|
 |
0d097b |
From d702d594e380a1d0f0e937524bdd8a3eabc9bdf1 Mon Sep 17 00:00:00 2001
|
|
|
0d097b |
From: Sumit Bose <sbose@redhat.com>
|
|
|
0d097b |
Date: Fri, 27 Sep 2019 13:45:13 +0200
|
|
|
0d097b |
Subject: [PATCH 13/13] ad: set min and max ssf for ldaps
|
|
|
0d097b |
MIME-Version: 1.0
|
|
|
0d097b |
Content-Type: text/plain; charset=UTF-8
|
|
|
0d097b |
Content-Transfer-Encoding: 8bit
|
|
|
0d097b |
|
|
|
0d097b |
AD does not allow to use encryption in the TLS and SASL layer at the
|
|
|
0d097b |
same time. To be able to use ldaps this patch sets min and max ssf to 0
|
|
|
0d097b |
if ldaps should be used.
|
|
|
0d097b |
|
|
|
0d097b |
Related to https://pagure.io/SSSD/sssd/issue/4131
|
|
|
0d097b |
|
|
|
0d097b |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
0d097b |
---
|
|
|
0d097b |
src/providers/ad/ad_common.c | 21 +++++++++++++++++++++
|
|
|
0d097b |
src/providers/ad/ad_common.h | 2 ++
|
|
|
0d097b |
src/providers/ad/ad_subdomains.c | 4 ++++
|
|
|
0d097b |
3 files changed, 27 insertions(+)
|
|
|
0d097b |
|
|
|
0d097b |
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
|
|
|
0d097b |
index a2369166a..51300f5b2 100644
|
|
|
0d097b |
--- a/src/providers/ad/ad_common.c
|
|
|
0d097b |
+++ b/src/providers/ad/ad_common.c
|
|
|
0d097b |
@@ -1021,6 +1021,23 @@ done:
|
|
|
0d097b |
return;
|
|
|
0d097b |
}
|
|
|
0d097b |
|
|
|
0d097b |
+void ad_set_ssf_for_ldaps(struct sdap_options *id_opts)
|
|
|
0d097b |
+{
|
|
|
0d097b |
+ int ret;
|
|
|
0d097b |
+
|
|
|
0d097b |
+ DEBUG(SSSDBG_TRACE_ALL, "Setting ssf for ldaps usage.\n");
|
|
|
0d097b |
+ ret = dp_opt_set_int(id_opts->basic, SDAP_SASL_MINSSF, 0);
|
|
|
0d097b |
+ if (ret != EOK) {
|
|
|
0d097b |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
0d097b |
+ "Failed to set SASL minssf for ldaps usage, ignored.\n");
|
|
|
0d097b |
+ }
|
|
|
0d097b |
+ ret = dp_opt_set_int(id_opts->basic, SDAP_SASL_MAXSSF, 0);
|
|
|
0d097b |
+ if (ret != EOK) {
|
|
|
0d097b |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
0d097b |
+ "Failed to set SASL maxssf for ldaps usage, ignored.\n");
|
|
|
0d097b |
+ }
|
|
|
0d097b |
+}
|
|
|
0d097b |
+
|
|
|
0d097b |
static errno_t
|
|
|
0d097b |
ad_set_sdap_options(struct ad_options *ad_opts,
|
|
|
0d097b |
struct sdap_options *id_opts)
|
|
|
0d097b |
@@ -1079,6 +1096,10 @@ ad_set_sdap_options(struct ad_options *ad_opts,
|
|
|
0d097b |
goto done;
|
|
|
0d097b |
}
|
|
|
0d097b |
|
|
|
0d097b |
+ if (dp_opt_get_bool(ad_opts->basic, AD_USE_LDAPS)) {
|
|
|
0d097b |
+ ad_set_ssf_for_ldaps(id_opts);
|
|
|
0d097b |
+ }
|
|
|
0d097b |
+
|
|
|
0d097b |
/* Warn if the user is doing something silly like overriding the schema
|
|
|
0d097b |
* with the AD provider
|
|
|
0d097b |
*/
|
|
|
0d097b |
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
|
|
|
0d097b |
index 820e06124..d23aee616 100644
|
|
|
0d097b |
--- a/src/providers/ad/ad_common.h
|
|
|
0d097b |
+++ b/src/providers/ad/ad_common.h
|
|
|
0d097b |
@@ -181,6 +181,8 @@ errno_t
|
|
|
0d097b |
ad_get_dyndns_options(struct be_ctx *be_ctx,
|
|
|
0d097b |
struct ad_options *ad_opts);
|
|
|
0d097b |
|
|
|
0d097b |
+void ad_set_ssf_for_ldaps(struct sdap_options *id_opts);
|
|
|
0d097b |
+
|
|
|
0d097b |
struct ad_id_ctx *
|
|
|
0d097b |
ad_id_ctx_init(struct ad_options *ad_opts, struct be_ctx *bectx);
|
|
|
0d097b |
|
|
|
0d097b |
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
|
|
|
0d097b |
index d8c201437..a9c6b9f28 100644
|
|
|
0d097b |
--- a/src/providers/ad/ad_subdomains.c
|
|
|
0d097b |
+++ b/src/providers/ad/ad_subdomains.c
|
|
|
0d097b |
@@ -328,6 +328,10 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
|
|
|
0d097b |
return ret;
|
|
|
0d097b |
}
|
|
|
0d097b |
|
|
|
0d097b |
+ if (dp_opt_get_bool(ad_options->basic, AD_USE_LDAPS)) {
|
|
|
0d097b |
+ ad_set_ssf_for_ldaps(ad_options->id);
|
|
|
0d097b |
+ }
|
|
|
0d097b |
+
|
|
|
0d097b |
ret = ad_inherit_opts_if_needed(id_ctx->sdap_id_ctx->opts->basic,
|
|
|
0d097b |
ad_options->id->basic,
|
|
|
0d097b |
be_ctx->cdb, subdom_conf_path,
|
|
|
0d097b |
--
|
|
|
0d097b |
2.20.1
|
|
|
0d097b |
|