ipa_s2n_exop.c revision accff8ebe158251b1d25a95b3b035fe7e08fd1ee
/*
SSSD
IPA Helper routines - external users and groups with s2n plugin
Copyright (C) Sumit Bose <sbose@redhat.com> - 2011
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "util/strtonum.h"
#include "util/crypto/sss_crypto.h"
#include "providers/ldap/sdap_async_private.h"
#include "providers/ldap/sdap_async_ad.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ipa/ipa_subdomains.h"
enum input_types {
INP_SID = 1,
};
enum request_types {
REQ_SIMPLE = 1,
};
enum response_types {
RESP_SID = 1,
};
/* ==Sid2Name Extended Operation============================================= */
struct ipa_s2n_exop_state {
struct sdap_handle *sh;
char *retoid;
};
struct tevent_context *ev,
struct sdap_handle *sh,
bool is_v1,
int timeout,
{
struct ipa_s2n_exop_state *state;
int ret;
int msgid;
goto fail;
}
msgid);
if (ret) {
ret = ERR_INTERNAL;
goto fail;
}
return req;
fail:
return req;
}
{
struct ipa_s2n_exop_state);
int ret;
int result;
if (error) {
return;
}
NULL, 0);
if (ret != LDAP_SUCCESS) {
goto done;
}
"ldap_extended_operation result: %s(%d), %s.\n",
if (result != LDAP_SUCCESS) {
if (result == LDAP_NO_SUCH_OBJECT) {
} else {
"logs might contain more details.\n");
}
goto done;
}
if (ret != LDAP_SUCCESS) {
ret);
goto done;
}
goto done;
}
goto done;
}
goto done;
}
goto done;
}
done:
} else {
}
}
{
struct ipa_s2n_exop_state);
return EOK;
}
{
int ret;
if (ret == -1) {
goto done;
}
goto done;
}
goto done;
}
done:
ber_bvfree(bv);
} else {
}
return ret;
}
/* The extended operation expect the following ASN.1 encoded request data:
*
* ExtdomRequestValue ::= SEQUENCE {
* inputType ENUMERATED {
* sid (1),
* name (2),
* posix uid (3),
* posix gid (3)
* },
* requestType ENUMERATED {
* simple (1),
* full (2)
* full_with_members (3)
* },
* data InputData
* }
*
* InputData ::= CHOICE {
* sid OCTET STRING,
* name NameDomainData
* uid PosixUid,
* gid PosixGid
* }
*
* NameDomainData ::= SEQUENCE {
* domain_name OCTET STRING,
* object_name OCTET STRING
* }
*
* PosixUid ::= SEQUENCE {
* domain_name OCTET STRING,
* uid INTEGER
* }
*
* PosixGid ::= SEQUENCE {
* domain_name OCTET STRING,
* gid INTEGER
* }
*
*/
const char *domain_name,
int entry_type,
enum request_types request_type,
{
int ret;
return ENOMEM;
}
switch (entry_type) {
case BE_REQ_USER:
case BE_REQ_USER_AND_GROUP: /* the extdom exop does not care if the
ID belongs to a user or a group */
} else {
goto done;
}
break;
case BE_REQ_GROUP:
} else {
goto done;
}
break;
case BE_REQ_BY_SECID:
} else {
goto done;
}
break;
case BE_REQ_BY_CERT:
} else {
goto done;
}
break;
default:
goto done;
}
if (ret == -1) {
goto done;
}
goto done;
}
done:
return ret;
}
/* If the extendend operation is successful it returns the following ASN.1
* encoded response:
*
* ExtdomResponseValue ::= SEQUENCE {
* responseType ENUMERATED {
* sid (1),
* name (2),
* posix_user (3),
* posix_group (4),
* posix_user_grouplist (5),
* posix_group_members (6)
* },
* data OutputData
* }
*
* OutputData ::= CHOICE {
* sid OCTET STRING,
* name NameDomainData,
* user PosixUser,
* group PosixGroup,
* usergrouplist PosixUserGrouplist,
* groupmembers PosixGroupMembers
*
* }
*
* NameDomainData ::= SEQUENCE {
* domain_name OCTET STRING,
* object_name OCTET STRING
* }
*
* PosixUser ::= SEQUENCE {
* domain_name OCTET STRING,
* user_name OCTET STRING,
* uid INTEGER
* gid INTEGER
* }
*
* PosixGroup ::= SEQUENCE {
* domain_name OCTET STRING,
* group_name OCTET STRING,
* gid INTEGER
* }
*
* PosixUserGrouplist ::= SEQUENCE {
* domain_name OCTET STRING,
* user_name OCTET STRING,
* uid INTEGER,
* gid INTEGER,
* gecos OCTET STRING,
* home_directory OCTET STRING,
* shell OCTET STRING,
* grouplist GroupNameList
* }
*
* GroupNameList ::= SEQUENCE OF OCTET STRING
*
* PosixGroupMembers ::= SEQUENCE {
* domain_name OCTET STRING,
* group_name OCTET STRING,
* gid INTEGER,
* members GroupMemberList
* }
*
* GroupMemberList ::= SEQUENCE OF OCTET STRING
*/
struct resp_attrs {
enum response_types response_type;
char *domain_name;
union {
char *sid_str;
char *name;
} a;
char **groups;
struct sysdb_attrs *sysdb_attrs;
};
{
char *ber_cookie;
char *name;
struct ldb_val v;
int ret;
size_t c;
return ENOMEM;
}
}
tag != LBER_DEFAULT;
if (tag == LBER_ERROR) {
return EINVAL;
}
"base64 encoded certificate not 0-terminated.\n");
return EINVAL;
}
return EINVAL;
}
} else {
}
return ret;
}
}
}
return EOK;
}
{
int ret;
size_t c;
if (tag == LBER_ERROR) {
goto done;
}
} else {
goto done;
}
}
} else {
goto done;
}
}
} else {
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
list[c]);
goto done;
}
}
}
if (tag == LBER_SEQUENCE) {
goto done;
}
}
done:
ber_memvfree((void **) list);
return ret;
}
{
int ret;
size_t c;
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
list[c]);
goto done;
}
}
}
} else {
goto done;
}
}
if (tag == LBER_SEQUENCE) {
goto done;
}
}
done:
ber_memvfree((void **) list);
return ret;
}
struct resp_attrs *attrs,
struct resp_attrs *simple_attrs,
const char *view_name,
struct sysdb_attrs *override_attrs,
bool update_initgr_timeout);
char *retoid,
struct resp_attrs **resp_attrs)
{
int ret;
enum response_types type;
char *domain_name = NULL;
char *sid_str;
bool is_v1 = false;
return EINVAL;
}
is_v1 = true;
is_v1 = false;
} else {
"Result has wrong OID, expected [%s] or [%s], got [%s].\n",
return EINVAL;
}
return EINVAL;
}
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
switch (type) {
case RESP_USER:
case RESP_USER_GROUPLIST:
if (tag == LBER_ERROR) {
goto done;
}
/* Winbind is not consistent with the case of the returned user
* name. In general all names should be lower case but there are
* bug in some version of winbind which might lead to upper case
* letters in the name. To be on the safe side we explicitly
* lowercase the name. */
goto done;
}
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
break;
case RESP_GROUP:
case RESP_GROUP_MEMBERS:
if (tag == LBER_ERROR) {
goto done;
}
/* Winbind is not consistent with the case of the returned user
* name. In general all names should be lower case but there are
* bug in some version of winbind which might lead to upper case
* letters in the name. To be on the safe side we explicitly
* lowercase the name. */
goto done;
}
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
break;
case RESP_SID:
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
break;
case RESP_NAME:
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
break;
default:
type);
goto done;
}
goto done;
}
}
done:
*resp_attrs = attrs;
} else {
}
return ret;
}
struct ipa_s2n_get_list_state {
struct tevent_context *ev;
struct ipa_id_ctx *ipa_ctx;
struct sss_domain_info *dom;
struct sdap_handle *sh;
char **list;
int exop_timeout;
int entry_type;
enum request_types request_type;
struct resp_attrs *attrs;
struct sss_domain_info *obj_domain;
struct sysdb_attrs *override_attrs;
};
struct tevent_context *ev,
struct ipa_id_ctx *ipa_ctx,
struct sss_domain_info *dom,
struct sdap_handle *sh,
int exop_timeout,
int entry_type,
enum request_types request_type,
enum req_input_type list_type,
char **list)
{
int ret;
struct ipa_s2n_get_list_state *state;
struct tevent_req *req;
return NULL;
}
goto done;
}
goto done;
}
done:
}
return req;
}
{
int ret;
struct ipa_s2n_get_list_state);
struct tevent_req *subreq;
struct sss_domain_info *parent_domain;
char *short_name = NULL;
char *domain_name = NULL;
char *endptr;
bool need_v1 = false;
case REQ_INP_NAME:
&domain_name, &short_name);
return ret;
}
if (domain_name) {
domain_name, true);
return ENOMEM;
}
} else {
}
break;
case REQ_INP_ID:
errno = 0;
return EINVAL;
}
break;
case REQ_INP_SECID:
"find_domain_by_sid failed for SID [%s].\n",
return EINVAL;
}
break;
default:
return EINVAL;
}
return ret;
}
need_v1 = true;
}
return ENOMEM;
}
return EOK;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_list_state);
const char *sid_str;
struct be_acct_req *ar;
goto fail;
}
goto fail;
}
goto fail;
}
return;
}
&sid_str);
goto fail;
}
goto fail;
}
ar);
goto fail;
}
return;
fail:
return;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_list_state);
goto fail;
}
goto fail;
}
return;
fail:
return;
}
{
int ret;
struct ipa_s2n_get_list_state);
state->override_attrs, false);
return ret;
}
return EOK;
}
return ret;
}
return EAGAIN;
}
{
return EOK;
}
struct ipa_s2n_get_user_state {
struct tevent_context *ev;
struct ipa_id_ctx *ipa_ctx;
struct sdap_options *opts;
struct sss_domain_info *dom;
struct sdap_handle *sh;
int entry_type;
enum request_types request_type;
struct resp_attrs *attrs;
struct resp_attrs *simple_attrs;
struct sysdb_attrs *override_attrs;
int exop_timeout;
};
struct tevent_context *ev,
struct ipa_id_ctx *ipa_ctx,
struct sdap_options *opts,
struct sss_domain_info *dom,
struct sysdb_attrs *override_attrs,
struct sdap_handle *sh,
int entry_type,
{
struct ipa_s2n_get_user_state *state;
struct tevent_req *req;
struct tevent_req *subreq;
bool is_v1 = false;
return NULL;
}
is_v1 = true;
is_v1 = false;
} else {
"cannot resolve objects from trusted domains.\n");
goto fail;
}
goto fail;
}
goto fail;
}
return req;
fail:
return req;
}
struct sysdb_attrs *group_attrs,
char **members,
{
int ret;
size_t c;
struct ldb_message *msg;
const char *dn_str;
struct sss_domain_info *obj_domain;
struct sss_domain_info *parent_domain;
char **missing_members = NULL;
size_t miss_count = 0;
if (_missing_members != NULL) {
*_missing_members = NULL;
}
return EOK;
}
return ENOMEM;
}
/* count members */
if (missing_members == NULL) {
goto done;
}
}
if (obj_domain == NULL) {
goto done;
}
&msg);
if (group_attrs != NULL) {
goto done;
}
dn_str);
"sysdb_attrs_add_string_safe failed.\n");
goto done;
}
}
if (group_attrs != NULL) {
members[c]);
/* There were cases where the server returned the same user
* multiple times */
members[c]);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
if (missing_members != NULL) {
members[c]);
goto done;
}
miss_count++;
}
} else {
goto done;
}
}
if (_missing_members != NULL) {
if (miss_count == 0) {
*_missing_members = NULL;
} else {
} else {
"Missing memory context for missing members list.\n");
goto done;
}
}
}
done:
return ret;
}
struct sss_domain_info *dom,
char ***_missing_groups)
{
int ret;
size_t c;
char **missing_groups = NULL;
struct sss_domain_info *obj_domain;
struct sss_domain_info *parent_domain;
return ENOMEM;
}
goto done;
}
for (c = 0; c < ngroups; c++) {
if (obj_domain == NULL) {
goto done;
}
&msg);
goto done;
}
n_dns++;
groups[c]);
goto done;
}
n_missing++;
} else {
goto done;
}
}
if (n_missing != 0) {
} else {
*_missing_groups = NULL;
}
if (n_dns != 0) {
} else {
}
done:
return ret;
}
{
struct tevent_req);
struct ipa_s2n_get_user_state);
int ret;
char **missing_list = NULL;
const char *sid_str;
struct be_acct_req *ar;
"Maybe the server does not support lookups by "
"certificates.\n");
}
goto done;
}
switch (state->request_type) {
case REQ_FULL_WITH_MEMBERS:
case REQ_FULL:
goto done;
}
"expected [%s] or [%s], got [%s].\n",
attrs->domain_name);
goto done;
}
goto done;
}
if (missing_list != NULL) {
"ipa_s2n_get_list_send failed.\n");
goto done;
}
req);
return;
}
break;
state, &missing_list);
goto done;
}
if (missing_list != NULL) {
"ipa_s2n_get_list_send failed.\n");
goto done;
}
req);
return;
}
break;
}
/* We already know the SID, we do not have to read it. */
break;
}
&bv_req);
goto done;
}
goto done;
}
return;
case REQ_SIMPLE:
&state->simple_attrs);
goto done;
}
break;
default:
goto done;
}
goto done;
}
&sid_str);
} else {
}
goto done;
}
goto done;
}
ar);
goto done;
}
req);
return;
} else {
goto done;
}
done:
} else {
}
return;
}
{
int ret;
int c;
struct sss_domain_info *root_domain;
char **dn_list;
return EOK;
}
/* To handle cross-domain memberships we have to check the domain for
* each group the member should be added or deleted. Since sub-domains
* use fully-qualified names by default any short name can only belong
* the domain given in the first argument if the second argument is a
* a short name hence we always use root_domain as first argument. */
if (root_domain->fqnames) {
"Root domain uses fully-qualified names, " \
"objects might not be correctly added to groups with " \
"short names.\n");
}
return ENOMEM;
}
goto done;
}
"Cannot find domain for [%s].\n", name_list[c]);
goto done;
}
/* This might fail if some unexpected cases are used. But current
* sysdb code which handles group membership constructs DNs this way
* as well, IPA names are lowercased and AD names by default will be
* lowercased as well. If there are really use-cases which cause an
* issue here, sysdb_group_strdn() has to be replaced by a proper
* search. */
goto done;
}
}
done:
return ret;
}
struct resp_attrs *attrs,
struct resp_attrs *simple_attrs,
const char *view_name,
struct sysdb_attrs *override_attrs,
bool update_initgr_timeout)
{
int ret;
struct sss_nss_homedir_ctx homedir_ctx;
char *realm;
const char *sid_str;
const char *tmp_str;
struct ldb_result *res;
enum sysdb_member_type type;
char **sysdb_grouplist;
char **add_groups;
char **add_groups_dns;
char **del_groups;
char **del_groups_dns;
bool in_transaction = false;
int tret;
char ** exop_grouplist;
struct ldb_message *msg;
return ENOMEM;
}
goto done;
}
}
goto done;
}
} else {
goto done;
}
tmp_str);
"sysdb_attrs_add_lc_name_alias_safe failed.\n");
goto done;
}
goto done;
}
goto done;
}
} else {
goto done;
}
}
attrs->domain_name, true);
goto done;
}
}
switch (attrs->response_type) {
case RESP_USER:
case RESP_USER_GROUPLIST:
if (dom->subdomain_homedir
&homedir_ctx);
goto done;
}
}
/* we always use the fully qualified name for subdomain users */
if (!name) {
goto done;
}
}
"sysdb_attrs_add_lc_name_alias_safe failed.\n");
goto done;
}
/* We also have to store a fake UPN here, because otherwise the
* krb5 child later won't be able to properly construct one as
* the username is fully qualified but the child doesn't have
* access to the regex to deconstruct it */
/* FIXME: The real UPN is available from the PAC, we should get
* it from there. */
if (!realm) {
goto done;
}
if (!upn) {
goto done;
}
/* We might already have the SID or the UPN from other sources
* hence sysdb_attrs_add_string_safe is used to avoid double
* entries. */
upn);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
if (simple_attrs != NULL
simple_attrs->a.sid_str);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
&& update_initgr_timeout) {
/* Since RESP_USER_GROUPLIST contains all group memberships it
* is effectively an initgroups request hence
* SYSDB_INITGR_EXPIRE will be set.*/
"sysdb_attrs_add_time_t failed.\n");
goto done;
}
}
gid = 0;
} else {
/* The extdom plugin always returns the objects with the
* default view applied. Since the GID is handled specially
* for MPG domains we have add any overridden GID separately.
*/
&orig_gid);
if (gid_override_attrs == NULL) {
"sysdb_new_attrs failed.\n");
goto done;
}
"sysdb_attrs_add_uint32 failed.\n");
goto done;
}
}
} else {
"sysdb_attrs_get_uint32_t failed.\n");
goto done;
}
}
SYSDB_ORIG_MEMBEROF, false, &el);
missing[0] = SYSDB_ORIG_MEMBEROF;
}
goto done;
}
in_transaction = true;
: discard_const(missing),
/* This handles the case where getgrgid() was called for
* this user, so a group was created in the cache
*/
/* Fail even on ENOENT, the group must be around */
"Could not delete MPG group [%d]: %s\n",
goto done;
}
"sysdb_delete_group failed for MPG group [%d]: %s\n",
goto done;
}
"sysdb_store_user failed for MPG user [%d]: %s\n",
goto done;
}
"sysdb_store_user failed [%d]: %s\n",
goto done;
}
if (gid_override_attrs != NULL) {
goto done;
}
}
goto done;
}
/* names returned by extdom exop will be all lower case, since
* we handle domain names case sensitve in the cache we have
* to make sure we use the right case. */
goto done;
}
&del_groups, NULL);
goto done;
}
goto done;
}
goto done;
}
name);
(const char *const *) add_groups_dns,
(const char *const *) del_groups_dns);
goto done;
}
}
goto done;
}
in_transaction = false;
break;
case RESP_GROUP:
case RESP_GROUP_MEMBERS:
}
if (IS_SUBDOMAIN(dom)) {
/* we always use the fully qualified name for subdomain users */
if (!name) {
goto done;
}
}
"sysdb_attrs_add_lc_name_alias_safe failed.\n");
goto done;
}
/* We might already have the SID from other sources hence
* sysdb_attrs_add_string_safe is used to avoid double entries. */
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
if (simple_attrs != NULL
simple_attrs->a.sid_str);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
goto done;
}
now);
goto done;
}
break;
default:
goto done;
}
"Cannot find SID of object with override.\n");
goto done;
}
"Cannot find object with override with SID [%s].\n", sid_str);
goto done;
}
if (!is_default_view(view_name)) {
/* For the default view the data return by the extdom plugin already
* contains all needed data and it is not expected to have a separate
* override object. */
goto done;
}
}
done:
if (in_transaction) {
}
}
return ret;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_user_state);
const char *sid_str;
struct be_acct_req *ar;
return;
}
&sid_str);
goto fail;
}
return;
goto fail;
}
goto fail;
}
ar);
goto fail;
}
req);
} else {
state->override_attrs, true);
return;
}
}
return;
fail:
return;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_user_state);
return;
}
override_attrs, true);
return;
}
return;
}
{
return EOK;
}
struct tevent_context *ev;
struct sdap_handle *sh;
struct sss_domain_info *dom;
char *username;
char **missing_sids;
char **cached_groups;
};
struct tevent_context *ev,
struct sdap_handle *sh,
struct ipa_id_ctx *ipa_ctx,
struct sss_domain_info *dom,
struct ldb_message *user_msg)
{
int ret;
struct tevent_req *req;
struct tevent_req *subreq;
char *user_sid;
char *primary_group_sid;
char **group_sids;
return NULL;
}
&num_sids, &group_sids);
goto done;
}
&state->cached_groups);
"sdap_ad_tokengroups_get_posix_members failed.\n");
goto done;
}
if (state->num_missing_sids == 0) {
}
goto done;
}
goto done;
}
return req;
done:
} else {
}
return req;
}
{
int ret;
struct tevent_req);
char **cached_groups;
return;
}
/* from ad_pac.c */
"sdap_ad_tokengroups_get_posix_members failed [%d]: %s\n",
goto done;
}
goto done;
}
/* update membership of existing groups */
goto done;
}
done:
} else {
}
return;
}
{
return EOK;
}