[SSSD] [PATCH] SUDO: AD provider

Sumit Bose sbose at redhat.com
Fri Feb 28 09:21:08 UTC 2014


On Thu, Feb 27, 2014 at 05:18:26PM +0100, Jakub Hrozek wrote:
> On Thu, Feb 27, 2014 at 01:59:57PM +0100, Pavel Březina wrote:
> > On 02/26/2014 01:54 PM, Sumit Bose wrote:
> > >Hi,
> > >
> > >this patch provides the AD sudo provider and is "inspired" by Lukas'
> > >"SUDO: IPA provider" patch.
> > >
> > >I do not have an AD setup with sudo rules. It would be nice if someone
> > >with such setup can run some basic test otherwise I can/have to do some
> > >additional testing.
> > >
> > >Patches for master and 1.11 are attached.
> > >
> > >bye,
> > >Sumit
> > 
> > Hi,
> > 
> > <nitpick>
> > -            'ad': ['id', 'auth', 'access', 'chpass'],
> > +            'ad': ['id', 'auth', 'access', 'chpass', 'sudo', 'subdomains'],
> > 
> > subdomains should be added in separate patch
> > </nitpick>
> > 
> > code-wise ack. I will try to update ad schema and test it.
> 
> The patch works fine! ACK from my side, I'll leave it up to you whether
> you'd like to split the patch into two or not.

sure, new version attached

> 
> For future reference, if you want to amend the schema, you need to copy
> the AD schema file (/usr/share/doc/sudo/schema.ActiveDirectory) from sudo
> 
> Then load it on AD:
> ldifde -i -f schema.ActiveDirectory -c dc=X dc=DOMAINNAME,dc=LOCAL
> 
> Then just add the records. I admit I was lazy and just added the
> sudoRole objects to the same subtree as users but that doesn't matter as
> SSSD uses the top level base anyway:
> (Thu Feb 27 17:03:12 2014) [sssd[be[WIN.EXAMPLE.COM]]]
> [common_parse_search_base] (0x0100): Search base added:
> [SUDO][DC=WIN,DC=EXAMPLE,DC=COM][SUBTREE][]
> 
> To add the records, I used "ADSI Edit". Just right-click the container,
> select "New->Object" and then you should see sudoRole in the list of
> objectClasses. The name of the user must be non-qualified, so from the
> following rule:
> 
> dn: CN=lessrule,CN=Users,DC=WIN,DC=EXAMPLE,DC=COM
> objectClass: top
> objectClass: sudoRole
> cn: lessrule
> distinguishedName: CN=lessrule,CN=Users,DC=WIN,DC=EXAMPLE,DC=COM
> instanceType: 4
> whenCreated: 20140226161739.0Z
> whenChanged: 20140226163320.0Z
> uSNCreated: 274759
> uSNChanged: 274760
> name: lessrule
> objectGUID:: Q44OphStKUaZOkDR9eBs7A==
> objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=WIN,DC=EXAMPLE,DC=COM
> dSCorePropagationData: 16010101000000.0Z
> sudoHost: ALL
> sudoCommand: /usr/bin/less
> sudoUser: tuser at win.example.com
> sudoUser: Administrator
> 
> Only Administrator worked. So I suspect that in order to support users
> from trusted domains, you'd have to make them a member of a group and then
> allow the rule for the group. But this is mostly academic as this
> problem is present also with sudo using the 'built-in' LDAP support and
> not SSSD.


Thanks for the instructions.

bye,
Sumit

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 79514e61046a5fc184c8552103e02293573fb0df Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 28 Feb 2014 10:04:08 +0100
Subject: [PATCH 1/2] config API: add missing subdomain target to AD provider
 test

---
 src/config/SSSDConfigTest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 7cfbddc..47e9e75 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -731,7 +731,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
         control_provider_dict = {
             'ipa': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs',
                     'session', 'hostid', 'subdomains'],
-            'ad': ['id', 'auth', 'access', 'chpass'],
+            'ad': ['id', 'auth', 'access', 'chpass', 'subdomains'],
             'local': ['id', 'auth', 'chpass'],
             'ldap': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs'],
             'krb5': ['auth', 'access', 'chpass'],
-- 
1.8.3.1

-------------- next part --------------
From 591d2a10b7d21c6381a0dfa4c92f2ef1949ad099 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 28 Feb 2014 10:05:34 +0100
Subject: [PATCH 2/2] SUDO: AD provider

This patch adds the sudo target to the AD provider. The main reason is
to cover different default settings in the LDAP and AD provider. E.g.
the default for ldap_id_mapping is True in the AD provider and False
in the LDAP provider. If ldap_id_mapping was not set explicitly in the
config file both components worked with different setting.

Fixes https://fedorahosted.org/sssd/ticket/2256
---
 Makefile.am                            |  5 +++++
 src/config/SSSDConfigTest.py           |  2 +-
 src/config/etc/sssd.api.d/sssd-ad.conf | 21 +++++++++++++++++++++
 src/man/sssd-ad.5.xml                  |  6 +++---
 src/man/sssd.conf.5.xml                | 15 ++++++++++++---
 src/providers/ad/ad_common.h           |  4 ++++
 src/providers/ad/ad_init.c             | 25 +++++++++++++++++++++++++
 7 files changed, 71 insertions(+), 7 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index a861d0e..31ac813 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1970,6 +1970,11 @@ libsss_ad_la_SOURCES = \
     src/util/sss_krb5.c \
     src/util/sss_ldap.c
 
+if BUILD_SUDO
+libsss_ad_la_SOURCES += \
+    src/providers/ad/ad_sudo.c
+endif
+
 libsss_ad_la_CFLAGS = \
     $(AM_CFLAGS) \
     $(SYSTEMD_LOGIN_CFLAGS) \
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 47e9e75..182572f 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -731,7 +731,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
         control_provider_dict = {
             'ipa': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs',
                     'session', 'hostid', 'subdomains'],
-            'ad': ['id', 'auth', 'access', 'chpass', 'subdomains'],
+            'ad': ['id', 'auth', 'access', 'chpass', 'sudo', 'subdomains'],
             'local': ['id', 'auth', 'chpass'],
             'ldap': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs'],
             'krb5': ['auth', 'access', 'chpass'],
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 6b136f2..aa20ca0 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -132,3 +132,24 @@ krb5_kpasswd = str, None, false
 krb5_backup_kpasswd = str, None, false
 
 [provider/ad/subdomains]
+
+[provider/ad/sudo]
+ldap_sudo_search_base = str, None, false
+ldap_sudo_full_refresh_interval = int, None, false
+ldap_sudo_smart_refresh_interval = int, None, false
+ldap_sudo_use_host_filter = bool, None, false
+ldap_sudo_hostnames = str, None, false
+ldap_sudo_ip = str, None, false
+ldap_sudo_include_netgroups = bool, None, false
+ldap_sudo_include_regexp = bool, None, false
+ldap_sudorule_object_class = str, None, false
+ldap_sudorule_name = str, None, false
+ldap_sudorule_command = str, None, false
+ldap_sudorule_host = str, None, false
+ldap_sudorule_user = str, None, false
+ldap_sudorule_option = str, None, false
+ldap_sudorule_runasuser = str, None, false
+ldap_sudorule_runasgroup = str, None, false
+ldap_sudorule_notbefore = str, None, false
+ldap_sudorule_notafter = str, None, false
+ldap_sudorule_order = str, None, false
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index b763e42..9b39e08 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -60,9 +60,9 @@
         </para>
         <para>
             However, it is neither necessary nor recommended to set these
-            options. The AD provider can also be used as an access and chpass
-            provider. No configuration of the access provider is required on
-            the client side.
+            options. The AD provider can also be used as an access, chpass and
+            sudo provider. No configuration of the access provider is required
+            on the client side.
         </para>
         <para>
             By default, the AD provider will map UID and GID values from the
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 4ce90de..9668bb0 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -1465,14 +1465,23 @@ fallback_homedir = /home/%u
                             <citerefentry>
                                 <refentrytitle>sssd-ldap</refentrytitle>
                                 <manvolnum>5</manvolnum>
-                            </citerefentry> for more information on configuring LDAP.
+                            </citerefentry> for more information on configuring
+                            LDAP.
+                        </para>
+                        <para>
+                            <quote>ipa</quote> the same as <quote>ldap</quote>
+                            but with IPA default settings.
+                        </para>
+                        <para>
+                            <quote>ad</quote> the same as <quote>ldap</quote>
+                            but with AD default settings.
                         </para>
                         <para>
                             <quote>none</quote> disables SUDO explicitly.
                         </para>
                         <para>
-                            Default: The value of <quote>id_provider</quote> is used if it
-                            is set.
+                            Default: The value of <quote>id_provider</quote> is
+                            used if it is set.
                         </para>
                     </listitem>
                 </varlistentry>
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index d370cef..bc11e54 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -128,4 +128,8 @@ errno_t ad_dyndns_init(struct be_ctx *be_ctx,
                        struct ad_options *ctx);
 void ad_dyndns_timer(void *pvt);
 
+int ad_sudo_init(struct be_ctx *be_ctx,
+                 struct ad_id_ctx *id_ctx,
+                 struct bet_ops **ops,
+                 void **pvt_data);
 #endif /* AD_COMMON_H_ */
diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c
index 60f1939..74ef423 100644
--- a/src/providers/ad/ad_init.c
+++ b/src/providers/ad/ad_init.c
@@ -467,3 +467,28 @@ int sssm_ad_subdomains_init(struct be_ctx *bectx,
 
     return EOK;
 }
+
+
+int sssm_ad_sudo_init(struct be_ctx *bectx,
+                      struct bet_ops **ops,
+                      void **pvt_data)
+{
+#ifdef BUILD_SUDO
+    struct ad_id_ctx *id_ctx;
+    int ret;
+
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Initializing AD sudo handler\n");
+
+    ret = sssm_ad_id_init(bectx, ops, (void **) &id_ctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "sssm_ad_id_init failed.\n");
+        return ret;
+    }
+
+    return ad_sudo_init(bectx, id_ctx, ops, pvt_data);
+#else
+    DEBUG(SSSDBG_MINOR_FAILURE, "Sudo init handler called but SSSD is "
+                                "built without sudo support, ignoring\n");
+    return EOK;
+#endif
+}
-- 
1.8.3.1



More information about the sssd-devel mailing list