From e13d8a12513bfba1531cc867fbf687ff8673241f Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Thu, 10 Dec 2020 19:45:08 +0100

Subject: [PATCH] Squashed commit of the following:

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

commit 6b3b4b0bf945814e8886b900dcda18de25f38bb4

Author: Sumit Bose <sbose@redhat.com>

Date:   Thu Dec 12 13:10:16 2019 +0100

    certmap: mention special regex characters in man page

    Since some of the matching rules use regular expressions some characters

    must be escaped so that they can be used a ordinary characters in the

    rules.

    Related to https://pagure.io/SSSD/sssd/issue/4127

    Reviewed-by: Michal Židek <mzidek@redhat.com>

    (cherry picked from commit 21cb9fb28db1f2eb4ee770eb029bfe20233e4392)

commit 451410e72514bd68e4b56b1a42c97ade6783e74b

Author: Sumit Bose <sbose@redhat.com>

Date:   Tue Nov 27 16:42:38 2018 +0100

    test: add certificate without KU to certmap tests

    Make sure there is a test for a certificate without key-usage (KU)

    Related to https://bugzilla.redhat.com/show_bug.cgi?id=1660899

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit e1734ba828470d00370c44c95da56822fdcc104d)

commit e7966dfa40b9a7fcde79a07f146ae5283a7bc8e5

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Nov 26 12:03:13 2018 +0100

    certmap: allow missing KU in OpenSSL version

    Make sure a missing key-usage (KU) is not treated as an error and is

    handled equally in the NSS and OpenSSL implementation

    Related to https://bugzilla.redhat.com/show_bug.cgi?id=1660899

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit aef8e49b7ee2e7743d6981070d61bc89b7c8fcfb)

commit 6e9e6673916b61197df8a809f56c73d8bdbb868c

Author: Alexey Tikhonov <atikhono@redhat.com>

Date:   Mon Jan 7 17:04:34 2019 +0100

    CONFIG: validator rules & test

    Add support of 'certmap' config section to validator rules

    Resolves:

    https://pagure.io/SSSD/sssd/issue/3845

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 8e9e8011ce17860bec67a572e4c11a9178c03b8e)

commit eec9d72a242b2b05369f0eb89c4ebcda26d59802

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Sep 7 22:26:21 2018 +0200

    intg: add Smartcard authentication tests

    Two test for Smartcard authentication of a local user, i.e. a user

    managed by the files provider, are added. One for a successful

    authentication, the other for a failed authentication with a wrong PIN.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked with fixes from commit 657f3b89bca9adfb13f0867c91f1d76845d2d6dd)

commit cc2840fbb494ac686e9a3ae0016827a44d14769f

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Sep 7 22:17:47 2018 +0200

    test_ca: set a password/PIN to nss databases

    To make sure the PIN is properly checked during tests the NSS databases

    need a password.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit a45a410dc7fa7cf84bcac541e693ee8781e25431)

commit 0a989c62b4a3b73f23d9b6956ac81afaed9901f7

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Sep 10 22:03:55 2018 +0200

    test_ca: test library only for readable

    On Debian libraries typically do not have the execute-bit set so it is

    better to only check for readability.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 91aea762d02731193eb66a00b930ff1fe8bc5ab8)

commit 5a47b213b11cbf74dad47594d1826985f6b68f22

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Sep 7 22:16:50 2018 +0200

    PAM: use better PAM error code for failed Smartcard authentication

    If the user enters a wrong PIN the PAM responder currently returns

    PAM_USER_UNKNOWN better is PAM_AUTH_ERR.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 442ae7b1d0704cdd667d4f1ba4c165ce3f3ffed4)

commit b6907d7cd5ab7568971ddb48f3932f106e86fe06

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Sep 3 18:38:42 2018 +0200

    doc: add certificate mapping section to man page

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked with fixes from commit 0c739e969a617bdb4c06cdfd63772bf6d283c518)

commit d75b196312c4cec767c196c663ff969b6aebcd6b

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Jul 9 18:56:26 2018 +0200

    PAM: add certificate matching rules from all domains

    Currently the PAM responder only reads the certificate mapping and

    matching rules from the first domain. To support Smartcard

    authentication for local and remote users all configured domains must be

    taken into account.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit d42f44d54453d3ddb54875374c1b61dc1e7cd821)

commit 167ab7206913c17617a8e5ada7567d91f8ed6e11

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Jul 9 18:45:21 2018 +0200

    responder: make sure SSS_DP_CERT is passed to files provider

    Currently the files provider is only contacted once in a while to update

    the full cache with fresh data from the passwd file. To allow rule based

    certificate mapping the lookup by certificate request must be always

    send to the file provider so that it can evaluate the rules and add the

    certificate to cached entry of the matching user.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 9fdc5f1d87a133885e6a22810a7eb980c60dcb55)

commit 69def7a3e81313a30ceae937f9cde5d62e999c3d

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Jul 9 18:37:46 2018 +0200

    files: add support for Smartcard authentication

    To support certificate based authentication the files provider must be

    able to map a certificate to a user during a BE_REQ_BY_CERT request.

    Additionally the authentication request should be handled by the PAM

    responder code which is responsible for the local Smartcard

    authentication. To be consistent with the other backend an authentication

    handler is added to the files provider which unconditionally returns the

    offline error code telling the PAM responder to handle the

    authentication if it has access to the needed credentials.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 275eeed24adc31f3df51cf278f509a4be76a3a3c)

commit e96ba56ea8037d58e1335f7dacd3b19919bc4135

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Jul 6 15:17:10 2018 +0200

    confdb: add special handling for rules for the files provider

    To make the configuration more simple there are some special assumption

    for local users, i.e. user managed by the files provider.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 9386ef605ffbc03abe2bc273efddbc099441fe3b)

commit d304f5a9e60f7f6eb915a10067ee2e5e5f14c369

Author: Sumit Bose <sbose@redhat.com>

Date:   Tue Jul 3 11:31:12 2018 +0200

    sysdb: sysdb_certmap_add() handle domains more flexible

    sysdb_ldb_msg_attr_to_certmap_info() creates an empty list if there are

    no domains defined, sysdb_certmap_add() should be able to handle both a

    missing or an empty domains list.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 06f7005d38d164879b727708feff80004b422f91)

commit 53befb320c2b60a420a2588425fd5004ceec791a

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Jul 2 12:20:53 2018 +0200

    AD/LDAP: read certificate mapping rules from config file

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 15301db1dc1e5e2aafc1805a30e3b28756218c9b)

commit 670a1ca6b7b22bb3a1079111528ee7e4aafd97e5

Author: Sumit Bose <sbose@redhat.com>

Date:   Mon Jul 2 10:38:54 2018 +0200

    confdb: add confdb_certmap_to_sysdb()

    Add a function to write certificate mapping and matching rules from the

    config database to the cache of a domain.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked with fixes from commit d9cc38008a51a8a5189904f175e4d10cbde4a974)

commit 14c15cc6db16726419fbf6df76b5c83aec49192a

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Jun 29 18:13:59 2018 +0200

    sysdb: add attr_map attribute to sysdb_ldb_msg_attr_to_certmap_info()

    Allow more flexible attribute mapping in

    sysdb_ldb_msg_attr_to_certmap_info()

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 0bf709ad348ca115443bd21e4e369abd5d7698c4)

commit f867c2a293651043072afe1dd7a8a78a05e5fe4d

Author: Sumit Bose <sbose@redhat.com>

Date:   Tue Jul 3 11:30:07 2018 +0200

    sysdb_ldb_msg_attr_to_certmap_info: set SSS_CERTMAP_MIN_PRIO

    Make sure that priority is always set.

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit d1dd7f7703b4f40d2fbb830e28969b31b8a1673e)

commit 8ef2cc11008ef86f4dfcbc267c797bf8ee265455

Author: Sumit Bose <sbose@redhat.com>

Date:   Fri Jun 29 17:49:50 2018 +0200

    sysdb: extract sysdb_ldb_msg_attr_to_certmap_info() call

    Related to https://pagure.io/SSSD/sssd/issue/3500

    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

    (cherry picked from commit 7c619ae08f05a7595d15cf11b64461a7d19cfaa7)

---

 Makefile.am                                   |   2 +

 configure.ac                                  |   1 +

 contrib/sssd.spec.in                          |   1 +

 src/confdb/confdb.c                           | 158 +++++++++++++

 src/confdb/confdb.h                           |  23 ++

 src/config/cfg_rules.ini                      |  10 +

 src/db/sysdb.h                                |   5 +

 src/db/sysdb_certmap.c                        | 223 +++++++++++-------

 src/external/cwrap.m4                         |   5 +

 src/external/intgcheck.m4                     |   1 +

 src/external/test_ca.m4                       |   2 +-

 src/lib/certmap/sss_cert_content_crypto.c     |  22 +-

 src/lib/certmap/sss_cert_content_nss.c        |  21 +-

 src/man/sss-certmap.5.xml                     |   9 +

 src/man/sssd.conf.5.xml                       | 149 ++++++++++++

 src/providers/ad/ad_init.c                    |  16 ++

 src/providers/files/files_auth.c              |  69 ++++++

 src/providers/files/files_certmap.c           | 186 +++++++++++++++

 src/providers/files/files_id.c                |  20 ++

 src/providers/files/files_init.c              |  29 +++

 src/providers/files/files_private.h           |  17 ++

 src/providers/ldap/ldap_init.c                |  16 ++

 src/responder/common/responder_dp.c           |  20 +-

 src/responder/pam/pamsrv.h                    |   2 +-

 src/responder/pam/pamsrv_cmd.c                |   6 +-

 src/responder/pam/pamsrv_p11.c                |  77 +++---

 src/tests/cmocka/test_certmap.c               |  45 ++++

 src/tests/cmocka/test_config_check.c          |  16 +-

 src/tests/intg/test_pam_responder.py          | 109 ++++++++-

 src/tests/test_CA/Makefile.am                 |  24 +-

 src/tests/test_CA/SSSD_test_cert_0004.config  |  11 +

 src/tests/test_CA/SSSD_test_cert_key_0004.pem |  28 +++

 32 files changed, 1170 insertions(+), 153 deletions(-)

 create mode 100644 src/providers/files/files_auth.c

 create mode 100644 src/providers/files/files_certmap.c

 create mode 100644 src/tests/test_CA/SSSD_test_cert_0004.config

 create mode 100644 src/tests/test_CA/SSSD_test_cert_key_0004.pem

diff --git a/Makefile.am b/Makefile.am

index 718041634..77f5faf6b 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -4094,6 +4094,8 @@ libsss_proxy_la_LDFLAGS = \

 libsss_files_la_SOURCES = \

     src/providers/files/files_init.c \

     src/providers/files/files_id.c \

+    src/providers/files/files_auth.c \

+    src/providers/files/files_certmap.c \

     src/providers/files/files_ops.c \

     src/util/inotify.c \

     $(NULL)

diff --git a/configure.ac b/configure.ac

index 5154918b1..89abddef4 100644

--- a/configure.ac

+++ b/configure.ac

@@ -488,6 +488,7 @@ AM_CONDITIONAL([HAVE_CHECK], [test x$have_check != x])

 AM_CHECK_CMOCKA

 AM_CHECK_UID_WRAPPER

 AM_CHECK_NSS_WRAPPER

+AM_CHECK_PAM_WRAPPER

 AM_CHECK_TEST_CA

 # Check if the user wants SSSD to be compiled with systemtap probes

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in

index 10b5bd56c..52a77ae7a 100644

--- a/contrib/sssd.spec.in

+++ b/contrib/sssd.spec.in

@@ -236,6 +236,7 @@ BuildRequires: selinux-policy-targeted

 BuildRequires: libcmocka-devel >= 1.0.0

 BuildRequires: uid_wrapper

 BuildRequires: nss_wrapper

+BuildRequires: pam_wrapper

 # Test CA requires openssl independent if SSSD is build with NSS or openssl,

 # openssh is needed for ssh-keygen and NSS builds need nss-tools for certutil.

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c

index e55f88e4e..97de6d3b1 100644

--- a/src/confdb/confdb.c

+++ b/src/confdb/confdb.c

@@ -2209,3 +2209,161 @@ done:

     talloc_free(tmp_ctx);

     return ret;

 }

+

+static errno_t certmap_local_check(struct ldb_message *msg)

+{

+    const char *rule_name;

+    const char *tmp_str;

+    int ret;

+

+    rule_name = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_NAME, NULL);

+    if (rule_name == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Certficate mapping rule [%s] has no name.",

+                                   ldb_dn_get_linearized(msg->dn));

+        return EINVAL;

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_DOMAINS, NULL);

+    if (tmp_str != NULL) {

+        DEBUG(SSSDBG_CONF_SETTINGS,

+              "Option [%s] is ignored for local certmap rules.\n",

+              CONFDB_CERTMAP_DOMAINS);

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, CONFDB_CERTMAP_MAPRULE, NULL);

+    if (tmp_str != NULL) {

+        if (tmp_str[0] != '(' || tmp_str[strlen(tmp_str) - 1] != ')') {

+            DEBUG(SSSDBG_CONF_SETTINGS,

+                  "Mapping rule must be in braces (...).\n");

+            return EINVAL;

+        }

+        DEBUG(SSSDBG_TRACE_ALL, "Using [%s] mapping rule of [%s].\n",

+                                tmp_str, ldb_dn_get_linearized(msg->dn));

+        return EOK;

+    }

+

+    tmp_str = talloc_asprintf(msg, "(%s)", rule_name);

+    if (tmp_str == NULL) {

+        DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");

+        return ENOMEM;

+    }

+    ret = ldb_msg_add_string(msg, CONFDB_CERTMAP_MAPRULE, tmp_str);

+    if (ret != LDB_SUCCESS) {

+        talloc_free(discard_const(tmp_str));

+        DEBUG(SSSDBG_OP_FAILURE, "ldb_msg_add_string failed.\n");

+        return EIO;

+    }

+

+    DEBUG(SSSDBG_TRACE_ALL, "Using [%s] as mapping rule for [%s].\n",

+                            tmp_str, ldb_dn_get_linearized(msg->dn));

+

+    return EOK;

+}

+

+static errno_t confdb_get_all_certmaps(TALLOC_CTX *mem_ctx,

+                                       struct confdb_ctx *cdb,

+                                       struct sss_domain_info *dom,

+                                       struct certmap_info ***_certmap_list)

+{

+    TALLOC_CTX *tmp_ctx = NULL;

+    struct ldb_dn *dn = NULL;

+    struct ldb_result *res = NULL;

+    /* The attributte order is important, because it is used in

+     * sysdb_ldb_msg_attr_to_certmap_info and must match

+     * enum certmap_info_member. */

+    static const char *attrs[] = { CONFDB_CERTMAP_NAME,

+                                   CONFDB_CERTMAP_MAPRULE,

+                                   CONFDB_CERTMAP_MATCHRULE,

+                                   CONFDB_CERTMAP_PRIORITY,

+                                   CONFDB_CERTMAP_DOMAINS,

+                                   NULL};

+    struct certmap_info **certmap_list = NULL;

+    size_t c;

+    int ret;

+

+    tmp_ctx = talloc_new(NULL);

+    if (tmp_ctx == NULL) {

+        return ENOMEM;

+    }

+

+    dn = ldb_dn_new_fmt(tmp_ctx, cdb->ldb, "cn=%s,%s", dom->name,

+                                                       CONFDB_CERTMAP_BASEDN);

+    if (dn == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    ret = ldb_search(cdb->ldb, tmp_ctx, &res, dn, LDB_SCOPE_ONELEVEL,

+                     attrs, NULL);

+    if (ret != LDB_SUCCESS) {

+        ret = EIO;

+        goto done;

+    }

+

+    certmap_list = talloc_zero_array(tmp_ctx, struct certmap_info *,

+                                     res->count + 1);

+    if (certmap_list == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    for (c = 0; c < res->count; c++) {

+        if (is_files_provider(dom)) {

+            ret = certmap_local_check(res->msgs[c]);

+            if (ret != EOK) {

+                DEBUG(SSSDBG_CONF_SETTINGS,

+                      "Invalid certificate mapping [%s] for local user, "

+                      "ignored.\n", ldb_dn_get_linearized(res->msgs[c]->dn));

+                continue;

+            }

+        }

+        ret = sysdb_ldb_msg_attr_to_certmap_info(certmap_list, res->msgs[c],

+                                                 attrs, &certmap_list[c]);

+        if (ret != EOK) {

+            DEBUG(SSSDBG_OP_FAILURE,

+                  "sysdb_ldb_msg_attr_to_certmap_info failed.\n");

+            goto done;

+        }

+    }

+

+    *_certmap_list = talloc_steal(mem_ctx, certmap_list);

+

+    ret = EOK;

+

+done:

+    talloc_free(tmp_ctx);

+    return ret;

+}

+

+int confdb_certmap_to_sysdb(struct confdb_ctx *cdb,

+                            struct sss_domain_info *dom)

+{

+    int ret;

+    TALLOC_CTX *tmp_ctx;

+    struct certmap_info **certmap_list;

+

+    tmp_ctx = talloc_new(NULL);

+    if (tmp_ctx == NULL) {

+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");

+        return ENOMEM;

+    }

+

+    ret = confdb_get_all_certmaps(tmp_ctx, cdb, dom, &certmap_list);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE, "confdb_get_all_certmaps failed.\n");

+        goto done;

+    }

+

+    ret = sysdb_update_certmap(dom->sysdb, certmap_list, false /* TODO */);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_certmap failed.\n");

+        goto done;

+    }

+

+    ret = EOK;

+

+done:

+    talloc_free(tmp_ctx);

+

+    return ret;

+}

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h

index d3e71be86..b0d52ba49 100644

--- a/src/confdb/confdb.h

+++ b/src/confdb/confdb.h

@@ -267,6 +267,14 @@

 #define CONFDB_KCM_SOCKET "socket_path"

 #define CONFDB_KCM_DB "ccache_storage" /* Undocumented on purpose */

+/* Certificate mapping rules */

+#define CONFDB_CERTMAP_BASEDN "cn=certmap,cn=config"

+#define CONFDB_CERTMAP_NAME "cn"

+#define CONFDB_CERTMAP_MAPRULE "maprule"

+#define CONFDB_CERTMAP_MATCHRULE "matchrule"

+#define CONFDB_CERTMAP_DOMAINS "domains"

+#define CONFDB_CERTMAP_PRIORITY "priority"

+

 /* Prompting */

 #define CONFDB_PC_CONF_ENTRY "config/prompting"

 #define CONFDB_PC_TYPE_PASSWORD "password"

@@ -681,6 +689,21 @@ int confdb_get_sub_sections(TALLOC_CTX *mem_ctx,

                             const char *section,

                             char ***sections,

                             int *num_sections);

+

+/**

+ * @brief Convenience function to write the certificate mapping and matching

+ * rules from the configuration database to the cache of a domain

+ *

+ * @param[in] cdb The connection object to the confdb

+ * @param[in] dom Target domain where to rules should be written to

+ *

+ * @return 0 - Successfully retrieved the entry (or used the default)

+ * @return ENOMEM - There was insufficient memory to complete the operation

+ * @return EINVAL - Typically internal processing error

+ */

+int confdb_certmap_to_sysdb(struct confdb_ctx *cdb,

+                            struct sss_domain_info *dom);

+

 /**

  * @}

  */

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini

index 997ba5aec..79e366875 100644

--- a/src/config/cfg_rules.ini

+++ b/src/config/cfg_rules.ini

@@ -17,6 +17,7 @@ section_re = ^secrets/kcm$

 section_re = ^domain/[^/\@]\+$

 section_re = ^domain/[^/\@]\+/[^/\@]\+$

 section_re = ^application/[^/\@]\+$

+section_re = ^certmap/[^/\@]\+/[^/\@]\+$

 [rule/allowed_sssd_options]

@@ -765,3 +766,12 @@ option = use_fully_qualified_names

 [rule/sssd_checks]

 validator = sssd_checks

+

+[rule/allowed_certmap_options]

+validator = ini_allowed_options

+section_re = ^certmap/[^/\@]\+/[^/\@]\+$

+

+option = matchrule

+option = maprule

+option = priority

+option = domains

diff --git a/src/db/sysdb.h b/src/db/sysdb.h

index 018ec22ab..a2bc8ed3b 100644

--- a/src/db/sysdb.h

+++ b/src/db/sysdb.h

@@ -737,6 +737,11 @@ errno_t sysdb_update_certmap(struct sysdb_ctx *sysdb,

                              struct certmap_info **certmaps,

                              bool user_name_hint);

+errno_t sysdb_ldb_msg_attr_to_certmap_info(TALLOC_CTX *mem_ctx,

+                                           struct ldb_message *msg,

+                                           const char **attr_map,

+                                           struct certmap_info **certmap);

+

 errno_t sysdb_get_certmap(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,

                           struct certmap_info ***certmaps,

                           bool *user_name_hint);

diff --git a/src/db/sysdb_certmap.c b/src/db/sysdb_certmap.c

index eda20f5a7..4cc5b5b41 100644

--- a/src/db/sysdb_certmap.c

+++ b/src/db/sysdb_certmap.c

@@ -22,6 +22,7 @@

 #include "util/util.h"

 #include "db/sysdb_private.h"

+#include "lib/certmap/sss_certmap.h"

 static errno_t sysdb_create_certmap_container(struct sysdb_ctx *sysdb,

                                               bool user_name_hint)

@@ -153,7 +154,7 @@ static errno_t sysdb_certmap_add(struct sysdb_ctx *sysdb,

         }

     }

-    if (certmap->domains != NULL) {

+    if (certmap->domains != NULL && certmap->domains[0] != NULL) {

         for (c = 0; certmap->domains[c] != NULL; c++);

         el = talloc_zero(tmp_ctx, struct ldb_message_element);

         if (el == NULL) {

@@ -285,28 +286,151 @@ done:

     return ret;

 }

+enum certmap_info_member {

+    SSS_CMIM_NAME = 0,

+    SSS_CMIM_MAPPING_RULE,

+    SSS_CMIM_MATCHING_RULE,

+    SSS_CMIM_PRIORITY,

+    SSS_CMIM_DOMAINS,

+

+    SSS_CMIM_SENTINEL

+};

+

+errno_t sysdb_ldb_msg_attr_to_certmap_info(TALLOC_CTX *mem_ctx,

+                                           struct ldb_message *msg,

+                                           const char **attr_map,

+                                           struct certmap_info **certmap)

+{

+    int ret;

+    size_t d;

+    size_t num_values;

+    struct certmap_info *map = NULL;

+    const char *tmp_str;

+    uint64_t tmp_uint;

+    struct ldb_message_element *tmp_el;

+

+    if (msg == NULL || attr_map == NULL || certmap == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Invalid input.\n");

+        return EINVAL;

+    }

+

+    for (d = 0; d < SSS_CMIM_SENTINEL; d++) {

+        if (attr_map[d] == NULL) {

+            DEBUG(SSSDBG_CRIT_FAILURE, "Invalid attribute map");

+            return EINVAL;

+        }

+    }

+

+    map = talloc_zero(mem_ctx, struct certmap_info);

+    if (map == NULL) {

+        return ENOMEM;

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, attr_map[SSS_CMIM_NAME], NULL);

+    if (tmp_str == NULL) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "The object [%s] doesn't have a name.\n",

+                                    ldb_dn_get_linearized(msg->dn));

+        ret = EINVAL;

+        goto done;

+    }

+

+    map->name = talloc_strdup(map, tmp_str);

+    if (map->name == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, attr_map[SSS_CMIM_MAPPING_RULE],

+                                          NULL);

+    if (tmp_str != NULL) {

+        map->map_rule = talloc_strdup(map, tmp_str);

+        if (map->map_rule == NULL) {

+            DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");

+            ret = ENOMEM;

+            goto done;

+        }

+    }

+

+    tmp_str = ldb_msg_find_attr_as_string(msg, attr_map[SSS_CMIM_MATCHING_RULE],

+                                          NULL);

+    if (tmp_str != NULL) {

+        map->match_rule = talloc_strdup(map, tmp_str);

+        if (map->match_rule == NULL) {

+            DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");

+            ret = ENOMEM;

+            goto done;

+        }

+    }

+

+    tmp_uint = ldb_msg_find_attr_as_uint64(msg, attr_map[SSS_CMIM_PRIORITY],

+                                           (uint64_t) -1);

+    if (tmp_uint != (uint64_t) -1) {

+        if (tmp_uint > UINT32_MAX) {

+            DEBUG(SSSDBG_OP_FAILURE, "Priority value [%lu] too large.\n",

+                                     (unsigned long) tmp_uint);

+            ret = EINVAL;

+            goto done;

+        }

+

+        map->priority = (uint32_t) tmp_uint;

+    } else {

+        map->priority = SSS_CERTMAP_MIN_PRIO;

+    }

+

+    tmp_el = ldb_msg_find_element(msg, attr_map[SSS_CMIM_DOMAINS]);

+    if (tmp_el != NULL) {