/*
SSSD
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2016 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ad/ad_common.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ldap/sdap_async_ad.h"
struct dp_id_data *ar,
struct ldb_message **_msg)
{
NULL };
int ret;
return EINVAL;
}
return ENOMEM;
}
user_attrs, &msg);
} else {
switch (ar->filter_type) {
case BE_FILTER_SECID:
user_attrs, &msg);
break;
case BE_FILTER_UUID:
user_attrs, &res);
} else {
"Search by UUID returned multiple results.\n");
goto done;
}
}
break;
case BE_FILTER_NAME:
user_attrs, &msg);
break;
default:
ar->filter_type);
goto done;
}
}
ar->filter_value);
} else {
"Looking up user in cache with filter [%s] failed.\n",
ar->filter_value);
}
goto done;
}
done:
return ret;
}
struct sss_domain_info *dom,
struct dp_id_data *ar,
struct ldb_message **_msg)
{
int ret;
return ret;
}
return ENOENT;
}
if (pac_expires < now) {
return ENOENT;
}
}
return EOK;
}
struct sss_idmap_ctx *idmap_ctx,
struct PAC_LOGON_INFO *logon_info,
char **_user_sid_str,
char **_primary_group_sid_str,
char *** _sid_list)
{
int ret;
size_t s;
char *rid_start;
size_t c;
return EINVAL;
}
return ENOMEM;
}
&sid_table);
goto done;
}
if (err != IDMAP_SUCCESS) {
goto done;
}
goto done;
}
goto done;
}
if (user_sid_str == NULL) {
goto done;
}
goto done;
}
if (primary_group_sid_str == NULL) {
goto done;
}
if (ret != HASH_SUCCESS) {
goto done;
}
goto done;
}
if (ret != HASH_SUCCESS) {
goto done;
}
}
&msid_str);
if (err != IDMAP_SUCCESS) {
goto done;
}
if (ret != HASH_SUCCESS) {
goto done;
}
}
goto done;
}
goto done;
}
c = 0;
goto done;
}
c++;
}
done:
}
return ret;
}
struct ldb_message *msg,
struct sss_idmap_ctx *idmap_ctx,
char **_username,
char **user_sid,
char **primary_group_sid,
char ***group_sids)
{
int ret;
const char *dummy;
char *username;
return ENOMEM;
}
goto done;
}
goto done;
}
&logon_info);
goto done;
}
goto done;
}
goto done;
}
goto done;
}
done:
return ret;
}
struct ad_handle_pac_initgr_state {
const char *err;
int dp_error;
int sdap_ret;
char **missing_sids;
char **cached_groups;
char *username;
};
struct dp_id_data *ar,
struct sdap_id_ctx *id_ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
bool noexist_delete,
struct ldb_message *msg)
{
int ret;
char *user_sid;
char *primary_group_sid;
char **group_sids;
bool use_id_mapping;
struct ad_handle_pac_initgr_state);
return NULL;
}
/* The following variables are currently unused because no sub-request
* returns any of them. But they are needed to allow the same signature as
* sdap_handle_acct_req_recv() from the alternative group-membership
* lookup path. */
&num_sids, &group_sids);
goto done;
}
if (use_id_mapping
/* In contrast to the tokenGroups based group-membership lookup the
* PAC based approach can be used for sub-domains with id-mapping as
* well because the PAC will only contain groups which are valid in
* the target domain, i.e. it will not contain domain-local groups for
* domains other than the user domain. This means the groups must not
* be looked up immediately to determine if they are domain-local or
* not.
*
* Additionally, as a temporary workaround until
* https://fedorahosted.org/sssd/ticket/2522 is fixed, we also fetch
* the group object if group members are ignored to avoid having to
* transfer and retain members when the fake tokengroups object
* without name is replaced by the full group object.
*/
"sdap_ad_save_group_membership_with_idmapping failed.\n");
}
/* this path only includes cache operation, so we can finish the
* request immediately */
goto done;
} else {
&state->cached_groups);
"sdap_ad_tokengroups_get_posix_members failed.\n");
goto done;
}
/* download missing SIDs */
conn,
goto done;
}
req);
}
return req;
done:
} else {
}
return req;
}
{
char **cached_groups;
goto done;
}
"sdap_ad_tokengroups_get_posix_members failed [%d]: %s\n",
goto done;
}
goto done;
}
/* update membership of existing groups */
goto done;
}
done:
return;
}
}
int *sdap_ret)
{
if (_dp_error) {
}
if (_err) {
}
if (sdap_ret) {
}
return EOK;
}