From 8a122e2eab007a5accd0a57aa68a22d79ebaa6d6 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 26 Feb 2014 11:38:05 +0100 Subject: [PATCH] SUDO: AD provider This patch adds the sudo target to the AD provider. The main reason is to cover different default settings in the LDAP and AD provider. E.g. the default for ldap_id_mapping is True in the AD provider and False in the LDAP provider. If ldap_id_mapping was not set explicitly in the config file both components worked with different setting. Fixes https://fedorahosted.org/sssd/ticket/2256 --- Makefile.am | 5 ++++ src/config/SSSDConfigTest.py | 2 +- src/config/etc/sssd.api.d/sssd-ad.conf | 21 ++++++++++++++ src/man/sssd-ad.5.xml | 6 ++-- src/man/sssd.conf.5.xml | 15 ++++++++-- src/providers/ad/ad_common.h | 4 +++ src/providers/ad/ad_init.c | 25 +++++++++++++++++ src/providers/ad/ad_sudo.c | 51 ++++++++++++++++++++++++++++++++++ 8 files changed, 122 insertions(+), 7 deletions(-) create mode 100644 src/providers/ad/ad_sudo.c diff --git a/Makefile.am b/Makefile.am index 36312fe..ce18d36 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1958,6 +1958,11 @@ libsss_ad_la_SOURCES = \ src/util/sss_krb5.c \ src/util/sss_ldap.c +if BUILD_SUDO +libsss_ad_la_SOURCES += \ + src/providers/ad/ad_sudo.c +endif + libsss_ad_la_CFLAGS = \ $(AM_CFLAGS) \ $(SYSTEMD_LOGIN_CFLAGS) \ diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py index a0c7d31..bfec8d0 100755 --- a/src/config/SSSDConfigTest.py +++ b/src/config/SSSDConfigTest.py @@ -731,7 +731,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): control_provider_dict = { 'ipa': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs', 'session', 'hostid', 'subdomains'], - 'ad': ['id', 'auth', 'access', 'chpass'], + 'ad': ['id', 'auth', 'access', 'chpass', 'sudo', 'subdomains'], 'local': ['id', 'auth', 'chpass'], 'ldap': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs'], 'krb5': ['auth', 'access', 'chpass'], diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf index 6b136f2..aa20ca0 100644 --- a/src/config/etc/sssd.api.d/sssd-ad.conf +++ b/src/config/etc/sssd.api.d/sssd-ad.conf @@ -132,3 +132,24 @@ krb5_kpasswd = str, None, false krb5_backup_kpasswd = str, None, false [provider/ad/subdomains] + +[provider/ad/sudo] +ldap_sudo_search_base = str, None, false +ldap_sudo_full_refresh_interval = int, None, false +ldap_sudo_smart_refresh_interval = int, None, false +ldap_sudo_use_host_filter = bool, None, false +ldap_sudo_hostnames = str, None, false +ldap_sudo_ip = str, None, false +ldap_sudo_include_netgroups = bool, None, false +ldap_sudo_include_regexp = bool, None, false +ldap_sudorule_object_class = str, None, false +ldap_sudorule_name = str, None, false +ldap_sudorule_command = str, None, false +ldap_sudorule_host = str, None, false +ldap_sudorule_user = str, None, false +ldap_sudorule_option = str, None, false +ldap_sudorule_runasuser = str, None, false +ldap_sudorule_runasgroup = str, None, false +ldap_sudorule_notbefore = str, None, false +ldap_sudorule_notafter = str, None, false +ldap_sudorule_order = str, None, false diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index b763e42..9b39e08 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -60,9 +60,9 @@ However, it is neither necessary nor recommended to set these - options. The AD provider can also be used as an access and chpass - provider. No configuration of the access provider is required on - the client side. + options. The AD provider can also be used as an access, chpass and + sudo provider. No configuration of the access provider is required + on the client side. By default, the AD provider will map UID and GID values from the diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 4ce90de..9668bb0 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -1465,14 +1465,23 @@ fallback_homedir = /home/%u sssd-ldap 5 - for more information on configuring LDAP. + for more information on configuring + LDAP. + + + ipa the same as ldap + but with IPA default settings. + + + ad the same as ldap + but with AD default settings. none disables SUDO explicitly. - Default: The value of id_provider is used if it - is set. + Default: The value of id_provider is + used if it is set. diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index d370cef..bc11e54 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -128,4 +128,8 @@ errno_t ad_dyndns_init(struct be_ctx *be_ctx, struct ad_options *ctx); void ad_dyndns_timer(void *pvt); +int ad_sudo_init(struct be_ctx *be_ctx, + struct ad_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data); #endif /* AD_COMMON_H_ */ diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c index 60f1939..74ef423 100644 --- a/src/providers/ad/ad_init.c +++ b/src/providers/ad/ad_init.c @@ -467,3 +467,28 @@ int sssm_ad_subdomains_init(struct be_ctx *bectx, return EOK; } + + +int sssm_ad_sudo_init(struct be_ctx *bectx, + struct bet_ops **ops, + void **pvt_data) +{ +#ifdef BUILD_SUDO + struct ad_id_ctx *id_ctx; + int ret; + + DEBUG(SSSDBG_TRACE_INTERNAL, "Initializing AD sudo handler\n"); + + ret = sssm_ad_id_init(bectx, ops, (void **) &id_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, "sssm_ad_id_init failed.\n"); + return ret; + } + + return ad_sudo_init(bectx, id_ctx, ops, pvt_data); +#else + DEBUG(SSSDBG_MINOR_FAILURE, "Sudo init handler called but SSSD is " + "built without sudo support, ignoring\n"); + return EOK; +#endif +} diff --git a/src/providers/ad/ad_sudo.c b/src/providers/ad/ad_sudo.c new file mode 100644 index 0000000..53ce5af --- /dev/null +++ b/src/providers/ad/ad_sudo.c @@ -0,0 +1,51 @@ +/* + SSSD + + AD SUDO Provider Initialization functions + + Authors: + Sumit Bose + + Copyright (C) 2014 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "providers/ad/ad_common.h" +#include "providers/ldap/sdap_sudo.h" + +int ad_sudo_init(struct be_ctx *be_ctx, + struct ad_id_ctx *id_ctx, + struct bet_ops **ops, + void **pvt_data) +{ + int ret; + struct ad_options *ad_options; + struct sdap_options *ldap_options; + + DEBUG(SSSDBG_TRACE_INTERNAL, "Initializing sudo AD back end\n"); + + ret = sdap_sudo_init(be_ctx, id_ctx->sdap_id_ctx, ops, pvt_data); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize LDAP SUDO [%d]: %s\n", + ret, strerror(ret)); + return ret; + } + + ad_options = id_ctx->ad_options; + ldap_options = id_ctx->sdap_id_ctx->opts; + + ad_options->id->sudorule_map = ldap_options->sudorule_map; + return EOK; +} -- 1.8.3.1