>From b73aa60f6cddc6b002aa50987af349f8999d24ed Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Wed, 24 Apr 2013 20:26:40 +0200 Subject: [PATCH] SUDO: IPA provider This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733 --- Makefile.am | 5 +++ src/config/SSSDConfigTest.py | 4 +- src/config/etc/sssd.api.d/sssd-ipa.conf | 21 ++++++++++ src/man/sssd-sudo.5.xml | 28 +------------ src/providers/ipa/ipa_common.h | 5 +++ src/providers/ipa/ipa_init.c | 24 ++++++++++++ src/providers/ipa/ipa_sudo.c | 69 +++++++++++++++++++++++++++++++++ 7 files changed, 127 insertions(+), 29 deletions(-) create mode 100644 src/providers/ipa/ipa_sudo.c diff --git a/Makefile.am b/Makefile.am index c6dfcb2c75c9d03197f3d55ce135de05ab8feef8..a4f3ee9cac3f062665c7f00f3fb09fd42f7dd729 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1547,6 +1547,11 @@ libsss_ipa_la_SOURCES += \ src/providers/ipa/ipa_autofs.c endif +if BUILD_SUDO +libsss_ipa_la_SOURCES += \ + src/providers/ipa/ipa_sudo.c +endif + if BUILD_SSH libsss_ipa_la_SOURCES += src/providers/ipa/ipa_hostid.c endif diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py index 6ae458b1a438ff0bb7b2e10765b1fff3f5494163..79a290b81cbd7737c800df3b3096f7d0c456509e 100755 --- a/src/config/SSSDConfigTest.py +++ b/src/config/SSSDConfigTest.py @@ -715,8 +715,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): domain = SSSDConfig.SSSDDomain('sssd', self.schema) control_provider_dict = { - 'ipa': ['id', 'auth', 'access', 'chpass', 'autofs', 'session', - 'hostid', 'subdomains'], + 'ipa': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs', + 'session','hostid', 'subdomains'], 'ad': ['id', 'auth', 'access', 'chpass'], 'local': ['id', 'auth', 'chpass'], 'ldap': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs'], diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf index e88e32b1a2c522aac89559657ec2dc3609193bb5..e6f1bb0a88dd72a5f7bfcb269fa4736e7efd947c 100644 --- a/src/config/etc/sssd.api.d/sssd-ipa.conf +++ b/src/config/etc/sssd.api.d/sssd-ipa.conf @@ -194,3 +194,24 @@ ipa_selinux_usermap_uuid = str, None, false [provider/ipa/subdomains] ipa_subdomains_search_base = str, None, false + +[provider/ipa/sudo] +ldap_sudo_search_base = str, None, false +ldap_sudo_full_refresh_interval = int, None, false +ldap_sudo_smart_refresh_interval = int, None, false +ldap_sudo_use_host_filter = bool, None, false +ldap_sudo_hostnames = str, None, false +ldap_sudo_ip = str, None, false +ldap_sudo_include_netgroups = bool, None, false +ldap_sudo_include_regexp = bool, None, false +ldap_sudorule_object_class = str, None, false +ldap_sudorule_name = str, None, false +ldap_sudorule_command = str, None, false +ldap_sudorule_host = str, None, false +ldap_sudorule_user = str, None, false +ldap_sudorule_option = str, None, false +ldap_sudorule_runasuser = str, None, false +ldap_sudorule_runasgroup = str, None, false +ldap_sudorule_notbefore = str, None, false +ldap_sudorule_notafter = str, None, false +ldap_sudorule_order = str, None, false diff --git a/src/man/sssd-sudo.5.xml b/src/man/sssd-sudo.5.xml index fec81533d9351c5ed8711c1649fe49a3939f8448..d3ab9c864ac65365e804f6cfe4d133e216b3e76c 100644 --- a/src/man/sssd-sudo.5.xml +++ b/src/man/sssd-sudo.5.xml @@ -89,33 +89,7 @@ ldap_sudo_search_base = ou=sudoers,dc=example,dc=com - The following example illustrates setting up SSSD to download - sudo rules from an IPA server. It is necessary to use the LDAP - provider and set appropriate connection parameters to authenticate - correctly against the IPA server, because SSSD does not have native - support of IPA provider for sudo yet. - - - -[sssd] -config_file_version = 2 -services = nss, pam, sudo -domains = EXAMPLE - -[domain/EXAMPLE] -id_provider = ipa -ipa_domain = example.com -ipa_server = ipa.example.com -ldap_tls_cacert = /etc/ipa/ca.crt - -sudo_provider = ldap -ldap_uri = ldap://ipa.example.com -ldap_sudo_search_base = ou=sudoers,dc=example,dc=com -ldap_sasl_mech = GSSAPI -ldap_sasl_authid = host/hostname.example.com -ldap_sasl_realm = EXAMPLE.COM -krb5_server = ipa.example.com - + SSSD has native support of IPA provider for sudo compat tree. diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index ae1c91731e9637c06dad555d1a87ef2e0cf53184..d5c10a518a822060d1989b62f30544ee01c13dd0 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -180,4 +180,9 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx, struct ipa_options *options, struct ipa_service **_service); +int ipa_sudo_init(struct be_ctx *be_ctx, + struct ipa_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data); + #endif /* _IPA_COMMON_H_ */ diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c index b65a6cea1ddd05272a8ae522be5c8b070a93ac1e..0e9fe0dd185e7b237bf4cda077e872dfd0d07fe2 100644 --- a/src/providers/ipa/ipa_init.c +++ b/src/providers/ipa/ipa_init.c @@ -526,3 +526,27 @@ int sssm_ipa_subdomains_init(struct be_ctx *bectx, return EOK; } + +int sssm_ipa_sudo_init(struct be_ctx *bectx, + struct bet_ops **ops, + void **pvt_data) +{ +#ifdef BUILD_SUDO + struct ipa_id_ctx *id_ctx; + int ret; + + DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing IPA sudo handler\n")); + + ret = sssm_ipa_id_init(bectx, ops, (void **) &id_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("sssm_ipa_id_init failed.\n")); + return ret; + } + + return ipa_sudo_init(bectx, id_ctx, ops, pvt_data); +#else + DEBUG(SSSDBG_MINOR_FAILURE, ("Sudo init handler called but SSSD is " + "built without sudo support, ignoring\n")); + return EOK; +#endif +} diff --git a/src/providers/ipa/ipa_sudo.c b/src/providers/ipa/ipa_sudo.c new file mode 100644 index 0000000000000000000000000000000000000000..e512ddf5131971f2a2fa401534432855f116bcc4 --- /dev/null +++ b/src/providers/ipa/ipa_sudo.c @@ -0,0 +1,69 @@ +/* + SSSD + + IPA Provider Initialization functions + + Authors: + Lukas Slebodnik + + Copyright (C) 2013 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + */ + +#include "providers/ipa/ipa_common.h" +#include "providers/ipa/ipa_id.h" +#include "providers/ipa/ipa_auth.h" + +#include "providers/ldap/sdap_sudo.h" +#include "db/sysdb_sudo.h" + +struct bet_ops ipa_sudo_ops = { + .handler = sdap_sudo_handler, + .finalize = NULL, + .check_online = sdap_check_online +}; + +int ipa_sudo_init(struct be_ctx *be_ctx, + struct ipa_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data) +{ + int ret; + struct ipa_options *ipa_options; + struct sdap_options *ldap_options; + + DEBUG(SSSDBG_TRACE_INTERNAL, ("Initializing sudo IPA back end\n")); + + /* + * SDAP_SUDO_SEARCH_BASE has already been initialized in + * function ipa_get_id_options + */ + ret = sdap_sudo_init(be_ctx, id_ctx->sdap_id_ctx, ops, pvt_data); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Cannot initialize LDAP SUDO [%d]: %s\n", + ret, strerror(ret))); + return ret; + } + + /* We override ops configured in sdap_sudo_init with IPA specific.*/ + *ops = &ipa_sudo_ops; + + ipa_options = id_ctx->ipa_options; + ldap_options = id_ctx->sdap_id_ctx->opts; + + ipa_options->id->sudorule_map = talloc_move(ipa_options->id, + &ldap_options->sudorule_map); + return EOK; +} -- 1.8.1.4