->last_request + request_interval) {
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        next_request = (session_ctx->last_request + request_interval - now);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        /* This value is in seconds ... */
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        next_request /= 60;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        DEBUG(SSSDBG_TRACE_FUNC,
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio              "No rules were found in the last request.\n"
0475a98d313b8380e7fbf98ee0821a65f8140589Sumit Bose              "Next request will happen in any login after %ld minutes\n",
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio              next_request);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        ret = ENOENT;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        goto immediately;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    }
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    state->session_ctx->no_rules_found = false;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    offline = be_is_offline(be_ctx);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DEBUG(SSSDBG_TRACE_ALL, "Connection status is [%s].\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio          offline ? "offline" : "online");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    refresh_interval = dp_opt_get_int(state->ipa_options,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      IPA_DESKPROFILE_REFRESH);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (offline || now < session_ctx->last_update + refresh_interval) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_TRACE_FUNC,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Performing cached Desktop Profile evaluation\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_fetch_deskprofile_retry(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EAGAIN) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto immediately;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioimmediately:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret == EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_done(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_post(req, ev);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_retry(struct tevent_req *req)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *subreq;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    int ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (subreq == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "sdap_id_op_connect_send() failed: %d (%s)\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_set_callback(subreq, ipa_fetch_deskprofile_connect_done, req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return EAGAIN;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_connect_done(struct tevent_req *subreq)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    int dp_error;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_callback_data(subreq, struct tevent_req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = sdap_id_op_connect_recv(subreq, &dp_error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_zfree(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_fetch_deskprofile_hostinfo(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret == EAGAIN) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret == EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_done(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_hostinfo(struct tevent_req *req)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *subreq;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    const char *hostname;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    hostname = dp_opt_get_string(state->ipa_options, IPA_HOSTNAME);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    subreq = ipa_host_info_send(state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->ev,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                sdap_id_op_handle(state->sdap_op),
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->sdap_ctx->opts,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                hostname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->session_ctx->host_map,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->session_ctx->hostgroup_map,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->session_ctx->host_search_bases);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (subreq == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_set_callback(subreq, ipa_fetch_deskprofile_hostinfo_done, req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return EAGAIN;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_hostinfo_done(struct tevent_req *subreq)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_callback_data(subreq, struct tevent_req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_host_info_recv(subreq, state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             &state->hosts->entry_count,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             &state->hosts->entries,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             &state->hosts->group_count,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             &state->hosts->groups);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->hosts->entry_subdir = DESKPROFILE_HOSTS_SUBDIR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->hosts->group_subdir = DESKPROFILE_HOSTGROUPS_SUBDIR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_zfree(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_get_host_attrs(state->ipa_options,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             state->hosts->entry_count,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             state->hosts->entries,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             &state->ipa_host);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "Could not locate IPA host.\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    subreq = ipa_deskprofile_get_config_send(state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                             state->ev,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                             sdap_id_op_handle(state->sdap_op),
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                             state->sdap_ctx->opts,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                             state->ipa_options);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (subreq == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_set_callback(subreq, ipa_fetch_deskprofile_config_done, req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_config_done(struct tevent_req *subreq)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_callback_data(subreq, struct tevent_req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_deskprofile_get_config_recv(subreq, state, &state->config);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_zfree(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = sysdb_store_custom(state->be_ctx->domain, IPA_DESKPROFILE_PRIORITY,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             DESKPROFILE_CONFIG_SUBDIR, state->config);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to save Desktop Profile policy\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    subreq = ipa_deskprofile_rule_info_send(state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->ev,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            sdap_id_op_handle(state->sdap_op),
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->sdap_ctx->opts,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->search_bases,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->ipa_host,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                            state->username);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (subreq == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_set_callback(subreq, ipa_fetch_deskprofile_rules_done, req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_rules_done(struct tevent_req *subreq)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_fetch_deskprofile_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    int dp_error;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    bool found;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_callback_data(subreq, struct tevent_req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_fetch_deskprofile_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_deskprofile_rule_info_recv(subreq,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                         state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                         &state->rules->entry_count,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                         &state->rules->entries);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->rules->entry_subdir = DESKPROFILE_RULES_SUBDIR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_zfree(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret == ENOENT) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        /* Set ret to EOK so we can safely call sdap_id_op_done. */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        found = false;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else if (ret == EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        found = true;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (dp_error == DP_ERR_OK && ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        /* retry */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ipa_fetch_deskprofile_retry(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        if (ret != EAGAIN) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio            tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio   /* For now, let's completely purge the previous stored
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    * rules before saving the new ones */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_common_purge_rules(state->be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                 DESKPROFILE_RULES_SUBDIR);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Unable to remove Desktop Profile rules\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (!found) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOENT;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_common_save_rules(state->be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                state->hosts, NULL, state->rules,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                &state->session_ctx->last_update);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to save Desktop Profile rules\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        tevent_req_error(req, ret);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_done(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_fetch_deskprofile_recv(struct tevent_req *req)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    TEVENT_REQ_RETURN_ON_ERROR(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostruct ipa_pam_session_handler_state {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_context *ev;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct be_ctx *be_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_session_ctx *session_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct pam_data *pd;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Those attributes are used for:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * - saving the deskprofile rules to the disk;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * - deleting the deskprofile rules from the disk;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * - contacting the deskprofile client that everything is ready;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *shortname;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *domain;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *user_dir;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    uid_t uid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    gid_t gid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio};
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_get_deskprofile_user_info(
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                TALLOC_CTX *mem_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                struct sss_domain_info *domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                const char *username,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                char **_shortname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                char **_domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                char **_user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                uid_t *uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                gid_t *gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void ipa_pam_session_handler_done(struct tevent_req *subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_save_deskprofile_rules(
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    struct be_ctx *be_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    struct sss_domain_info *domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *username, /* fully-qualified */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *hostname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    uid_t uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    gid_t gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_notify_deskprofile_client(uid_t uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  const char *user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  uint16_t prio);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostruct tevent_req *
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_send(TALLOC_CTX *mem_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             struct ipa_session_ctx *session_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             struct pam_data *pd,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             struct dp_req_params *params)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *subreq;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_pam_session_handler_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DEBUG(SSSDBG_TRACE_FUNC, "Retrieving Desktop Profile rules\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_create(mem_ctx, &state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                            struct ipa_pam_session_handler_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (req == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->pd = pd;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->ev = params->ev;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->be_ctx = params->be_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->session_ctx = session_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Get all the user info that will be needed in order the delete the
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * user's deskprofile directory from the disk, create the user's directory,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * save the fetched rules to the disk and notify the deskprofile client
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * that this operation is done. */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_pam_session_handler_get_deskprofile_user_info(
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        state,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        state->be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        pd->user,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        &state->shortname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        &state->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        &state->user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        &state->uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                        &state->gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "ipa_deskprofile_get_user_info() failed [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        state->pd->pam_status = PAM_SESSION_ERR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* As no proper merging mechanism has been implemented yet ...
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * let's just remove the user directory stored in the disk as it's
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio     * going to be created again in case there's any rule fetched. */
1a011c4f20e80f2bcb4d10a4d690b3a88c2fd70dFabiano Fidêncio    ret = ipa_deskprofile_rules_remove_user_dir(state->user_dir,
1a011c4f20e80f2bcb4d10a4d690b3a88c2fd70dFabiano Fidêncio                                                state->uid,
1a011c4f20e80f2bcb4d10a4d690b3a88c2fd70dFabiano Fidêncio                                                state->gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "ipa_deskprofile_rules_remove_user_dir() failed.\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        state->pd->pam_status = PAM_SESSION_ERR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    subreq = ipa_fetch_deskprofile_send(state, state->ev, state->be_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                        state->session_ctx, pd->user);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (subreq == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        state->pd->pam_status = PAM_SESSION_ERR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_set_callback(subreq, ipa_pam_session_handler_done, req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_done(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_post(req, params->ev);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic void
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_done(struct tevent_req *subreq)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct tevent_req *req;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_pam_session_handler_state *state;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    const char *hostname;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    req = tevent_req_callback_data(subreq, struct tevent_req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_pam_session_handler_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_fetch_deskprofile_recv(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_free(subreq);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret == ENOENT) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_IMPORTANT_INFO, "No Desktop Profile rules found\n");
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        if (!state->session_ctx->no_rules_found) {
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio            state->session_ctx->no_rules_found = true;
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio            state->session_ctx->last_request = time(NULL);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio        }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        state->pd->pam_status = PAM_SUCCESS;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    } else if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Unable to fetch Desktop Profile rules [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        state->pd->pam_status = PAM_SYSTEM_ERR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio    state->session_ctx->last_request = time(NULL);
4a311702045b065a97a0c0fc0ccc7a1fc84b38cfFabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    hostname = dp_opt_get_string(state->session_ctx->ipa_options, IPA_HOSTNAME);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_pam_session_handler_save_deskprofile_rules(state->be_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         state->be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         state->pd->user,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         state->user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         hostname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         state->uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                         state->gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state->pd->pam_status = (ret == EOK) ? PAM_SUCCESS : PAM_SESSION_ERR;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* TODO For backward compatibility we always return EOK to DP now. */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tevent_req_done(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioerrno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_recv(TALLOC_CTX *mem_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             struct tevent_req *req,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                             struct pam_data **_data)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ipa_pam_session_handler_state *state = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    state = tevent_req_data(req, struct ipa_pam_session_handler_state);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    TEVENT_REQ_RETURN_ON_ERROR(req);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_data = talloc_steal(mem_ctx, state->pd);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_get_deskprofile_user_info(TALLOC_CTX *mem_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  struct sss_domain_info *domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  const char *username,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  char **_shortname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  char **_domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  char **_user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  uid_t *_uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  gid_t *_gid)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    TALLOC_CTX *tmp_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct ldb_result *res = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *shortname;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *domain_name;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    char *user_dir;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    uid_t uid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    gid_t gid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tmp_ctx = talloc_new(NULL);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (tmp_ctx == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = sss_parse_internal_fqname(tmp_ctx, username,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    &shortname, &domain_name);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_TRACE_FUNC, "Failed to parse \"%s\" [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              username, ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    user_dir = talloc_asprintf(tmp_ctx, IPA_DESKPROFILE_RULES_USER_DIR"/%s/%s",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                               domain_name, shortname);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (user_dir == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf() failed!\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = sysdb_getpwnam(tmp_ctx, domain, username, &res);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_getpwnam() failed [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (res->count != 1) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "sysdb_getpwnam() got more users than expected. "
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Expected [%d], got [%d]\n", 1, res->count);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EINVAL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    gid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_GIDNUM, 0);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (uid == 0 || gid == 0) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        /* As IPA doesn't handle root users ou groups, we know for sure that's
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio         * something wrong in case we get uid = 0 or gid = 0.
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio         */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EINVAL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_shortname = talloc_steal(mem_ctx, shortname);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_domain = talloc_steal(mem_ctx, domain_name);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_user_dir = talloc_steal(mem_ctx, user_dir);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_uid = uid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    *_gid = gid;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_free(tmp_ctx);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_save_deskprofile_rules(
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    struct be_ctx *be_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    struct sss_domain_info *domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *username, /* fully-qualified */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    const char *hostname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    uid_t uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                    gid_t gid)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    TALLOC_CTX *tmp_ctx;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    const char **attrs_get_cached_rules;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    size_t rule_count;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    struct sysdb_attrs **rules;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    uint16_t priority;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    tmp_ctx = talloc_new(NULL);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (tmp_ctx == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        return ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Get Desktop Profile priority from sysdb */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = deskprofile_get_cached_priority(be_ctx->domain, &priority);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "deskprofile_get_cached_priority() failed [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Get Desktop Profile rules from sysdb */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    attrs_get_cached_rules = deskprofile_get_attrs_to_get_cached_rules(tmp_ctx);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (attrs_get_cached_rules == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "deskprofile_get_attrs_get_cached_rules() failed\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_common_get_cached_rules(tmp_ctx, be_ctx->domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      IPA_DESKPROFILE_RULE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      DESKPROFILE_RULES_SUBDIR,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      attrs_get_cached_rules,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      &rule_count,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                      &rules);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Could not retrieve Desktop Profile rules from the cache\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Create the user directory where the rules are going to be stored */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_deskprofile_rules_create_user_dir(username, uid, gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Cannot create the user directory [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Save the rules to the disk */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    for (size_t i = 0; i < rule_count; i++) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ipa_deskprofile_rules_save_rule_to_disk(tmp_ctx,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      priority,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      rules[i],
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      domain,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      hostname,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      username,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                      gid);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio            DEBUG(SSSDBG_OP_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                  "Failed to save a Desktop Profile Rule to disk [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                  ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio            goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    /* Notify FleetCommander that our side is done */
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = ipa_pam_session_handler_notify_deskprofile_client(uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                            user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                            priority);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (ret != EOK) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "ipa_pam_session_handler_notify_deskprofile_client() "
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "failed [%d]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              ret, sss_strerror(ret));
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    talloc_free(tmp_ctx);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic DBusConnection *
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_deskprofile_client_connect(void)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DBusConnection *conn;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DBusError error;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    dbus_error_init(&error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    conn = dbus_bus_get(DBUS_BUS_SYSTEM, &error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (dbus_error_is_set(&error)) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              "Unable to connect to the FleetCommanderClient bus [%s]: %s\n",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio              error.name, error.message);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        conn = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    dbus_error_free(&error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return conn;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciostatic errno_t
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncioipa_pam_session_handler_notify_deskprofile_client(uid_t uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  const char *user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                                                  uint16_t prio)
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio{
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DBusConnection *conn = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DBusMessage *msg = NULL;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    DBusError error;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    errno_t ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    bool dbus_ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    dbus_error_init(&error);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    conn = ipa_deskprofile_client_connect();
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (conn == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EIO;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    msg = sbus_create_message(NULL,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              SSS_FLEETCOMMANDERCLIENT_BUS,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              SSS_FLEETCOMMANDERCLIENT_PATH,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              SSS_FLEETCOMMANDERCLIENT_IFACE,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              "ProcessSSSDFiles",
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              DBUS_TYPE_UINT32, &uid,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              DBUS_TYPE_STRING, &user_dir,
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio                              DBUS_TYPE_UINT16, &prio);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (msg == NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to create D-Bus Message!\n");
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = ENOMEM;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    dbus_ret = dbus_connection_send(conn, msg, NULL);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (dbus_ret == FALSE) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        ret = EIO;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        goto done;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    ret = EOK;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidênciodone:
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (msg != NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        dbus_message_unref(msg);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    if (conn != NULL) {
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio        dbus_connection_unref(conn);
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    }
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio    return ret;
f982039c75ec064894deb676ae53ee57de868590Fabiano Fidêncio}