[SSSD] [PATCH] Add ldap_chpass_uri config option

Sumit Bose sbose at redhat.com
Mon Dec 6 14:00:02 UTC 2010


On Mon, Dec 06, 2010 at 02:38:27PM +0100, Sumit Bose wrote:
> On Fri, Dec 03, 2010 at 08:19:08AM -0500, Stephen Gallagher wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > On 12/03/2010 05:19 AM, Sumit Bose wrote:
> > > On Thu, Dec 02, 2010 at 09:19:02AM -0500, Stephen Gallagher wrote:
> > > On 11/29/2010 09:15 AM, Sumit Bose wrote:
> > >>>> Hi,
> > >>>>
> > >>>> this patch adds a ldap_chpass_uri config option as requested in trac
> > >>>> ticket #680. The first patch just removes an unused struct member.
> > >>>>
> > >>>> bye,
> > >>>> Sumit
> > >>>>
> > > 
> > > Patch 0001: Ack.
> > > 
> > > Patch 0002: Nack. It doesn't apply atop current master. Is there a
> > > dependent patch I should be aware of?
> > > 
> > >> I would expect that you need to apply this patch on top of 'Add new
> > >> account expired rule to LDAP access provider'
> > 
> > Right, I wasn't thinking. It applies fine atop those patches.
> > 
> > Nack (minor).
> > 
> > With https://fedorahosted.org/sssd/ticket/653 in mind, we probably need
> > to get in the habit of adding new options to the sssd.api.d files.
> 
> The two new options where already sssd-ldap.conf, I just moved them from
> the /auth to the /chpass section. We agreed on irc that they should not
> be exposed via the SSSDConfig API for the IPA provider, because that are
> not evaluated here.
> 
> > 
> > 
> > +    dns_service_name = dp_opt_get_string(ctx->opts->basic,
> > +                                         SDAP_CHPASS_DNS_SERVICE_NAME);
> > +    if (!dns_service_name) {
> > +        DEBUG(7, ("Service name for chpass discovery set to %s\n",
> > +                  dns_service_name));
> > +    }
> > 
> > I think you meant to print this when dns_service_name != NULL.
> 
> done (it's hard to break patterns :-)
> 
> Thanks for the review, new version attached.
> 
> bye,
> Sumit

This rebased version should apply cleanly on top of master + "account
expired rules". Sorry for any inconveniences.

bye,
Sumit


> > 
> > 
> > - -- 
> > Stephen Gallagher
> > RHCE 804006346421761
> > 
> > Delivering value year after year.
> > Red Hat ranks #1 in value among software vendors.
> > http://www.redhat.com/promo/vendor/
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.11 (GNU/Linux)
> > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> > 
> > iEYEARECAAYFAkz47kwACgkQeiVVYja6o6MSJQCgkPjuaa+x7t4C6GAS52eiu/vc
> > U9UAn2SN9o9N1Bp0PKdrTgKxSOCM3d+p
> > =Rdbd
> > -----END PGP SIGNATURE-----
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 0431c4f99f2c90fc60512cde5889b2aa97863301 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 29 Nov 2010 14:29:19 +0100
Subject: [PATCH] Add ldap_chpass_uri config option

---
 src/config/SSSDConfig.py                 |    4 +++
 src/config/etc/sssd.api.d/sssd-ldap.conf |    3 +-
 src/man/sssd-ldap.5.xml                  |   34 ++++++++++++++++++++++++++++++
 src/providers/ipa/ipa_common.c           |    4 ++-
 src/providers/ipa/ipa_common.h           |    2 +-
 src/providers/ldap/ldap_auth.c           |   19 ++++++++++++----
 src/providers/ldap/ldap_common.c         |   10 ++++++++-
 src/providers/ldap/ldap_common.h         |    1 +
 src/providers/ldap/ldap_init.c           |   21 ++++++++++++++++++
 src/providers/ldap/sdap.h                |    2 +
 10 files changed, 91 insertions(+), 9 deletions(-)

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 7136e76..18d8e9d 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -164,6 +164,10 @@ option_strings = {
     'ldap_account_expire_policy' : _('Which attributes shall be used to evaluate if an account is expired'),
     'ldap_access_order' : _('Which rules should be used to evaluate access control'),
 
+    # [provider/ldap/chpass]
+    'ldap_chpass_uri' : _('URI of an LDAP server where password changes are allowed'),
+    'ldap_chpass_dns_service_name' : _('DNS service name for LDAP password change server'),
+
     # [provider/simple/access]
     'simple_allow_users' : _('Comma separated list of allowed users'),
     'simple_deny_users' : _('Comma separated list of prohibited users'),
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index b7d2f9b..2d44fb4 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -84,4 +84,5 @@ ldap_account_expire_policy = str, None, false
 ldap_access_order = str, None, false
 
 [provider/ldap/chpass]
-
+ldap_chpass_uri = str, None, false
+ldap_chpass_dns_service_name = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 8936882..786d5fd 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -70,6 +70,26 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>ldap_chpass_uri (string)</term>
+                    <listitem>
+                        <para>
+                            Specifies the list of URIs of the LDAP servers to
+                            which SSSD should connect in the order of preference
+                            to change the password of a user. Refer to the
+                            <quote>FAILOVER</quote> section for more information
+                            on failover and server redundancy.
+                        </para>
+                        <para>
+                            To enable service discovery
+                            ldap_chpass_dns_service_name must be set.
+                        </para>
+                        <para>
+                            Default: empty, i.e. ldap_uri is used.
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_search_base (string)</term>
                     <listitem>
                         <para>
@@ -988,6 +1008,20 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>ldap_chpass_dns_service_name (string)</term>
+                    <listitem>
+                        <para>
+                            Specifies the service name to use to find an LDAP
+                            server which allows password changes when service
+                            discovery is enabled.
+                        </para>
+                        <para>
+                            Default: not set, i.e. service discovery is disabled
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_access_filter (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 9719ab9..35583af 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -79,7 +79,9 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_group_nesting_level", DP_OPT_NUMBER, { .number = 2 }, NULL_NUMBER },
     { "ldap_deref", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_account_expire_policy", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "ldap_access_order", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "ldap_access_order", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING }
 };
 
 struct sdap_attr_map ipa_attr_map[] = {
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index d457d7f..4d79c03 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -35,7 +35,7 @@ struct ipa_service {
 /* the following defines are used to keep track of the options in the ldap
  * module, so that if they change and ipa is not updated correspondingly
  * this will trigger a runtime abort error */
-#define IPA_OPTS_BASIC_TEST 41
+#define IPA_OPTS_BASIC_TEST 43
 
 /* the following define is used to keep track of the options in the krb5
  * module, so that if they change and ipa is not updated correspondingly
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index 5a85fe9..2d66b1d 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -450,6 +450,7 @@ struct auth_state {
     struct sdap_auth_ctx *ctx;
     const char *username;
     struct dp_opt_blob password;
+    struct sdap_service *sdap_service;
 
     struct sdap_handle *sh;
 
@@ -470,7 +471,8 @@ static struct tevent_req *auth_send(TALLOC_CTX *memctx,
                                     struct tevent_context *ev,
                                     struct sdap_auth_ctx *ctx,
                                     const char *username,
-                                    struct dp_opt_blob password)
+                                    struct dp_opt_blob password,
+                                    bool try_chpass_service)
 {
     struct tevent_req *req;
     struct auth_state *state;
@@ -490,6 +492,12 @@ static struct tevent_req *auth_send(TALLOC_CTX *memctx,
     state->username = username;
     state->password = password;
     state->srv = NULL;
+    if (try_chpass_service && ctx->chpass_service != NULL &&
+        ctx->chpass_service->name != NULL) {
+        state->sdap_service = ctx->chpass_service;
+    } else {
+        state->sdap_service = ctx->service;
+    }
 
     if (!auth_get_server(req)) goto fail;
 
@@ -511,7 +519,7 @@ static struct tevent_req *auth_get_server(struct tevent_req *req)
     next_req = be_resolve_server_send(state,
                                       state->ev,
                                       state->ctx->be,
-                                      state->ctx->service->name);
+                                      state->sdap_service->name);
     if (!next_req) {
         DEBUG(1, ("be_resolve_server_send failed.\n"));
         return NULL;
@@ -539,7 +547,7 @@ static void auth_resolve_done(struct tevent_req *subreq)
     }
 
     subreq = sdap_connect_send(state, state->ev, state->ctx->opts,
-                               state->ctx->service->uri, true);
+                               state->sdap_service->uri, true);
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
@@ -743,7 +751,7 @@ void sdap_pam_chpass_handler(struct be_req *breq)
     authtok.data = (uint8_t *)state->password;
     authtok.length = strlen(state->password);
     subreq = auth_send(breq, breq->be_ctx->ev,
-                       ctx, state->username, authtok);
+                       ctx, state->username, authtok, true);
     if (!subreq) goto done;
 
     tevent_req_set_callback(subreq, sdap_auth4chpass_done, state);
@@ -950,7 +958,8 @@ void sdap_pam_auth_handler(struct be_req *breq)
         state->password.length = pd->authtok_size;
 
         subreq = auth_send(breq, breq->be_ctx->ev, ctx,
-                           state->username, state->password);
+                           state->username, state->password,
+                           pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM ? true : false);
         if (!subreq) goto done;
 
         tevent_req_set_callback(subreq, sdap_pam_auth_done, state);
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index dc01226..4242a7e 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -74,7 +74,9 @@ struct dp_option default_basic_opts[] = {
     { "ldap_group_nesting_level", DP_OPT_NUMBER, { .number = 2 }, NULL_NUMBER },
     { "ldap_deref", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_account_expire_policy", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "ldap_access_order", DP_OPT_STRING, { "filter" }, NULL_STRING }
+    { "ldap_access_order", DP_OPT_STRING, { "filter" }, NULL_STRING },
+    { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING }
 };
 
 struct sdap_attr_map generic_attr_map[] = {
@@ -688,6 +690,12 @@ int sdap_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
     /* now for each URI add a new server to the failover service */
     for (i = 0; list[i]; i++) {
         if (be_fo_is_srv_identifier(list[i])) {
+            if (!dns_service_name) {
+                DEBUG(0, ("Missing DNS service name for service [%s].\n",
+                          service_name));
+                ret = EINVAL;
+                goto done;
+            }
             srv_user_data = talloc_strdup(service, dns_service_name);
             if (!srv_user_data) {
                 ret = ENOMEM;
diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
index d24a983..f1af8fc 100644
--- a/src/providers/ldap/ldap_common.h
+++ b/src/providers/ldap/ldap_common.h
@@ -65,6 +65,7 @@ struct sdap_auth_ctx {
     struct sdap_options *opts;
     struct fo_service *fo_service;
     struct sdap_service *service;
+    struct sdap_service *chpass_service;
 };
 
 void sdap_check_online(struct be_req *breq);
diff --git a/src/providers/ldap/ldap_init.c b/src/providers/ldap/ldap_init.c
index d6407c4..58c12d0 100644
--- a/src/providers/ldap/ldap_init.c
+++ b/src/providers/ldap/ldap_init.c
@@ -212,6 +212,27 @@ int sssm_ldap_auth_init(struct be_ctx *bectx,
         goto done;
     }
 
+    dns_service_name = dp_opt_get_string(ctx->opts->basic,
+                                         SDAP_CHPASS_DNS_SERVICE_NAME);
+    if (dns_service_name) {
+        DEBUG(7, ("Service name for chpass discovery set to %s\n",
+                  dns_service_name));
+    }
+
+    urls = dp_opt_get_string(ctx->opts->basic, SDAP_CHPASS_URI);
+    if (!urls && !dns_service_name) {
+        DEBUG(9, ("ldap_chpass_uri and ldap_chpass_dns_service_name not set, "
+                  "using ldap_uri.\n"));
+        ctx->chpass_service = NULL;
+    } else {
+        ret = sdap_service_init(ctx, ctx->be, "LDAP_CHPASS", dns_service_name,
+                                urls, &ctx->chpass_service);
+        if (ret != EOK) {
+            DEBUG(1, ("Failed to initialize failover service!\n"));
+            goto done;
+        }
+    }
+
     ret = setup_tls_config(ctx->opts->basic);
     if (ret != EOK) {
         DEBUG(1, ("setup_tls_config failed [%d][%s].\n",
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 4d52d5b..5c4f4a5 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -184,6 +184,8 @@ enum sdap_basic_opt {
     SDAP_DEREF,
     SDAP_ACCOUNT_EXPIRE_POLICY,
     SDAP_ACCESS_ORDER,
+    SDAP_CHPASS_URI,
+    SDAP_CHPASS_DNS_SERVICE_NAME,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
-- 
1.7.3.2



More information about the sssd-devel mailing list