[SSSD] Support for subdomains - stage 1

Jan Zeleny jzeleny at redhat.com
Tue Mar 20 16:42:39 UTC 2012


Hi guys,
it took me and Sumit some time but we finally have completed the first stage 
of support for subdomains. I'm sending all patches in attachment.

This stage has basic support for subdomains but some pieces like PAC support 
are left out. We agreed that those can wait for the second stage which depends 
on some server side changes that are not ready yet. We'll keep you posted.

Please note that patches depend on Sumit's previous idmap library patch. I'll 
get that reviewed either today or tomorrow.

#0001
All sysdby routines that are used in later patches

#0002
Responder routines for asking provider for a list of supported subdomains

#0003
The routine responder_get_domain is modified to look for subdomains as well 
when looking for the correct domain descriptor

#0004
If a request for fully qualified entity (user/group) comes to the responder 
and its domain has not been found, it updates its list of domains and 
supported subdomains in each domain. To update the list, a get_domains call is 
sent to each provider.

#0005
Create a list of all domains and subdomains when the first request after start 
comes in. To create the list, a get_domains call is sent to each provider.

#0006
Check sub-domains in nss_cmd_get{pwuid|grgid}_search()

#0007
Basic infrastructure for handling get_subdomains requests in providers.

#0008
Add the infrastructure in IPA provider which fetches a list of handled 
subdomains from server and stores in in sysdb.

#0009
Currently the connections to the data provider use the same name as the 
domain. With sub-domains the name of the sub-domain cannot be used to find the 
right data provider connection, hence we store the name of the connection in a 
new member.

#0010
Support for subdomain name given to provider when calling get_account_info

#0011
New ID-related config options for subdomains, these have to be present because 
IPA provider doesn't provide these values and defaults need to be implemented. 
Having defaults on the responder level didn't seem right since the policy 
might differ for each domain.

#0012
The routine expand_homedir_template is now used on more place, therefore it 
was convenient to move it to util code.

#0013
s2n extended LDAP operation - this is used to ask IPA server for entities from 
supported subdomains

#0014
Extend IPA ID provider toi support fetching information for entities within 
subdomains

#0015
Support for routing PAM request from reponder to the right provider. Similar 
case as patches #3-#6 in NSS responder but much more simple.

#0016
Basic support (or rather un-support) for subdomains in auth providers. 
Basically it's designed to acknowledge that the request is not for the main 
domain but for subdomain and in that case it supports only SSS_PAM_ACCT_MGMT 
and returns error otherwise. Note that similar thing as the IPA backend change 
in last hunk is probably not necessary for krb5 backend since when using it, 
there will be no subdomains for that domain.

#0017
Support providing sysdb context and domain info per request, not per backend 
context. This is necessary for the next patches.

#0018
Accept be_req instead of be_ctx in access providers. Together with the 
previous patch, this is needed for the next one.

#0019
Detect if the authorization request came for a user in subdomain and if yes, 
replace the original backend-wide sysdb context and domain info with their 
subdomain specific replacements.

#0020
Use request-wide sysdb context and domain info instead of their backend-wide 
counterparts in HBAC.


That's all folks, have fun reviewing :)
Thanks and bye,
Jan and Sumit
-------------- next part --------------
A non-text attachment was scrubbed...
Name: subdomains.tar.bz2
Type: application/x-bzip-compressed-tar
Size: 28972 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120320/208a729e/attachment.bin>


More information about the sssd-devel mailing list