>From 09ba8e4118f4d15aee77a2339924c6370d949e89 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 17 Jun 2013 09:32:07 +0200 Subject: [PATCH 1/8] IPA: Add a server mode option https://fedorahosted.org/sssd/ticket/1993 SSSD needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, is introduced which defaults to false but is set to true during ipa-server-install or during updates of the FreeIPA server if it is not already set. --- src/config/etc/sssd.api.d/sssd-ipa.conf | 1 + src/man/sssd-ipa.5.xml | 19 +++++++++++++++++++ src/providers/ipa/ipa_common.h | 1 + src/providers/ipa/ipa_opts.h | 1 + 4 files changed, 22 insertions(+) diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf index 8a7e75f2a820e5fac604201586257342787d4a01..bc14fbe3d4153bd7a7ca4ffe0351edf0b8c02ee4 100644 --- a/src/config/etc/sssd.api.d/sssd-ipa.conf +++ b/src/config/etc/sssd.api.d/sssd-ipa.conf @@ -128,6 +128,7 @@ ldap_idmap_default_domain_sid = str, None, false ldap_groups_use_matching_rule_in_chain = bool, None, false ldap_initgroups_use_matching_rule_in_chain = bool, None, false ldap_rfc2307_fallback_to_local_users = bool, None, false +ipa_server_mode = bool, None, false [provider/ipa/auth] krb5_ccachedir = str, None, false diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml index a0c2c3460ac714cd849c176866723eaf90e9920a..2eebe70ffd40060f6aefe072da2b0717fc0d52c4 100644 --- a/src/man/sssd-ipa.5.xml +++ b/src/man/sssd-ipa.5.xml @@ -457,6 +457,7 @@ + ipa_hbac_support_srchost (boolean) @@ -475,6 +476,24 @@ + + ipa_server_mode (boolean) + + + This options should only be set by the IPA + installer. + + + The option denotes that the SSSD is running on + IPA server and should perform lookups of users + and groups from trusted domains differently. + + + Default: false + + + + ipa_automount_location (string) diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index 8bf2d3e17596499cc2625174d80a9c7bf16f8a8c..43ccb8e0a30b76da53b0a865b517194fc4a4d7d7 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -50,6 +50,7 @@ enum ipa_basic_opt { IPA_AUTOMOUNT_LOCATION, IPA_RANGES_SEARCH_BASE, IPA_ENABLE_DNS_SITES, + IPA_SERVER_MODE, IPA_OPTS_BASIC /* opts counter */ }; diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h index 139008b1a2df925f7ddfb3efc91fd23adf3cde2d..9babca73f4cf2e48ec7dff085870fa69429053df 100644 --- a/src/providers/ipa/ipa_opts.h +++ b/src/providers/ipa/ipa_opts.h @@ -48,6 +48,7 @@ struct dp_option ipa_basic_opts[] = { { "ipa_automount_location", DP_OPT_STRING, { "default" }, NULL_STRING }, { "ipa_ranges_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ipa_enable_dns_sites", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "ipa_server_mode", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, DP_OPTION_TERMINATOR }; -- 1.8.3.1