>From 86a9c9b155b45d2c3d09356b923cf30ca3e00b2d Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Fri, 3 Feb 2012 22:29:47 +0100
Subject: [PATCH 3/9] LDAP: Add support for SSH user public keys

---
 src/db/sysdb.h                        |    2 ++
 src/providers/ipa/ipa_common.c        |    3 ++-
 src/providers/ldap/ldap_common.c      |    6 ++++--
 src/providers/ldap/sdap.h             |    1 +
 src/providers/ldap/sdap_async_users.c |   28 ++++++++++++++++++++++++++++
 5 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index 31b988e..fd6d534 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -109,6 +109,8 @@
 #define SYSDB_USN "entryUSN"
 #define SYSDB_HIGH_USN "highestUSN"
 
+#define SYSDB_SSH_PUBKEY "sshPublicKey"
+
 #define SYSDB_NEXTID_FILTER "("SYSDB_NEXTID"=*)"
 
 #define SYSDB_UC "objectclass="SYSDB_USER_CLASS
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index ba22830..790adb7 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -149,7 +149,8 @@ struct sdap_attr_map ipa_user_map[] = {
     { "ldap_user_authorized_host", "host", SYSDB_AUTHORIZED_HOST, NULL },
     { "ldap_user_nds_login_disabled", "loginDisabled", SYSDB_NDS_LOGIN_DISABLED, NULL },
     { "ldap_user_nds_login_expiration_time", "loginExpirationTime", SYSDB_NDS_LOGIN_EXPIRATION_TIME, NULL },
-    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL }
+    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL },
+    { "ldap_user_ssh_public_key", "ipaSshPubKey", SYSDB_SSH_PUBKEY, NULL }
 };
 
 struct sdap_attr_map ipa_group_map[] = {
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 786e06b..061528d 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -150,7 +150,8 @@ struct sdap_attr_map rfc2307_user_map[] = {
     { "ldap_user_authorized_host", "host", SYSDB_AUTHORIZED_HOST, NULL },
     { "ldap_user_nds_login_disabled", "loginDisabled", SYSDB_NDS_LOGIN_DISABLED, NULL },
     { "ldap_user_nds_login_expiration_time", "loginExpirationTime", SYSDB_NDS_LOGIN_EXPIRATION_TIME, NULL },
-    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL }
+    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL },
+    { "ldap_user_ssh_public_key", NULL, SYSDB_SSH_PUBKEY, NULL }
 };
 
 struct sdap_attr_map rfc2307_group_map[] = {
@@ -197,7 +198,8 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
     { "ldap_user_authorized_host", "host", SYSDB_AUTHORIZED_HOST, NULL },
     { "ldap_user_nds_login_disabled", "loginDisabled", SYSDB_NDS_LOGIN_DISABLED, NULL },
     { "ldap_user_nds_login_expiration_time", "loginExpirationTime", SYSDB_NDS_LOGIN_EXPIRATION_TIME, NULL },
-    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL }
+    { "ldap_user_nds_login_allowed_time_map", "loginAllowedTimeMap", SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL },
+    { "ldap_user_ssh_public_key", NULL, SYSDB_SSH_PUBKEY, NULL }
 };
 
 struct sdap_attr_map rfc2307bis_group_map[] = {
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 7bf1805..8a827ff 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -255,6 +255,7 @@ enum sdap_user_attrs {
     SDAP_AT_NDS_LOGIN_DISABLED,
     SDAP_AT_NDS_LOGIN_EXPIRATION_TIME,
     SDAP_AT_NDS_LOGIN_ALLOWED_TIME_MAP,
+    SDAP_AT_USER_SSH_PUBLIC_KEY,
 
     SDAP_OPTS_USER /* attrs counter */
 };
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index ac856a6..c4fa968 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -22,6 +22,7 @@
 */
 
 #include "util/util.h"
+#include "util/crypto/sss_crypto.h"
 #include "db/sysdb.h"
 #include "providers/ldap/sdap_async_private.h"
 #include "providers/ldap/ldap_common.h"
@@ -55,6 +56,7 @@ int sdap_save_user(TALLOC_CTX *memctx,
     char *usn_value = NULL;
     char **missing = NULL;
     TALLOC_CTX *tmpctx = NULL;
+    char *sshpubkey;
 
     DEBUG(9, ("Save user\n"));
 
@@ -228,6 +230,8 @@ int sdap_save_user(TALLOC_CTX *memctx,
     }
 
     for (i = SDAP_FIRST_EXTRA_USER_AT; i < SDAP_OPTS_USER; i++) {
+        if (i == SDAP_AT_USER_SSH_PUBLIC_KEY) continue;
+
         ret = sdap_attrs_add_list(attrs, opts->user_map[i].sys_name,
                                   NULL, name, user_attrs);
         if (ret) {
@@ -235,6 +239,30 @@ int sdap_save_user(TALLOC_CTX *memctx,
         }
     }
 
+    /* base64 encode sshPublicKey and add it to user_attrs */
+    ret = sysdb_attrs_get_el(attrs,
+            opts->user_map[SDAP_AT_USER_SSH_PUBLIC_KEY].sys_name, &el);
+    if (ret) {
+        goto fail;
+    }
+
+    for (i = 0; i < el->num_values; i++) {
+        sshpubkey = sss_base64_encode(user_attrs,
+                                      el->values[i].data,
+                                      el->values[i].length);
+        if (!sshpubkey) {
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        ret = sysdb_attrs_add_string(user_attrs,
+                opts->user_map[SDAP_AT_USER_SSH_PUBLIC_KEY].sys_name,
+                sshpubkey);
+        if (ret) {
+            goto fail;
+        }
+    }
+
     cache_timeout = dp_opt_get_int(opts->basic, SDAP_ENTRY_CACHE_TIMEOUT);
 
     if (is_initgr) {
-- 
1.7.6.5

