[SSSD] [PATCHES] krb5: make krb5 provider view aware
Sumit Bose
sbose at redhat.com
Thu Nov 27 16:41:57 UTC 2014
Hi,
this patchset makes the krb5 provider view-aware. All needed
functionality is in the 1st patch. 2nd makes sure the view data is only
update when there is a change and the 3rd makes a check in the
krb5_child more relaxed. This needed when the client gets a different
view and the UID of a user changes. In this case and old ccache cannot
be read by the user anymore and we should not fail in this case.
bye,
Sumit
-------------- next part --------------
From c286c4e040b0ffaf30e348d4ccd0c4fd50c959d6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 10:01:40 +0100
Subject: [PATCH 1/3] krb5: make krb5 provider view aware
---
src/providers/ipa/ipa_subdomains.c | 13 +++++++++++++
src/providers/krb5/krb5_auth.c | 18 ++++++++++++------
2 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 6fdb0be..d053d46 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1174,6 +1174,19 @@ static void ipa_get_view_name_done(struct tevent_req *req)
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
}
}
+
+ /* TODO: only needed if view changed */
+ ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "sysdb_master_domain_update failed.\n");
+ goto done;
+ }
+
+ ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
+ goto done;
+ }
}
ret = ipa_check_master(ctx);
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index e791aee..e43b365 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -462,8 +462,8 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
}
kr = state->kr;
- ret = sysdb_get_user_attr(state, state->domain, state->pd->user, attrs,
- &res);
+ ret = sysdb_get_user_attr_with_views(state, state->domain, state->pd->user,
+ attrs, &res);
if (ret) {
DEBUG(SSSDBG_FUNC_DATA,
"sysdb search for upn of user [%s] failed.\n", pd->user);
@@ -503,14 +503,18 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
goto done;
}
- kr->homedir = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_HOMEDIR,
- NULL);
+ kr->homedir = sss_view_ldb_msg_find_attr_as_string(state->domain,
+ res->msgs[0],
+ SYSDB_HOMEDIR,
+ NULL);
if (kr->homedir == NULL) {
DEBUG(SSSDBG_CONF_SETTINGS,
"Home directory for user [%s] not known.\n", pd->user);
}
- kr->uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
+ kr->uid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
+ res->msgs[0],
+ SYSDB_UIDNUM, 0);
if (kr->uid == 0) {
DEBUG(SSSDBG_CONF_SETTINGS,
"UID for user [%s] not known.\n", pd->user);
@@ -518,7 +522,9 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
goto done;
}
- kr->gid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_GIDNUM, 0);
+ kr->gid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
+ res->msgs[0],
+ SYSDB_GIDNUM, 0);
if (kr->gid == 0) {
DEBUG(SSSDBG_CONF_SETTINGS,
"GID for user [%s] not known.\n", pd->user);
--
1.8.3.1
-------------- next part --------------
From 8d16df2271fb0b10287c8fdbfd72cdbb86d8443b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 13:41:37 +0100
Subject: [PATCH 2/3] IPA: only update view data if it really changed
---
src/providers/ipa/ipa_subdomains.c | 116 +++++++++++++++++++++----------------
1 file changed, 66 insertions(+), 50 deletions(-)
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index d053d46..3148389 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1110,23 +1110,44 @@ static void ipa_get_view_name_done(struct tevent_req *req)
"View name changed, this is not supported at runtime. " \
"Please restart SSSD to get the new view applied.\n");
} else {
- ctx->sd_ctx->view_read_at_init = true;
- /* View name changed */
- if (ctx->sd_ctx->id_ctx->view_name != NULL) {
- ret = sysdb_transaction_start(ctx->sd_ctx->be_ctx->domain->sysdb);
- if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_start failed.\n");
- goto done;
- }
+ if (ctx->sd_ctx->id_ctx->view_name == NULL
+ || strcmp(ctx->sd_ctx->id_ctx->view_name, view_name) != 0) {
+ /* View name changed */
+
+ if (ctx->sd_ctx->id_ctx->view_name != NULL) {
+ ret = sysdb_transaction_start(
+ ctx->sd_ctx->be_ctx->domain->sysdb);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "sysdb_transaction_start failed.\n");
+ goto done;
+ }
- if (strcmp(ctx->sd_ctx->id_ctx->view_name,
- SYSDB_DEFAULT_VIEW_NAME) != 0) {
- /* Old view was not the default view, delete view tree */
- ret = sysdb_delete_view_tree(ctx->sd_ctx->be_ctx->domain->sysdb,
+ if (strcmp(ctx->sd_ctx->id_ctx->view_name,
+ SYSDB_DEFAULT_VIEW_NAME) != 0) {
+ /* Old view was not the default view, delete view tree */
+ ret = sysdb_delete_view_tree(
+ ctx->sd_ctx->be_ctx->domain->sysdb,
ctx->sd_ctx->id_ctx->view_name);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "sysdb_delete_view_tree failed.\n");
+ sret = sysdb_transaction_cancel(
+ ctx->sd_ctx->be_ctx->domain->sysdb);
+ if (sret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "sysdb_transaction_cancel failed.\n");
+ goto done;
+ }
+ goto done;
+ }
+ }
+
+ ret = sysdb_invalidate_overrides(
+ ctx->sd_ctx->be_ctx->domain->sysdb);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE,
- "sysdb_delete_view_tree failed.\n");
+ "sysdb_invalidate_overrides failed.\n");
sret = sysdb_transaction_cancel(
ctx->sd_ctx->be_ctx->domain->sysdb);
if (sret != EOK) {
@@ -1136,57 +1157,52 @@ static void ipa_get_view_name_done(struct tevent_req *req)
}
goto done;
}
- }
- ret = sysdb_invalidate_overrides(
+ ret = sysdb_transaction_commit(
ctx->sd_ctx->be_ctx->domain->sysdb);
- if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE,
- "sysdb_invalidate_overrides failed.\n");
- sret = sysdb_transaction_cancel(
- ctx->sd_ctx->be_ctx->domain->sysdb);
- if (sret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_cancel failed.\n");
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "sysdb_transaction_commit failed.\n");
goto done;
}
- goto done;
+
+ /* TODO: start referesh task */
}
- ret = sysdb_transaction_commit(ctx->sd_ctx->be_ctx->domain->sysdb);
+ ret = sysdb_update_view_name(ctx->sd_ctx->be_ctx->domain->sysdb,
+ view_name);
if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_commit failed.\n");
- goto done;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Cannot add/update view name to sysdb.\n");
+ } else {
+ talloc_free(ctx->sd_ctx->id_ctx->view_name);
+ ctx->sd_ctx->id_ctx->view_name = talloc_strdup(
+ ctx->sd_ctx->id_ctx,
+ view_name);
+ if (ctx->sd_ctx->id_ctx->view_name == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
+ }
}
-
- /* TODO: start referesh task */
}
- ret = sysdb_update_view_name(ctx->sd_ctx->be_ctx->domain->sysdb,
- view_name);
- if (ret != EOK) {
- DEBUG(SSSDBG_CRIT_FAILURE,
- "Cannot add/update view name to sysdb.\n");
- } else {
- talloc_free(ctx->sd_ctx->id_ctx->view_name);
- ctx->sd_ctx->id_ctx->view_name = talloc_strdup(ctx->sd_ctx->id_ctx,
- view_name);
- if (ctx->sd_ctx->id_ctx->view_name == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
+ if (!ctx->sd_ctx->view_read_at_init) {
+ /* refresh view data of all domains at startup */
+ ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "sysdb_master_domain_update failed.\n");
+ goto done;
}
- }
- /* TODO: only needed if view changed */
- ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
- if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_master_domain_update failed.\n");
- goto done;
+ ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
+ goto done;
+ }
}
- ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
- if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
- goto done;
- }
+ ctx->sd_ctx->view_read_at_init = true;
+
}
ret = ipa_check_master(ctx);
--
1.8.3.1
-------------- next part --------------
From ad3ce954c086ca8882c20d4fe22b5202efcbff72 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 13:42:19 +0100
Subject: [PATCH 3/3] krb5: do not fail if checking the old ccache failed
---
Makefile.am | 1 +
src/providers/krb5/krb5_child.c | 7 +++++--
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index 56a562c..130c647 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2505,6 +2505,7 @@ krb5_child_SOURCES = \
src/util/signal.c \
src/util/strtonum.c \
src/util/become_user.c \
+ src/util/util_errors.c \
src/sss_client/common.c \
$(NULL)
krb5_child_CFLAGS = \
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 94cd34e..d828dd5 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -34,6 +34,7 @@
#include "util/user_info_msg.h"
#include "util/child_common.h"
#include "util/find_uid.h"
+#include "src/util/util_errors.h"
#include "providers/dp_backend.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_utils.h"
@@ -2039,8 +2040,10 @@ static int k5c_ccache_setup(struct krb5_req *kr, uint32_t offline)
ret = k5c_check_old_ccache(kr);
if (ret != 0) {
- DEBUG(SSSDBG_OP_FAILURE, "Cannot check old ccache\n");
- return ret;
+ DEBUG(SSSDBG_CRIT_FAILURE, "Cannot check old ccache [%s]: [%d][%s]. " \
+ "Assuming old cache is invalid " \
+ "and not used.\n",
+ kr->old_ccname, ret, sss_strerror(ret));
}
/* Pre-creating the ccache must be done as root, otherwise we can't mkdir
--
1.8.3.1
More information about the sssd-devel
mailing list