[SSSD] [PATCH] Create a domain-realm mapping for krb5.conf to be included

Jakub Hrozek jhrozek at redhat.com
Wed Aug 1 19:38:02 UTC 2012


On Wed, Aug 01, 2012 at 03:21:33PM -0400, Simo Sorce wrote:
> On Wed, 2012-08-01 at 21:09 +0200, Jakub Hrozek wrote:
> > On Wed, Aug 01, 2012 at 07:13:22PM +0200, Jakub Hrozek wrote:
> > > When new subdomains are discovered, the SSSD creates a file that
> > > includes the domain-realm mappings. This file can in turn be included in
> > > the krb5.conf using the includedir directive, such as:
> > > 
> > > includedir /var/lib/sss/pubconf/realm_mappings
> > > 
> > > The other part of the work is changing ipa-client such that the above
> > > line is added to krb5.conf when the client is installed.
> > 
> > Simo nacked the origial patch on IRC.
> > 
> > I made the following changes:
> >     * the directory is now called krb5.include.d. In the future we might
> >       want to include other config snippets than domain-realm mappings
> >     * fprintf is used to write the contents instead of first
> >       constructing the contents and then writing
> >     * the file is first created with mkstemp's default restrictive
> >       permissions and then chmod-ed to be readable
> >     * failure to write the file is not fatal anymore
> 
> NACK, ret is overwritten in erro conditions if fstream or tmp_path are
> not NULL.
> 
> Simo.

Thank you, a new patch is attached. The attached version also owns the
new directory in the specfile.
-------------- next part --------------
>From e70c140ba3d91d80f08071bd6d0e88cf578b621e Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 1 Aug 2012 18:28:04 +0200
Subject: [PATCH] Create a domain-realm mapping for krb5.conf to be included

When new subdomains are discovered, the SSSD creates a file that
includes the domain-realm mappings. This file can in turn be included in
the krb5.conf using the includedir directive, such as:

includedir /var/lib/sss/pubconf/realm_mappings
---
 Makefile.am                        |    1 +
 contrib/sssd.spec.in               |    1 +
 src/providers/ipa/ipa_subdomains.c |  135 ++++++++++++++++++++++++++++++++++++
 3 files changed, 137 insertions(+)

diff --git a/Makefile.am b/Makefile.am
index 9b361a8ce236beb4c3d3512cf7d9ef1dd96e2f5d..61472b622c776c9196fd9ff8072949eedf9a21a9 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1602,6 +1602,7 @@ installsssddirs::
     $(DESTDIR)$(pidpath) \
     $(DESTDIR)$(logpath) \
     $(DESTDIR)$(pubconfpath) \
+    $(DESTDIR)$(pubconfpath)/krb5.include.d \
     $(DESTDIR)$(sudolibdir) \
     $(DESTDIR)$(autofslibdir)
 
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index ccb2ce3ff71eb14d0ede70d6c67269fc8beab672..90bd079762df27f072e2e2e56df8ece31076b185 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -362,6 +362,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %dir %{mcpath}
 %attr(755,root,root) %dir %{pipepath}
 %attr(755,root,root) %dir %{pubconfpath}
+%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
 %attr(700,root,root) %dir %{pipepath}/private
 %attr(750,root,root) %dir %{_var}/log/%{name}
 %attr(711,root,root) %dir %{_sysconfdir}/sssd
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index fd6b6e43c311ac8365852186f4788e3907f41d62..3ea8a3175f862ec6ecc2cdede17bb29483b7047e 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -48,6 +48,9 @@
 /* refresh automatically every 4 hours */
 #define IPA_SUBDOMAIN_REFRESH_PERIOD (3600 * 4)
 
+/* the directory domain - realm mappings are written to */
+#define IPA_SUBDOMAIN_MAPPING_DIR PUBCONF_PATH"/krb5.include.d"
+
 enum ipa_subdomains_req_type {
     IPA_SUBDOMAINS_MASTER,
     IPA_SUBDOMAINS_SLAVE,
@@ -271,6 +274,130 @@ static errno_t ipa_subdom_parse(TALLOC_CTX *memctx,
     return EOK;
 }
 
+static errno_t
+ipa_subdomains_write_mappings(struct sss_domain_info *domain,
+                              size_t num_subdoms,
+                              struct sysdb_subdom *subdoms)
+{
+    errno_t ret;
+    errno_t err;
+    TALLOC_CTX *tmp_ctx;
+    const char *mapping_file;
+    char *tmp_file = NULL;
+    int fd = -1;
+    FILE *fstream = NULL;
+    size_t i;
+
+    tmp_ctx = talloc_new(NULL);
+    if (!tmp_ctx) return ENOMEM;
+
+    mapping_file = talloc_asprintf(tmp_ctx, "%s/domain_realm_%s",
+                                   IPA_SUBDOMAIN_MAPPING_DIR, domain->name);
+    if (!mapping_file) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    tmp_file = talloc_asprintf(tmp_ctx, "%sXXXXXX", mapping_file);
+    if (tmp_file == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    fd = mkstemp(tmp_file);
+    if (fd < 0) {
+        DEBUG(SSSDBG_OP_FAILURE, ("creating the temp file [%s] for domain-realm "
+                                  "mappings failed.", tmp_file));
+        ret = EIO;
+        talloc_zfree(tmp_ctx);
+        goto done;
+    }
+
+    fstream = fdopen(fd, "a");
+    if (!fstream) {
+        ret = errno;
+        DEBUG(SSSDBG_OP_FAILURE, ("fdopen failed [%d]: %s\n",
+                                  ret, strerror(ret)));
+        ret = close(fd);
+        if (ret != 0) {
+            ret = errno;
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                ("fclose failed [%d][%s].\n", ret, strerror(ret)));
+            /* Nothing to do here, just report the failure */
+        }
+        ret = EIO;
+        goto done;
+    }
+
+    ret = fprintf(fstream, "[domain_realm]\n");
+    if (ret < 0) {
+        DEBUG(SSSDBG_OP_FAILURE, ("fprintf failed\n"));
+        ret = EIO;
+        goto done;
+    }
+
+    for (i = 0; i < num_subdoms; i++) {
+        ret = fprintf(fstream, ".%s = %s\n%s = %s\n",
+                               subdoms[i].name, subdoms[i].realm,
+                               subdoms[i].name, subdoms[i].realm);
+        if (ret < 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE, ("fprintf failed\n"));
+            goto done;
+        }
+    }
+
+    ret = fclose(fstream);
+    if (ret != 0) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("fclose failed [%d][%s].\n", ret, strerror(ret)));
+        goto done;
+    }
+    fstream = NULL;
+
+    ret = rename(tmp_file, mapping_file);
+    if (ret == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("rename failed [%d][%s].\n", ret, strerror(ret)));
+        goto done;
+    }
+
+    talloc_zfree(tmp_file);
+
+    ret = chmod(mapping_file, 0644);
+    if (ret == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("fchmod failed [%d][%s].\n", ret, strerror(ret)));
+        goto done;
+    }
+
+    ret = EOK;
+done:
+    if (fstream) {
+        err = fclose(fstream);
+        if (err != 0) {
+            err = errno;
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                ("fclose failed [%d][%s].\n", err, strerror(err)));
+            /* Nothing to do here, just report the failure */
+        }
+    }
+
+    if (tmp_file) {
+        err = unlink(tmp_file);
+        if (err < 0) {
+            err = errno;
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  ("Could not remove file [%s]: [%d]: %s",
+                   tmp_file, err, strerror(err)));
+        }
+    }
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
 static errno_t ipa_subdomains_refresh(struct ipa_subdomains_ctx *ctx,
                                       int count, struct sysdb_attrs **reply,
                                       bool *changes)
@@ -598,6 +725,14 @@ static void ipa_subdomains_handler_done(struct tevent_req *req)
             DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_subdomains failed.\n"));
             goto done;
         }
+
+        ret = ipa_subdomains_write_mappings(sysdb_ctx_get_domain(sysdb),
+                                            ctx->sd_ctx->num_subdoms,
+                                            ctx->sd_ctx->subdoms);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  ("ipa_subdomains_write_mappings failed.\n"));
+        }
     }
 
 
-- 
1.7.10.4



More information about the sssd-devel mailing list