|
 |
8d3578 |
From 9b875b87fda7dab1c92022b5c2e3b11cd5fffa4f Mon Sep 17 00:00:00 2001
|
|
|
8d3578 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
8d3578 |
Date: Fri, 27 Sep 2019 13:45:13 +0200
|
|
|
8d3578 |
Subject: [PATCH 109/109] ad: set min and max ssf for ldaps
|
|
|
8d3578 |
MIME-Version: 1.0
|
|
|
8d3578 |
Content-Type: text/plain; charset=UTF-8
|
|
|
8d3578 |
Content-Transfer-Encoding: 8bit
|
|
|
8d3578 |
|
|
|
8d3578 |
AD does not allow to use encryption in the TLS and SASL layer at the
|
|
|
8d3578 |
same time. To be able to use ldaps this patch sets min and max ssf to 0
|
|
|
8d3578 |
if ldaps should be used.
|
|
|
8d3578 |
|
|
|
8d3578 |
Related to https://pagure.io/SSSD/sssd/issue/4131
|
|
|
8d3578 |
|
|
|
8d3578 |
(cherry picked from commit 50a92f65c4823d272240ef416f2b05874b2b7918)
|
|
|
8d3578 |
|
|
|
8d3578 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
8d3578 |
---
|
|
|
8d3578 |
src/providers/ad/ad_common.c | 21 +++++++++++++++++++++
|
|
|
8d3578 |
src/providers/ad/ad_common.h | 2 ++
|
|
|
8d3578 |
src/providers/ad/ad_subdomains.c | 4 ++++
|
|
|
8d3578 |
3 files changed, 27 insertions(+)
|
|
|
8d3578 |
|
|
|
8d3578 |
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
|
|
|
8d3578 |
index de8a0c8bb..4e46da7f2 100644
|
|
|
8d3578 |
--- a/src/providers/ad/ad_common.c
|
|
|
8d3578 |
+++ b/src/providers/ad/ad_common.c
|
|
|
8d3578 |
@@ -1008,6 +1008,23 @@ done:
|
|
|
8d3578 |
return;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
+void ad_set_ssf_for_ldaps(struct sdap_options *id_opts)
|
|
|
8d3578 |
+{
|
|
|
8d3578 |
+ int ret;
|
|
|
8d3578 |
+
|
|
|
8d3578 |
+ DEBUG(SSSDBG_TRACE_ALL, "Setting ssf for ldaps usage.\n");
|
|
|
8d3578 |
+ ret = dp_opt_set_int(id_opts->basic, SDAP_SASL_MINSSF, 0);
|
|
|
8d3578 |
+ if (ret != EOK) {
|
|
|
8d3578 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
8d3578 |
+ "Failed to set SASL minssf for ldaps usage, ignored.\n");
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
+ ret = dp_opt_set_int(id_opts->basic, SDAP_SASL_MAXSSF, 0);
|
|
|
8d3578 |
+ if (ret != EOK) {
|
|
|
8d3578 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
8d3578 |
+ "Failed to set SASL maxssf for ldaps usage, ignored.\n");
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
+}
|
|
|
8d3578 |
+
|
|
|
8d3578 |
static errno_t
|
|
|
8d3578 |
ad_set_sdap_options(struct ad_options *ad_opts,
|
|
|
8d3578 |
struct sdap_options *id_opts)
|
|
|
8d3578 |
@@ -1066,6 +1083,10 @@ ad_set_sdap_options(struct ad_options *ad_opts,
|
|
|
8d3578 |
goto done;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
+ if (dp_opt_get_bool(ad_opts->basic, AD_USE_LDAPS)) {
|
|
|
8d3578 |
+ ad_set_ssf_for_ldaps(id_opts);
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
+
|
|
|
8d3578 |
/* Warn if the user is doing something silly like overriding the schema
|
|
|
8d3578 |
* with the AD provider
|
|
|
8d3578 |
*/
|
|
|
8d3578 |
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
|
|
|
8d3578 |
index 54245b9f8..753394832 100644
|
|
|
8d3578 |
--- a/src/providers/ad/ad_common.h
|
|
|
8d3578 |
+++ b/src/providers/ad/ad_common.h
|
|
|
8d3578 |
@@ -177,6 +177,8 @@ errno_t
|
|
|
8d3578 |
ad_get_dyndns_options(struct be_ctx *be_ctx,
|
|
|
8d3578 |
struct ad_options *ad_opts);
|
|
|
8d3578 |
|
|
|
8d3578 |
+void ad_set_ssf_for_ldaps(struct sdap_options *id_opts);
|
|
|
8d3578 |
+
|
|
|
8d3578 |
struct ad_id_ctx *
|
|
|
8d3578 |
ad_id_ctx_init(struct ad_options *ad_opts, struct be_ctx *bectx);
|
|
|
8d3578 |
|
|
|
8d3578 |
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
|
|
|
8d3578 |
index bc10da5bc..f94936102 100644
|
|
|
8d3578 |
--- a/src/providers/ad/ad_subdomains.c
|
|
|
8d3578 |
+++ b/src/providers/ad/ad_subdomains.c
|
|
|
8d3578 |
@@ -328,6 +328,10 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
|
|
|
8d3578 |
return ret;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
+ if (dp_opt_get_bool(ad_options->basic, AD_USE_LDAPS)) {
|
|
|
8d3578 |
+ ad_set_ssf_for_ldaps(ad_options->id);
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
+
|
|
|
8d3578 |
ret = ad_inherit_opts_if_needed(id_ctx->sdap_id_ctx->opts->basic,
|
|
|
8d3578 |
ad_options->id->basic,
|
|
|
8d3578 |
be_ctx->cdb, subdom_conf_path,
|
|
|
8d3578 |
--
|
|
|
8d3578 |
2.20.1
|
|
|
8d3578 |
|