From 0fc4a072783d8531d3fcc2072000351c880b9237 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 28 Sep 2010 15:43:31 +0200 Subject: [PATCH 7/9] Add infrastructure to LDAP provider for netgroup support --- src/config/etc/sssd.api.d/sssd-ipa.conf | 7 ++ src/config/etc/sssd.api.d/sssd-ldap.conf | 8 +++ src/config/upgrade_config.py | 7 ++ src/man/sssd-ldap.5.xml | 91 ++++++++++++++++++++++++++++++ src/providers/ipa/ipa_common.c | 35 +++++++++++- src/providers/ipa/ipa_common.h | 2 +- src/providers/ldap/ldap_common.c | 40 ++++++++++++- src/providers/ldap/sdap.h | 13 ++++ 8 files changed, 199 insertions(+), 4 deletions(-) diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf index ac68171..88ff0f0 100644 --- a/src/config/etc/sssd.api.d/sssd-ipa.conf +++ b/src/config/etc/sssd.api.d/sssd-ipa.conf @@ -70,6 +70,13 @@ ldap_group_member = str, None, false ldap_group_uuid = str, None, false ldap_group_modify_timestamp = str, None, false ldap_force_upper_case_realm = bool, None, false +ldap_netgroup_search_base = str, None, false +ldap_netgroup_object_class = str, None, false +ldap_netgroup_name = str, None, false +ldap_netgroup_member = str, None, false +ldap_netgroup_triple = str, None, false +ldap_netgroup_uuid = str, None, false +ldap_netgroup_modify_timestamp = str, None, false [provider/ipa/auth] krb5_ccachedir = str, None, false diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 7f0c360..38c75b2 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -63,6 +63,14 @@ ldap_group_member = str, None, false ldap_group_uuid = str, None, false ldap_group_modify_timestamp = str, None, false ldap_force_upper_case_realm = bool, None, false +ldap_netgroup_search_base = str, None, false +ldap_netgroup_object_class = str, None, false +ldap_netgroup_name = str, None, false +ldap_netgroup_member = str, None, false +ldap_netgroup_triple = str, None, false +ldap_netgroup_uuid = str, None, false +ldap_netgroup_modify_timestamp = str, None, false + [provider/ldap/auth] ldap_pwd_policy = str, None, false diff --git a/src/config/upgrade_config.py b/src/config/upgrade_config.py index ff22b48..62ffe52 100644 --- a/src/config/upgrade_config.py +++ b/src/config/upgrade_config.py @@ -193,6 +193,13 @@ class SSSDConfigFile(SSSDChangeConf): 'ldap_stale_time' : 'stale_time', 'ldap_opt_timeout' : 'opt_timeout', 'ldap_tls_reqcert' : 'tls_reqcert', + 'ldap_netgroup_search_base' : 'netgroupSearchBase', + 'ldap_netgroup_object_class' : 'netgroupObjectClass', + 'ldap_netgroup_name' : 'netgroupName', + 'ldap_netgroup_member' : 'netgroupMember', + 'ldap_netgroup_triple' : 'netgroupTriple', + 'ldap_netgroup_uuid' : 'netgroupUUID', + 'ldap_netgroup_modify_timestamp' : 'netgroupModifyTimestamp', } krb5_kw = { 'krb5_kdcip' : 'krb5KDCIP', 'krb5_realm' : 'krb5REALM', diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index b32096d..6442b8f 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -576,6 +576,97 @@ + ldap_netgroup_search_base (string) + + + An optional base DN to restrict netgroup searches + to a specific subtree. + + + Default: the value of + ldap_search_base + + + + + + ldap_netgroup_object_class (string) + + + The object class of a netgroup entry in LDAP. + + + Default: nisNetgroup + + + + + + ldap_netgroup_name (string) + + + The LDAP attribute that corresponds to + the netgroup name. + + + Default: cn + + + + + + ldap_netgroup_member (string) + + + The LDAP attribute that contains the names of + the netgroup's members. + + + Default: memberNisNetgroup + + + + + + ldap_netgroup_triple (string) + + + The LDAP attribute that contains the (host, user, + domain) netgroup triples. + + + Default: nisNetgroupTriple + + + + + + ldap_netgroup_uuid (string) + + + The LDAP attribute that contains the UUID/GUID of + an LDAP netgroup object. + + + Default: nsUniqueId + + + + + + ldap_netgroup_modify_timestamp (string) + + + The LDAP attribute that contains timestamp of the + last modification of the parent object. + + + Default: modifyTimestamp + + + + + ldap_search_timeout (integer) diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c index 99b1508..70b2af8 100644 --- a/src/providers/ipa/ipa_common.c +++ b/src/providers/ipa/ipa_common.c @@ -72,7 +72,8 @@ struct dp_option ipa_def_ldap_opts[] = { { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER }, { "ldap_dns_service_name", DP_OPT_STRING, { SSS_LDAP_SRV_NAME }, NULL_STRING }, { "ldap_krb5_ticket_lifetime", DP_OPT_NUMBER, { .number = (24 * 60 * 60) }, NULL_NUMBER }, - { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING } + { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_netgroup_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING } }; struct sdap_attr_map ipa_attr_map[] = { @@ -116,6 +117,15 @@ struct sdap_attr_map ipa_group_map[] = { { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL } }; +struct sdap_attr_map ipa_netgroup_map[] = { + { "ldap_netgroup_object_class", "nisNetgroup", SYSDB_NETGROUP_CLASS, NULL }, + { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL }, + { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL }, + { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL }, + { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL }, + { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL } +}; + struct dp_option ipa_def_krb5_opts[] = { { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING }, @@ -333,6 +343,20 @@ int ipa_get_id_options(struct ipa_options *ipa_opts, SDAP_GROUP_SEARCH_BASE))); } + if (NULL == dp_opt_get_string(ipa_opts->id->basic, + SDAP_NETGROUP_SEARCH_BASE)) { + ret = dp_opt_set_string(ipa_opts->id->basic, SDAP_NETGROUP_SEARCH_BASE, + dp_opt_get_string(ipa_opts->id->basic, + SDAP_SEARCH_BASE)); + if (ret != EOK) { + goto done; + } + DEBUG(6, ("Option %s set to %s\n", + ipa_opts->id->basic[SDAP_NETGROUP_SEARCH_BASE].opt_name, + dp_opt_get_string(ipa_opts->id->basic, + SDAP_NETGROUP_SEARCH_BASE))); + } + ret = sdap_get_map(ipa_opts->id, cdb, conf_path, ipa_attr_map, SDAP_AT_GENERAL, @@ -359,6 +383,15 @@ int ipa_get_id_options(struct ipa_options *ipa_opts, goto done; } + ret = sdap_get_map(ipa_opts->id, + cdb, conf_path, + ipa_netgroup_map, + SDAP_OPTS_NETGROUP, + &ipa_opts->id->netgroup_map); + if (ret != EOK) { + goto done; + } + ret = EOK; *_opts = ipa_opts->id; diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h index 3b40e41..1638f2a 100644 --- a/src/providers/ipa/ipa_common.h +++ b/src/providers/ipa/ipa_common.h @@ -35,7 +35,7 @@ struct ipa_service { /* the following defines are used to keep track of the options in the ldap * module, so that if they change and ipa is not updated correspondingly * this will trigger a runtime abort error */ -#define IPA_OPTS_BASIC_TEST 35 +#define IPA_OPTS_BASIC_TEST 36 /* the following define is used to keep track of the options in the krb5 * module, so that if they change and ipa is not updated correspondingly diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 14bdd28..168ec9e 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -67,7 +67,8 @@ struct dp_option default_basic_opts[] = { { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER }, { "ldap_dns_service_name", DP_OPT_STRING, { SSS_LDAP_SRV_NAME }, NULL_STRING }, { "ldap_krb5_ticket_lifetime", DP_OPT_NUMBER, { .number = (24 * 60 * 60) }, NULL_NUMBER }, - { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING } + { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_netgroup_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, }; struct sdap_attr_map generic_attr_map[] = { @@ -159,6 +160,16 @@ struct sdap_attr_map rfc2307bis_group_map[] = { { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL } }; +struct sdap_attr_map netgroup_map[] = { + { "ldap_netgroup_object_class", "nisNetgroup", SYSDB_NETGROUP_CLASS, NULL }, + { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL }, + { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL }, + { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL }, + /* FIXME: this is 389ds specific */ + { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL }, + { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL } +}; + int ldap_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb, const char *conf_path, @@ -167,6 +178,7 @@ int ldap_get_options(TALLOC_CTX *memctx, struct sdap_attr_map *default_attr_map; struct sdap_attr_map *default_user_map; struct sdap_attr_map *default_group_map; + struct sdap_attr_map *default_netgroup_map; struct sdap_options *opts; char *schema; const char *pwd_policy; @@ -185,7 +197,7 @@ int ldap_get_options(TALLOC_CTX *memctx, goto done; } - /* set user/group search bases if they are not */ + /* set user/group/netgroup search bases if they are not */ if (NULL == dp_opt_get_string(opts->basic, SDAP_USER_SEARCH_BASE)) { ret = dp_opt_set_string(opts->basic, SDAP_USER_SEARCH_BASE, dp_opt_get_string(opts->basic, @@ -210,6 +222,18 @@ int ldap_get_options(TALLOC_CTX *memctx, dp_opt_get_string(opts->basic, SDAP_GROUP_SEARCH_BASE))); } + if (NULL == dp_opt_get_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE)) { + ret = dp_opt_set_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE, + dp_opt_get_string(opts->basic, + SDAP_SEARCH_BASE)); + if (ret != EOK) { + goto done; + } + DEBUG(6, ("Option %s set to %s\n", + opts->basic[SDAP_NETGROUP_SEARCH_BASE].opt_name, + dp_opt_get_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE))); + } + pwd_policy = dp_opt_get_string(opts->basic, SDAP_PWD_POLICY); if (pwd_policy == NULL) { DEBUG(1, ("Missing password policy, this may not happen.\n")); @@ -285,24 +309,28 @@ int ldap_get_options(TALLOC_CTX *memctx, default_attr_map = generic_attr_map; default_user_map = rfc2307_user_map; default_group_map = rfc2307_group_map; + default_netgroup_map = netgroup_map; } else if (strcasecmp(schema, "rfc2307bis") == 0) { opts->schema_type = SDAP_SCHEMA_RFC2307BIS; default_attr_map = generic_attr_map; default_user_map = rfc2307bis_user_map; default_group_map = rfc2307bis_group_map; + default_netgroup_map = netgroup_map; } else if (strcasecmp(schema, "IPA") == 0) { opts->schema_type = SDAP_SCHEMA_IPA_V1; default_attr_map = gen_ipa_attr_map; default_user_map = rfc2307bis_user_map; default_group_map = rfc2307bis_group_map; + default_netgroup_map = netgroup_map; } else if (strcasecmp(schema, "AD") == 0) { opts->schema_type = SDAP_SCHEMA_AD; default_attr_map = gen_ad_attr_map; default_user_map = rfc2307bis_user_map; default_group_map = rfc2307bis_group_map; + default_netgroup_map = netgroup_map; } else { DEBUG(0, ("Unrecognized schema type: %s\n", schema)); ret = EINVAL; @@ -333,6 +361,14 @@ int ldap_get_options(TALLOC_CTX *memctx, goto done; } + ret = sdap_get_map(opts, cdb, conf_path, + default_netgroup_map, + SDAP_OPTS_NETGROUP, + &opts->netgroup_map); + if (ret != EOK) { + goto done; + } + ret = EOK; *_opts = opts; diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 4426dac..75df8b0 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -174,6 +174,7 @@ enum sdap_basic_opt { SDAP_DNS_SERVICE_NAME, SDAP_KRB5_TICKET_LIFETIME, SDAP_ACCESS_FILTER, + SDAP_NETGROUP_SEARCH_BASE, SDAP_OPTS_BASIC /* opts counter */ }; @@ -231,6 +232,17 @@ enum sdap_group_attrs { SDAP_OPTS_GROUP /* attrs counter */ }; +enum sdap_netgroup_attrs { + SDAP_OC_NETGROUP = 0, + SDAP_AT_NETGROUP_NAME, + SDAP_AT_NETGROUP_MEMBER, + SDAP_AT_NETGROUP_TRIPLE, + SDAP_AT_NETGROUP_UUID, + SDAP_AT_NETGROUP_MODSTAMP, + + SDAP_OPTS_NETGROUP /* attrs counter */ +}; + struct sdap_attr_map { const char *opt_name; const char *def_name; @@ -243,6 +255,7 @@ struct sdap_options { struct sdap_attr_map *gen_map; struct sdap_attr_map *user_map; struct sdap_attr_map *group_map; + struct sdap_attr_map *netgroup_map; /* supported schema types */ enum schema_type { -- 1.7.2.3