URL: https://github.com/SSSD/sssd/pull/488 Author: sumit-bose Title: #488: Two fixes for certificates in idoverrides Action: opened
PR body: """ ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides Recent changes to support a rule based mapping between users and certificates were not properly added for the case where a certificate was added to an idoverride for a user. As a result authentication with the certificate from the idoveride was not possible. With this patch the certificate from to idoveride is properly added to the cache. Related to https://pagure.io/SSSD/sssd/issue/3603 ipa: remove SYSDB_USER_CERT from sub-domain users If there are no certificates returned for a sub-domain user from the IPA server to the client we should make sure they are not present in the client's cache anymore and remove the whole attribute from the cached user entry. Related to https://pagure.io/SSSD/sssd/issue/3603 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/488/head:pr488 git checkout pr488
From 4cee7b8e580d1e48cfc85c1ae146894e25a0262a Mon Sep 17 00:00:00 2001 From: Sumit Bose <[email protected]> Date: Mon, 8 Jan 2018 18:23:50 +0100 Subject: [PATCH 1/2] ipa: remove SYSDB_USER_CERT from sub-domain users If there are no certificates returned for a sub-domain user from the IPA server to the client we should make sure they are not present in the client's cache anymore and remove the whole attribute from the cached user entry. Related to https://pagure.io/SSSD/sssd/issue/3603 --- src/providers/ipa/ipa_s2n_exop.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c index 8b97f7862..37bfa5224 100644 --- a/src/providers/ipa/ipa_s2n_exop.c +++ b/src/providers/ipa/ipa_s2n_exop.c @@ -2193,7 +2193,11 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom, struct sysdb_attrs *gid_override_attrs = NULL; struct ldb_message *msg; struct ldb_message_element *el = NULL; - const char *missing[] = {NULL, NULL}; + + /* SYSDB_ORIG_MEMBEROF and/or SYSDB_USER_CERT might be missing, the + * missing array will 3 entries including the trailing NULL at the end. */ + size_t missing_count = 0; + const char *missing[] = {NULL, NULL, NULL}; tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) { @@ -2435,7 +2439,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom, ret = sysdb_attrs_get_el_ext(attrs->sysdb_attrs, SYSDB_ORIG_MEMBEROF, false, &el); if (ret == ENOENT) { - missing[0] = SYSDB_ORIG_MEMBEROF; + missing[missing_count++] = SYSDB_ORIG_MEMBEROF; + } + + ret = sysdb_attrs_get_el_ext(attrs->sysdb_attrs, + SYSDB_USER_CERT, false, &el); + if (ret == ENOENT) { + missing[missing_count++] = SYSDB_USER_CERT; } ret = sysdb_transaction_start(dom->sysdb); From f44a3dc7e629d0a148bd1930530d0dc7fd6a2663 Mon Sep 17 00:00:00 2001 From: Sumit Bose <[email protected]> Date: Mon, 8 Jan 2018 18:24:35 +0100 Subject: [PATCH 2/2] ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides Recent changes to support a rule based mapping between users and certificates were not properly added for the case where a certificate was added to an idoverride for a user. As a result authentication with the certificate from the idoveride was not possible. With this patch the certificate from to idoveride is properly added to the cache. Related to https://pagure.io/SSSD/sssd/issue/3603 --- src/providers/ipa/ipa_subdomains_id.c | 78 +++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c index d40671086..3761d061a 100644 --- a/src/providers/ipa/ipa_subdomains_id.c +++ b/src/providers/ipa/ipa_subdomains_id.c @@ -60,6 +60,8 @@ struct ipa_subdomain_account_state { const char *filter; int filter_type; struct sysdb_attrs *override_attrs; + struct sysdb_attrs *mapped_attrs; + char *object_sid; int dp_error; }; @@ -110,6 +112,7 @@ struct tevent_req *ipa_subdomain_account_send(TALLOC_CTX *memctx, state->ipa_server_mode = dp_opt_get_bool(state->ipa_ctx->ipa_options->basic, IPA_SERVER_MODE); state->override_attrs = NULL; + state->mapped_attrs = NULL; /* With views we cannot got directly to the look up the AD objects but * have to check first if the request matches an override in the given @@ -209,8 +212,34 @@ static void ipa_subdomain_account_got_override(struct tevent_req *subreq) goto fail; } + if (state->ar->filter_type == BE_FILTER_CERT + && is_default_view(state->ipa_ctx->view_name)) { + /* The override data was found with a lookup by certificate. for the + * default view the certificate will be added to + * SYSDB_USER_MAPPED_CERT so that cache lookups will find the same + * user. If no override data was found the mapping (if any) should be + * removed. For other view this is not needed because the override + * certificate is store in the cached override object in this case. */ + state->mapped_attrs = sysdb_new_attrs(state); + if (state->mapped_attrs == NULL) { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_new_attrs failed, ignored.\n"); + } else { + ret = sysdb_attrs_add_base64_blob(state->mapped_attrs, + SYSDB_USER_MAPPED_CERT, + state->ar->filter_value); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_attrs_add_base64_blob failed, ignored.\n"); + talloc_free(state->mapped_attrs); + state->mapped_attrs = NULL; + } + } + } + if (state->override_attrs != NULL) { DEBUG(SSSDBG_TRACE_ALL, "Processing override.\n"); + ret = sysdb_attrs_get_string(state->override_attrs, SYSDB_OVERRIDE_ANCHOR_UUID, &anchor); @@ -230,6 +259,18 @@ static void ipa_subdomain_account_got_override(struct tevent_req *subreq) goto fail; } + if (state->mapped_attrs != NULL) { + /* save the SID so that SYSDB_USER_MAPPED_CERT can be added + * later to the object */ + state->object_sid = talloc_strdup(state, ar->filter_value); + if (state->object_sid == NULL) { + DEBUG(SSSDBG_OP_FAILURE, + "talloc_strdup failed, ignored.\n"); + talloc_free(state->mapped_attrs); + state->mapped_attrs = NULL; + } + } + if (state->ipa_server_mode && (state->ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_INITGROUPS) { @@ -245,6 +286,17 @@ static void ipa_subdomain_account_got_override(struct tevent_req *subreq) goto fail; } } else { + if (state->mapped_attrs != NULL) { + /* remove certifcate (if any) if no matching override was found */ + ret = sysdb_remove_mapped_data(state->domain, state->mapped_attrs); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "sysdb_remove_mapped_data failed, " + "some cached entries might contain " + "invalid mapping data.\n"); + } + talloc_free(state->mapped_attrs); + state->mapped_attrs = NULL; + } ar = state->ar; } @@ -297,6 +349,8 @@ static void ipa_subdomain_account_done(struct tevent_req *subreq) struct ipa_subdomain_account_state); int dp_error = DP_ERR_FATAL; int ret; + struct ldb_result *res; + struct sss_domain_info *object_dom; if (state->ipa_server_mode) { ret = ipa_srv_ad_acct_recv(subreq, &dp_error); @@ -312,6 +366,30 @@ static void ipa_subdomain_account_done(struct tevent_req *subreq) return; } + if (state->mapped_attrs != NULL) { + object_dom = sss_get_domain_by_sid_ldap_fallback(state->domain, + state->object_sid); + ret = sysdb_search_object_by_sid(state, + object_dom != NULL ? object_dom + : state->domain, + state->object_sid, NULL, &res); + if (ret == EOK) { + ret = sysdb_set_entry_attr(state->domain->sysdb, res->msgs[0]->dn, + state->mapped_attrs, SYSDB_MOD_ADD); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_set_entry_attr failed, ignoring.\n"); + } + } else if (ret == ENOENT) { + DEBUG(SSSDBG_TRACE_ALL, "No cached object found, cannot add " + "mapped attribute, ignoring.\n"); + } else { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_search_object_by_sid failed, cannot add mapped " + "attribute, ignoring.\n"); + } + } + state->dp_error = DP_ERR_OK; tevent_req_done(req); return;
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
