[PATCH] PAM: Add domains= option to pam_sss
by Daniel Gollub
Fixes:
https://fedorahosted.org/sssd/ticket/1021
Signed-off-by: Daniel Gollub <dgollub(a)brocade.com>
Reviewed-by: Sven-Thorsten Dietrich <sven(a)brocade.com>
---
src/providers/data_provider.h | 1 +
src/responder/pam/pamsrv_cmd.c | 44 +++++++++++++++++++++++++++++++++++++++++-
src/sss_client/pam_sss.c | 29 ++++++++++++++++++++++++++--
src/sss_client/sss_cli.h | 1 +
4 files changed, 72 insertions(+), 3 deletions(-)
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index ebb4fad..0abfd0f 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -170,6 +170,7 @@ struct pam_data {
char *tty;
char *ruser;
char *rhost;
+ char **requested_domains;
struct sss_auth_token *authtok;
struct sss_auth_token *newauthtok;
uint32_t cli_pid;
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 140d541..c6539e5 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -44,6 +44,26 @@ enum pam_verbosity {
static void pam_reply(struct pam_auth_req *preq);
+static bool is_domain_requested(struct pam_data *pd, const char *domain_name)
+{
+ int i;
+
+ /* If none specific domains got requested via pam, all domains are allowed.
+ * Which mimics the default/original behaviour.
+ */
+ if (!pd->requested_domains)
+ return true;
+
+ for (i = 0; pd->requested_domains[i]; i++) {
+ if (strcmp(domain_name, pd->requested_domains[i]))
+ continue;
+
+ return true;
+ }
+
+ return false;
+}
+
static int extract_authtok_v2(struct sss_auth_token *tok,
size_t data_size, uint8_t *body, size_t blen,
size_t *c)
@@ -146,6 +166,7 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
int ret;
uint32_t start;
uint32_t terminator;
+ char *requested_domains;
if (blen < 4*sizeof(uint32_t)+2) {
DEBUG(SSSDBG_CRIT_FAILURE, "Received data is invalid.\n");
@@ -202,6 +223,16 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
ret = extract_string(&pd->rhost, size, body, blen, &c);
if (ret != EOK) return ret;
break;
+ case SSS_PAM_ITEM_REQUESTED_DOMAINS:
+ ret = extract_string(&requested_domains, size, body, blen, &c);
+ if (ret != EOK) return ret;
+ ret = split_on_separator(pd, requested_domains, ',', true, true,
+ &pd->requested_domains, NULL);
+ if (ret != EOK) {
+ DEBUG(1, ("Failed to parse requested_domains list!\n"));
+ return ret;
+ }
+ break;
case SSS_PAM_ITEM_CLI_PID:
ret = extract_uint32_t(&pd->cli_pid, size,
body, blen, &c);
@@ -836,12 +867,22 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
ret = ENOENT;
goto done;
}
+
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name)) {
+ ret = ENOENT;
+ goto done;
+ }
} else {
for (dom = preq->cctx->rctx->domains;
dom;
dom = get_next_domain(dom, false)) {
if (dom->fqnames) continue;
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name))
+ continue;
+
ncret = sss_ncache_check_user(pctx->ncache, pctx->neg_timeout,
dom, pd->user);
if (ncret == ENOENT) {
@@ -856,7 +897,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
"User [%s@%s] filtered out (negative cache). "
"Trying next domain.\n", pd->user, dom->name);
}
- if (!dom) {
+
+ if (!dom || !is_domain_requested(pd, dom->name)) {
ret = ENOENT;
goto done;
}
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index d2502d1..4d76bd2 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -58,6 +58,7 @@
#define PW_RESET_MSG_MAX_SIZE 4096
#define OPT_RETRY_KEY "retry="
+#define OPT_DOMAINS_KEY "domains="
struct pam_items {
const char* pam_service;
@@ -81,6 +82,8 @@ struct pam_items {
pid_t cli_pid;
const char *login_name;
char *domain_name;
+ const char *requested_domains;
+ size_t requested_domains_size;
};
#define DEBUG_MGS_LEN 1024
@@ -246,6 +249,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
len += pi->pam_newauthtok != NULL ?
3*sizeof(uint32_t) + pi->pam_newauthtok_size : 0;
len += 3*sizeof(uint32_t); /* cli_pid */
+ len += *pi->requested_domains != '\0' ?
+ 2*sizeof(uint32_t) + pi->requested_domains_size : 0;
+
buf = malloc(len);
if (buf == NULL) {
@@ -271,6 +277,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
rp += add_string_item(SSS_PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size,
&buf[rp]);
+ rp += add_string_item(SSS_PAM_ITEM_REQUESTED_DOMAINS, pi->requested_domains, pi->requested_domains_size,
+ &buf[rp]);
+
rp += add_uint32_t_item(SSS_PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid,
&buf[rp]);
@@ -1061,6 +1070,9 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
pi->domain_name = NULL;
+ if (pi->requested_domains == NULL) pi->requested_domains="";
+ pi->requested_domains_size=strlen(pi->requested_domains)+1;
+
return PAM_SUCCESS;
}
@@ -1080,6 +1092,7 @@ static void print_pam_items(struct pam_items *pi)
D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok)));
D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok)));
D(("Cli_PID: %d", pi->cli_pid));
+ D(("Requested domains: %s", pi->requested_domains));
}
static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
@@ -1271,7 +1284,8 @@ static int prompt_new_password(pam_handle_t *pamh, struct pam_items *pi)
}
static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
- uint32_t *flags, int *retries, bool *quiet_mode)
+ uint32_t *flags, int *retries, bool *quiet_mode,
+ const char **domains)
{
char *ep;
@@ -1284,6 +1298,14 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
*flags |= FLAGS_USE_FIRST_PASS;
} else if (strcmp(*argv, "use_authtok") == 0) {
*flags |= FLAGS_USE_AUTHTOK;
+ } else if (strncmp(*argv, OPT_DOMAINS_KEY, strlen(OPT_DOMAINS_KEY)) == 0) {
+ if (*(*argv+strlen(OPT_DOMAINS_KEY)) == '\0') {
+ logger(pamh, LOG_ERR, "Missing argument to option domains.");
+ *domains = '\0';
+ } else {
+ *domains = *argv+strlen(OPT_DOMAINS_KEY);
+ }
+
} else if (strncmp(*argv, OPT_RETRY_KEY, strlen(OPT_RETRY_KEY)) == 0) {
if (*(*argv+6) == '\0') {
logger(pamh, LOG_ERR, "Missing argument to option retry.");
@@ -1443,12 +1465,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
bool retry = false;
bool quiet_mode = false;
int retries = 0;
+ const char *domains = NULL;
bindtextdomain(PACKAGE, LOCALEDIR);
D(("Hello pam_sssd: %d", task));
- eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode);
+ eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode, &domains);
+
+ pi.requested_domains = domains;
ret = get_pam_items(pamh, &pi);
if (ret != PAM_SUCCESS) {
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index 16a08e1..15f8322 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -314,6 +314,7 @@ enum pam_item_type {
SSS_PAM_ITEM_NEWAUTHTOK,
SSS_PAM_ITEM_CLI_LOCALE,
SSS_PAM_ITEM_CLI_PID,
+ SSS_PAM_ITEM_REQUESTED_DOMAINS,
};
#define SSS_NSS_MAX_ENTRIES 256
--
1.9.1
9 years, 7 months
sss_cache flush ssh hosts list.
by William
Hi,
I have been working on sssd being able to flush hosts from it's cache.
Here is an initial patch to add the options to the cli of sss_cache.
I have noticed that there are some methods already in src/db/sysdb_ssh.c
like sysdb_update_ssh_known_host_expire: Does that seem like the right
function to call to expire a host?
Advice is appreciated.
--
William Brown <william(a)firstyear.id.au>
9 years, 7 months
[sssd][patch] SYSDB: sysdb_getnetgr returns ENOENT
by Pavel Reichl
Hello,
attached patch is the first of many to solve
https://fedorahosted.org/sssd/ticket/1991
"The return codes of various sysdb operations differ. Some search
operations would return ENOENT if they don't find a matching object some
would return EOK but an empty result list."
I think it would be best if in case that no results were found both
ENOENT value and 'properly' empty list were returned.
Thank for opinions or/and review.
Pavel Reichl
9 years, 7 months
[PATCH] SPEC: Drop rhel5 conditions in spec file.
by Lukas Slebodnik
ehlo,
In theory, it could be possible to build current master without samba
on rhel5, but the spec file would be very complicated.
It is better to simplify spec file.
Patch is attached.
1 file changed, 43 deletions(-) :-)
LS
9 years, 7 months
[PATCH] libwbclient: SSSD implementation
by Sumit Bose
Hi,
this patch contains the libwbclient implementation for SSSD to allow
Samba file-servers and utilities to use SSSD instead of winbind to map
SIDs, names and POSIX IDs. The related ticket is
https://fedorahosted.org/sssd/ticket/1588.
The SSSD specific calls can be found in files with '_sssd' as part of
the name, the other files are mainly taken from the original Samba
sources because they contain API calls which are independent of the
backend. I have made some minor modification to meet the SSSD coding
style but tried to avoid major changes to make a diff to the original
version more easy. If major issue are found during review I think it
would be a good idea to try to bring the changes back to samba as well.
In wbc_pwd_sssd.c instead of linking in the related sources of the NSS
client I dlopen-ed libnss_sss.so.2 to have more flexibility about where
and how to build the library. I you think this is too much overhead I'd
be happy to change the code to use the NSS client call directly.
The patch does not contain unit test because the Samba source code
already contains some basic tests. I'll try to work with the samba
package maintainer to make this code in a samba-devel or samba-test
package available so that it can be used by SSSD as well.
Basic functional test can be run manually with wbinfo, e.g.:
$ /usr/bin/wbinfo -n 'AD18\Administrator'
S-1-5-21-3090815309-2627318493-3395719201-500 SID_USER (1)
$ /usr/bin/wbinfo -S S-1-5-21-3090815309-2627318493-3395719201-500
1670800500
bye,
Sumit
9 years, 7 months
[PATCH v3 0/4] NFSv4 rpc.idmapd plugin
by Noam Meltzer
Follow patches are the code implementing design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
* rebase over rev. 8ca18752 (current master)
* remove man pages from the patch (will be sent separately)
* add new contact details for plugin author
* code style
* remove sss_nfs_make_request() wrapper
* fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4):
NEW CLIENT: plugin for NFSv4 rpc.idmapd
NFSv4 client: (private) headers from libnfsidmap
NFSv4 client: add to build system
NFSv4 client: add to RPM spec
Makefile.am | 24 ++
configure.ac | 10 +
contrib/sssd.spec.in | 7 +
src/conf_macros.m4 | 30 ++
src/external/libnfsidmap.m4 | 17 +
src/sss_client/nfs/nfsidmap_internal.h | 78 +++++
src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++
7 files changed, 737 insertions(+)
create mode 100644 src/external/libnfsidmap.m4
create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
create mode 100644 src/sss_client/nfs/sss_nfs_client.c
--
1.9.1
9 years, 7 months
[PATCHES] Implement MIT Kerberos localauth plugin
by Sumit Bose
Hi,
these two patches implement the MIT Kerberos localauth plugin for SSSD.
Since it uses the new plugin style
(http://k5wiki.kerberos.org/wiki/Projects/Plugin_support_improvements)
it has to be activated explicitly. A section like
[plugins]
localauth = {
module = sssd:/path/to/plugin/sssd_krb5_localauth_plugin.so
enable_only = sssd
}
Should work. Please note that this example deactivates any other
mechanism, e.g. .k5login files. See krb5.conf man page of MIT Kerberos
1.12 how to active the mechanism as well.
One of the main use cases for this plugin is an IPA environment with
trust to AD. Currently AD user who want to use SSO with IPA client needed
a .k5login file in their home directory containing their Kerberos
principal. Alternatively krb5.conf has to be edited but here the names
user at the login prompt has to follow a fixed format and are case
sensitive. If the localauth plugin is activated the mapping of Kerberos
principal and user name is done by SSSD.
While I was testing the plugin with ssh I found that st least the Fedora
and RHEL versions of the sshd do not rely completely in the Kerberos
libraries here but do some checks on their own, especially they check
for the existence of the .k5login file in the default configuration.
This check can be disabled by setting KerberosUseKuserok to 'no' but
then sshd does not call krb5_userok() but the more restrictive
krb5_aname_to_localname() and does case sensitive checks on the related
names which won't help much in out case. As a result a .k5login file is
still needed when testing with ssh but it can be empty or contain random
content. I will investigate why OpenSSH is patched in this way on Fedora
and RHEL.
bye,
Sumit
9 years, 7 months