[SSSD] [PATCHES] Add AD and RHDS/IPA expire policy
Sumit Bose
sbose at redhat.com
Wed Jan 19 14:31:41 UTC 2011
On Wed, Jan 19, 2011 at 08:34:09AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 01/18/2011 05:24 AM, Sumit Bose wrote:
> > Hi,
> >
> > the following two patches add expired policies for AD and RHDS/IPA and
> > should fix trac ticket #674 and #679, respectively.
> >
>
> Patch 0001: Ack.
>
> Patch 0002: Nack. Could we please use "389ds" instead of (or in addition
> to) RHDS?
"389ds" added, new version attached.
bye,
Sumit
>
> Otherwise, these patches look good.
>
> - --
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk026FEACgkQeiVVYja6o6PFhACdFLS2g6HzEotyGLFmReB8C20h
> U9UAoJ4LJCE24CO+PQwAkYj85kSt3IJd
> =BmAQ
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 9158db11f134a9634bd08992f90ea7d17d1dcc89 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 22 Dec 2010 18:25:45 +0100
Subject: [PATCH 2/2] Add LDAP expire policy base RHDS/IPA attribute
The attribute nsAccountLock is used by RHDS, IPA and other directory
servers to indicate that the account is locked.
---
src/config/SSSDConfig.py | 1 +
src/config/etc/sssd.api.d/sssd-ldap.conf | 1 +
src/man/sssd-ldap.5.xml | 20 +++++++++++++++
src/providers/ipa/ipa_common.c | 3 +-
src/providers/ldap/ldap_common.c | 6 +++-
src/providers/ldap/ldap_init.c | 5 +++-
src/providers/ldap/sdap.h | 3 ++
src/providers/ldap/sdap_access.c | 38 ++++++++++++++++++++++++++++++
src/providers/ldap/sdap_access.h | 3 ++
9 files changed, 76 insertions(+), 4 deletions(-)
diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index d84509c..aed683b 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -174,6 +174,7 @@ option_strings = {
'ldap_pwd_attribute' : _('Attribute indicating that server side password policies are active'),
'ldap_user_ad_account_expires' : _('accountExpires attribute of AD'),
'ldap_user_ad_user_account_control' : _('userAccountControl attribute of AD'),
+ 'ldap_ns_account_lock' : _('nsAccountLock attribute'),
'ldap_group_search_base' : _('Base DN for group lookups'),
# not used # 'ldap_group_search_scope' : _('Scope of group lookups'),
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 0644383..440ebff 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -60,6 +60,7 @@ ldap_user_authorized_service = str, None, false
ldap_pwd_attribute = str, None, false
ldap_user_ad_account_expires = str, None, false
ldap_user_ad_user_account_control = str, None, false
+ldap_ns_account_lock = str, None, false
ldap_group_search_base = str, None, false
ldap_group_search_scope = str, None, false
ldap_group_search_filter = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 65c679d..b133b3b 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -464,6 +464,20 @@
</varlistentry>
<varlistentry>
+ <term>ldap_ns_account_lock (string)</term>
+ <listitem>
+ <para>
+ When using ldap_account_expire_policy=rhds or
+ equivalent, this parameter determines if access is
+ allowed or not.
+ </para>
+ <para>
+ Default: nsAccountLock
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>ldap_user_principal (string)</term>
<listitem>
<para>
@@ -1163,6 +1177,12 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
expiration time of the account is checked.
</para>
<para>
+ <emphasis>rhds</emphasis>, <emphasis>ipa</emphasis>,
+ <emphasis>389ds</emphasis>:
+ use the value of ldap_ns_account_lock to check if
+ access is allowed or not.
+ </para>
+ <para>
Default: Empty
</para>
</listitem>
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index fe12577..6b4f64f 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -117,7 +117,8 @@ struct sdap_attr_map ipa_user_map[] = {
{ "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL },
{ "ldap_user_authorized_service", "authorizedService", SYSDB_AUTHORIZED_SERVICE, NULL },
{ "ldap_user_ad_account_expires", "accountExpires", SYSDB_AD_ACCOUNT_EXPIRES, NULL},
- { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL}
+ { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL},
+ { "ldap_ns_account_lock", "nsAccountLock", SYSDB_NS_ACCOUNT_LOCK, NULL}
};
struct sdap_attr_map ipa_group_map[] = {
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index e98e718..48c3563 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -123,7 +123,8 @@ struct sdap_attr_map rfc2307_user_map[] = {
{ "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL },
{ "ldap_user_authorized_service", "authorizedService", SYSDB_AUTHORIZED_SERVICE, NULL },
{ "ldap_user_ad_account_expires", "accountExpires", SYSDB_AD_ACCOUNT_EXPIRES, NULL},
- { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL}
+ { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL},
+ { "ldap_ns_account_lock", "nsAccountLock", SYSDB_NS_ACCOUNT_LOCK, NULL}
};
struct sdap_attr_map rfc2307_group_map[] = {
@@ -165,7 +166,8 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
{ "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL },
{ "ldap_user_authorized_service", "authorizedService", SYSDB_AUTHORIZED_SERVICE, NULL },
{ "ldap_user_ad_account_expires", "accountExpires", SYSDB_AD_ACCOUNT_EXPIRES, NULL},
- { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL}
+ { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL},
+ { "ldap_ns_account_lock", "nsAccountLock", SYSDB_NS_ACCOUNT_LOCK, NULL}
};
struct sdap_attr_map rfc2307bis_group_map[] = {
diff --git a/src/providers/ldap/ldap_init.c b/src/providers/ldap/ldap_init.c
index 61f9233..6b05690 100644
--- a/src/providers/ldap/ldap_init.c
+++ b/src/providers/ldap/ldap_init.c
@@ -346,7 +346,10 @@ int sssm_ldap_access_init(struct be_ctx *bectx,
"All domain users will be denied access.\n"));
} else {
if (strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_SHADOW) != 0 &&
- strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_AD) != 0) {
+ strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_AD) != 0 &&
+ strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_RHDS) != 0 &&
+ strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_IPA) != 0 &&
+ strcasecmp(dummy, LDAP_ACCOUNT_EXPIRE_389DS) != 0) {
DEBUG(1, ("Unsupported LDAP account expire policy [%s].\n",
dummy));
ret = EINVAL;
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 57f849a..932abca 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -122,6 +122,8 @@ struct sdap_ppolicy_data {
#define SYSDB_SHADOWPW_EXPIRE "shadowExpire"
#define SYSDB_SHADOWPW_FLAG "shadowFlag"
+#define SYSDB_NS_ACCOUNT_LOCK "nsAccountLock"
+
#define SYSDB_KRBPW_LASTCHANGE "krbLastPwdChange"
#define SYSDB_KRBPW_EXPIRATION "krbPasswordExpiration"
@@ -236,6 +238,7 @@ enum sdap_user_attrs {
SDAP_AT_AUTH_SVC,
SDAP_AT_AD_ACCOUNT_EXPIRES,
SDAP_AT_AD_USER_ACCOUNT_CONTROL,
+ SDAP_AT_NS_ACCOUNT_LOCK,
SDAP_OPTS_USER /* attrs counter */
};
diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index a3c560d..f522074 100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -418,6 +418,35 @@ static errno_t sdap_account_expired_ad(struct pam_data *pd,
return EOK;
}
+#define RHDS_LOCK_MSG "The user account is locked on the server"
+
+static errno_t sdap_account_expired_rhds(struct pam_data *pd,
+ struct ldb_message *user_entry,
+ int *pam_status)
+{
+ bool locked;
+ int ret;
+
+ DEBUG(6, ("Performing RHDS access check for user [%s]\n", pd->user));
+
+ locked = ldb_msg_find_attr_as_bool(user_entry, SYSDB_NS_ACCOUNT_LOCK, false);
+ DEBUG(9, ("Account for user [%s] is%s locked.\n", pd->user,
+ locked ? "" : " not" ));
+
+ if (locked) {
+ ret = pam_add_response(pd, SSS_PAM_SYSTEM_INFO,
+ sizeof(RHDS_LOCK_MSG),
+ (const uint8_t *) RHDS_LOCK_MSG);
+ if (ret != EOK) {
+ DEBUG(1, ("pam_add_response failed.\n"));
+ }
+ }
+
+ *pam_status = locked ? PAM_PERM_DENIED : PAM_SUCCESS;
+
+ return EOK;
+}
+
struct sdap_account_expired_req_ctx {
int pam_status;
};
@@ -464,6 +493,15 @@ static struct tevent_req *sdap_account_expired_send(TALLOC_CTX *mem_ctx,
DEBUG(1, ("sdap_account_expired_ad failed.\n"));
goto done;
}
+ } else if (strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_RHDS) == 0 ||
+ strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_IPA) == 0 ||
+ strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_389DS) == 0) {
+ ret = sdap_account_expired_rhds(pd, user_entry,
+ &state->pam_status);
+ if (ret != EOK) {
+ DEBUG(1, ("sdap_account_expired_rhds failed.\n"));
+ goto done;
+ }
} else {
DEBUG(1, ("Unsupported LDAP account expire policy [%s]. "
"Access denied.\n", expire));
diff --git a/src/providers/ldap/sdap_access.h b/src/providers/ldap/sdap_access.h
index 28c857f..32c45b8 100644
--- a/src/providers/ldap/sdap_access.h
+++ b/src/providers/ldap/sdap_access.h
@@ -35,6 +35,9 @@
#define LDAP_ACCOUNT_EXPIRE_SHADOW "shadow"
#define LDAP_ACCOUNT_EXPIRE_AD "ad"
+#define LDAP_ACCOUNT_EXPIRE_RHDS "rhds"
+#define LDAP_ACCOUNT_EXPIRE_IPA "ipa"
+#define LDAP_ACCOUNT_EXPIRE_389DS "389ds"
enum ldap_access_rule {
LDAP_ACCESS_EMPTY = -1,
--
1.7.3.3
More information about the sssd-devel
mailing list