/*
SSSD
IPA Subdomains Module
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ldap/sdap_ops.h"
#include "providers/ipa/ipa_subdomains.h"
#include "providers/ipa/ipa_common.h"
#include "providers/ipa/ipa_opts.h"
#include <ctype.h>
/* do not refresh more often than every 5 seconds for now */
struct ipa_subdomains_ctx {
bool view_read_at_init;
};
static errno_t
{
bool canonicalize = false;
) {
} else {
"most probably because the auth provider "
"is not 'ipa'. Kerberos configuration "
"snippet to set the 'canonicalize' option "
"will not be created.\n");
}
/* Just continue */
}
return ret;
}
return ret;
}
"sss_krb5_write_mappings failed.\n");
/* Just continue */
}
return EOK;
}
char *domain_name,
struct sysdb_attrs **reply,
struct range_info ***_range_list)
{
struct range_info *r;
const char *value;
size_t c;
size_t d;
int ret;
char *name1;
char *name2;
char *sid1;
char *sid2;
bool mapping1;
bool mapping2;
if (range_list == NULL) {
return ENOMEM;
}
for (c = 0; c < count; c++) {
if (r == NULL) {
goto done;
}
goto done;
}
goto done;
}
if (r->trusted_dom_sid == NULL) {
goto done;
}
goto done;
}
&r->base_id);
goto done;
}
&r->id_range_size);
goto done;
}
&r->base_rid);
goto done;
}
&r->secondary_base_rid);
goto done;
}
if (r->range_type == NULL) {
goto done;
}
/* Older IPA servers might not have the range_type attribute, but
* only support local ranges and trusts with algorithmic mapping. */
if (r->trusted_dom_sid == NULL) {
} else {
}
} else {
goto done;
}
if (r->range_type == NULL) {
goto done;
}
goto done;
}
for (d = 0; d < c; d++) {
"get_idmap_data_from_range failed.\n");
goto done;
}
if (err != IDMAP_SUCCESS) {
"Collision of ranges [%s] and [%s] detected.\n",
goto done;
}
}
range_list[c] = r;
}
range_list[c] = NULL;
done:
}
return ret;
}
struct sysdb_attrs *attrs,
bool *_enumerates)
{
const char *name;
return ret;
}
return EOK;
}
struct ldb_context *ldb_ctx,
struct sysdb_attrs *attrs,
char **_forest)
{
int ret;
const char *name;
goto done;
}
if (ipa_subdom_is_member_dom(dn) == false) {
if (ret) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
done:
}
return ret;
}
struct ipa_id_ctx *id_ctx,
struct ldb_context *ldb_ctx,
{
} else {
/* Clients do not have access to the trust objects's trust direction
* and don't generally care
*/
*_direction = 0;
return EOK;
}
}
struct ipa_id_ctx *id_ctx,
struct sdap_idmap_ctx *sdap_idmap_ctx,
struct sysdb_attrs *attrs)
{
const char *name;
char *realm;
const char *flat;
const char *id;
int ret;
bool mpg;
bool enumerate;
return ENOMEM;
}
goto done;
}
if (!realm) {
goto done;
}
if (ret) {
goto done;
}
if (ret) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
&direction);
"ipa_get_sd_trust_direction failed: %d\n", ret);
goto done;
}
}
if (ret) {
goto done;
}
done:
return ret;
}
struct ipa_id_ctx *id_ctx,
struct sdap_idmap_ctx *sdap_idmap_ctx,
struct sysdb_attrs *attrs)
{
int ret;
if (ret == ERR_TRUST_NOT_SUPPORTED) {
} else if (ret) {
/* Nothing we can do about the error. */
"will try to use cached subdomain\n");
}
}
bool *changes)
{
const char *value;
int c, h;
int ret;
h = 0;
return EINVAL;
}
*changes = false;
/* check existing subdomains */
for (c = 0; c < count; c++) {
if (handled[c]) {
continue;
}
goto done;
}
break;
}
}
if (c >= count) {
/* ok this subdomain does not exist anymore, let's clean up */
goto done;
}
/* Remove the AD ID ctx from the list of LDAP domains */
} else {
/* ok let's try to update it */
reply[c]);
handled[c] = true;
h++;
}
}
if (count == h) {
/* all domains were already accounted for and have been updated */
goto done;
}
/* if we get here it means we have changes to the subdomains list */
*changes = true;
for (c = 0; c < count; c++) {
if (handled[c]) {
continue;
}
reply[c]);
}
done:
ctx->last_refreshed = 0;
} else {
}
return ret;
}
struct ipa_id_ctx *ipa_id_ctx,
const char *view_name,
bool read_at_init)
{
bool in_transaction = false;
"at runtime. Please restart SSSD to get the new view applied.\n");
return EOK;
}
return EOK;
}
/* View name changed. If there was a non-default non-local view
* was used the tree in cache containing the override values is
* removed. In all cases sysdb_invalidate_overrides() is called to
* remove the override attribute from the cached user objects.
*
* Typically ctx->sd_ctx->id_ctx->view_name == NULL means that the
* cache was empty but there was a bug in with caused that the
* view name was not written to the cache at all. In this case the
* cache must be invalidated if the new view is not the
* default-view as well. */
goto done;
}
in_transaction = true;
/* Old view was not the default view, delete view tree */
goto done;
}
}
goto done;
}
goto done;
}
in_transaction = false;
}
goto done;
}
goto done;
}
if (!read_at_init) {
/* refresh view data of all domains at startup */
goto done;
}
goto done;
}
}
done:
if (in_transaction) {
}
}
return ret;
}
struct ipa_subdomains_ranges_state {
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_subdomains_ctx *sd_ctx,
struct sdap_handle *sh)
{
IPA_RANGE_TYPE, NULL };
struct ipa_subdomains_ranges_state);
return NULL;
}
goto immediately;
}
0, RANGE_FILTER, attrs);
goto immediately;
}
return req;
} else {
}
return req;
}
{
goto done;
}
goto done;
}
goto done;
}
done:
return;
}
}
{
return EOK;
}
struct ipa_subdomains_master_state {
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_subdomains_ctx *sd_ctx,
struct sdap_handle *sh)
{
struct ipa_subdomains_master_state);
return NULL;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
0, MASTER_DOMAIN_FILTER, attrs);
goto immediately;
}
return req;
} else {
}
return req;
}
{
&reply_count, &reply);
goto done;
}
if (reply_count > 0) {
goto done;
}
goto done;
}
goto done;
}
} else {
/* All search paths are searched and no master domain record was
* found.
*
* A default IPA installation will not have a master domain record,
* this is only created by ipa-adtrust-install. Nevertheless we should
* continue to read other data like the idview on IPA clients. */
}
goto done;
}
goto done;
}
done:
return;
}
}
{
return EOK;
}
struct ipa_subdomains_slave_state {
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_subdomains_ctx *sd_ctx,
struct sdap_handle *sh)
{
NULL };
struct ipa_subdomains_slave_state);
return NULL;
}
goto immediately;
}
0, SUBDOMAINS_FILTER, attrs);
goto immediately;
}
return req;
} else {
}
return req;
}
{
int ret;
struct sss_domain_info *d;
while (d != NULL) {
if (d->upn_suffixes != NULL) {
break;
}
d = get_next_domain(d, SSS_GND_DESCEND);
}
if (d == NULL) {
"No UPN suffixes found, "
"no need to enable enterprise principals.\n");
return EOK;
}
return ENOMEM;
}
&vals);
goto done;
}
if (vals[0]) {
"Parameter [%s] set in config file and will not be changed.\n",
return EOK;
}
goto done;
}
if (krb5_auth_ctx == NULL) {
goto done;
}
KRB5_USE_ENTERPRISE_PRINCIPAL, true);
goto done;
}
done:
return ret;
}
{
bool has_changes = false;
goto done;
}
&has_changes);
goto done;
}
if (!has_changes) {
goto done;
}
goto done;
}
"Enterprise principals might not work as "
"expected.\n");
}
goto done;
}
goto done;
}
return;
done:
return;
}
}
{
return;
}
}
{
return EOK;
}
struct ipa_subdomains_view_name_state {
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_subdomains_ctx *sd_ctx,
struct sdap_handle *sh)
{
const char *filter;
struct ipa_subdomains_view_name_state);
return NULL;
}
/* Only get view on clients, on servers it is always 'default'. */
goto immediately;
}
goto immediately;
}
goto immediately;
}
/* We add SDAP_DEREF_FLG_SILENT because old IPA servers don't have
* the attribute we dereference, causing the deref call to fail. */
goto immediately;
}
return req;
} else {
}
return req;
}
{
const char *view_name;
&reply_count, &reply);
/* Depending on the version 389ds return a different error code if the
* search for the view name failed because our dereference attribute
* ipaAssignedIDView is not known. Newer version return
* LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to
* EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which
* is returned as EIO. In both cases we have to assume that the server
* is not view aware and keep the view name unset. */
"like server does not support views.\n");
goto done;
}
goto done;
}
if (reply_count == 0) {
} else if (reply_count == 1) {
&view_name);
goto done;
}
} else {
goto done;
}
goto done;
}
done:
return;
}
}
{
return EOK;
}
struct ipa_subdomains_refresh_state {
};
static struct tevent_req *
struct tevent_context *ev,
struct ipa_subdomains_ctx *sd_ctx)
{
struct ipa_subdomains_refresh_state);
return NULL;
}
goto immediately;
}
/* asynchronous processing */
return req;
}
} else {
}
return req;
}
{
int ret;
return ret;
}
return EAGAIN;
}
{
int dp_error;
if (dp_error == DP_ERR_OFFLINE) {
"cannot get the subdomain list while offline\n");
ret = ERR_OFFLINE;
}
return;
}
return;
}
return;
}
{
return;
}
return;
}
return;
}
{
return;
}
return;
}
return;
}
{
return;
}
return;
}
return;
}
{
int dp_error;
/* retry */
goto done;
}
return;
} else if (dp_error == DP_ERR_OFFLINE) {
ret = ERR_OFFLINE;
goto done;
goto done;
}
done:
return;
}
}
{
return EOK;
}
struct ipa_subdomains_handler_state {
};
static struct tevent_req *
struct ipa_subdomains_ctx *sd_ctx,
struct dp_subdomains_data *data,
struct dp_req_params *params)
{
struct ipa_subdomains_handler_state);
return NULL;
}
"nothing to do\n");
goto immediately;
}
goto immediately;
}
return req;
/* TODO For backward compatibility we always return EOK to DP now. */
return req;
}
{
}
/* TODO For backward compatibility we always return EOK to DP now. */
}
struct tevent_req *req,
struct dp_reply_std *data)
{
return EOK;
}
static struct tevent_req *
struct tevent_context *ev,
void *pvt)
{
}
static errno_t
{
return ipa_subdomains_refresh_recv(req);
}
struct ipa_id_ctx *ipa_id_ctx,
struct dp_method *dp_methods)
{
return ENOMEM;
}
"Subdomains Refresh", NULL);
/* Ignore, responders will trigger refresh from time to time. */
}
"Users from trusted domains might not be resolved correctly\n");
/* Ignore this error and try to discover the subdomains later */
}
return ret;
}
return EOK;
}