From db2ca398ef66d73bf04d4cf45a327a8472ce834e Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Fri, 6 Jul 2018 15:17:10 +0200

Subject: [PATCH 09/19] confdb: add special handling for rules for the files

 provider

To make the configuration more simple there are some special assumption

for local users, i.e. user managed by the files provider.

Related to https://pagure.io/SSSD/sssd/issue/3500

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit 9386ef605ffbc03abe2bc273efddbc099441fe3b)

---

 src/confdb/confdb.c              | 59 ++++++++++++++++++++++++++++++++++++++++

 src/confdb/confdb.h              |  1 +

 src/providers/files/files_init.c | 10 +++++++

 3 files changed, 70 insertions(+)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c

index 7de0fb3cc7031767d748bd4fb739a3376fd364e3..6370a0411d98b6611dd384e9ab0de1d580be9c2d 100644

--- a/src/confdb/confdb.c

+++ b/src/confdb/confdb.c

@@ -2197,6 +2197,56 @@ done:

     return ret;

 }

+static errno_t certmap_local_check(struct ldb_message *msg)

+{

+    const char *rule_name;

+    const char *tmp_str;

+    int ret;

+

+    rule_name = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_NAME, NULL);

+    if (rule_name == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Certficate mapping rule [%s] has no name.",

+                                   ldb_dn_get_linearized(msg->dn));

+        return EINVAL;

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_DOMAINS, NULL);

+    if (tmp_str != NULL) {

+        DEBUG(SSSDBG_CONF_SETTINGS,

+              "Option [%s] is ignored for local certmap rules.\n",

+              CONFDB_CERTMAP_DOMAINS);

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_MAPRULE, NULL);

+    if (tmp_str != NULL) {

+        if (tmp_str[0] != '(' || tmp_str[strlen(tmp_str) - 1] != ')') {

+            DEBUG(SSSDBG_CONF_SETTINGS,

+                  "Mapping rule must be in braces (...).\n");

+            return EINVAL;

+        }

+        DEBUG(SSSDBG_TRACE_ALL, "Using [%s] mapping rule of [%s].\n",

+                                tmp_str, ldb_dn_get_linearized(msg->dn));

+        return EOK;

+    }

+

+    tmp_str = talloc_asprintf(msg, "(%s)", rule_name);

+    if (tmp_str == NULL) {

+        DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");

+        return ENOMEM;

+    }

+    ret = ldb_msg_add_string(msg, CONFDB_CERTMAP_MAPRULE, tmp_str);

+    if (ret != LDB_SUCCESS) {

+        talloc_free(discard_const(tmp_str));

+        DEBUG(SSSDBG_OP_FAILURE, "ldb_msg_add_string failed.\n");

+        return EIO;

+    }

+

+    DEBUG(SSSDBG_TRACE_ALL, "Using [%s] as mapping rule for [%s].\n",

+                            tmp_str, ldb_dn_get_linearized(msg->dn));

+

+    return EOK;

+}

+

 static errno_t confdb_get_all_certmaps(TALLOC_CTX *mem_ctx,

                                        struct confdb_ctx *cdb,

                                        struct sss_domain_info *dom,

@@ -2245,6 +2295,15 @@ static errno_t confdb_get_all_certmaps(TALLOC_CTX *mem_ctx,

     }

     for (c = 0; c < res->count; c++) {

+        if (is_files_provider(dom)) {

+            ret = certmap_local_check(res->msgs[c]);

+            if (ret != EOK) {

+                DEBUG(SSSDBG_CONF_SETTINGS,

+                      "Invalid certificate mapping [%s] for local user, "

+                      "ignored.\n", ldb_dn_get_linearized(res->msgs[c]->dn));

+                continue;

+            }

+        }

         ret = sysdb_ldb_msg_attr_to_certmap_info(certmap_list, res->msgs[c],

                                                  attrs, &certmap_list[c]);

         if (ret != EOK) {

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index 2aae93a278eb62e9b8a18885f06d66b20f269f60..625d156267ebf5f59e3974663256acfbb5f3b027 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -685,6 +685,7 @@ int confdb_get_sub_sections(TALLOC_CTX *mem_ctx,

  */

 int confdb_certmap_to_sysdb(struct confdb_ctx *cdb,

                             struct sss_domain_info *dom);

+

 /**

  * @}

  */

diff --git a/src/providers/files/files_init.c b/src/providers/files/files_init.c

index 746c04af1d766b4da623196d3ff6ebc99ca6efef..c793bed9cc99db958b50ed9f6d69a2f8f337b409 100644

--- a/src/providers/files/files_init.c

+++ b/src/providers/files/files_init.c

@@ -189,6 +189,16 @@ int sssm_files_init(TALLOC_CTX *mem_ctx,

         goto done;

     }

+    ret = confdb_certmap_to_sysdb(be_ctx->cdb, be_ctx->domain);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to initialize certificate mapping rules. "

+              "Authentication with certificates/Smartcards might not work "

+              "as expected.\n");

+        /* not fatal, ignored */

+    }

+

+

     *_module_data = ctx;

     ret = EOK;

 done:

-- 

2.14.4