sss_certmap
 All Functions Typedefs Groups
Macros | Typedefs | Functions
Allow rule-based mapping of certificates to users

Macros

#define SSS_CERTMAP_MIN_PRIO   UINT32_MAX
 

Typedefs

typedef void( sss_certmap_ext_debug )(void *pvt, const char *file, long line, const char *function, const char *format,...)
 

Functions

int sss_certmap_init (TALLOC_CTX *mem_ctx, sss_certmap_ext_debug *debug, void *debug_priv, struct sss_certmap_ctx **ctx)
 Initialize certmap context. More...
 
void sss_certmap_free_ctx (struct sss_certmap_ctx *ctx)
 Free certmap context. More...
 
int sss_certmap_add_rule (struct sss_certmap_ctx *ctx, uint32_t priority, const char *match_rule, const char *map_rule, const char **domains)
 Add a rule to the certmap context. More...
 
int sss_certmap_match_cert (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size)
 Check if a certificate matches any of the applied rules. More...
 
int sss_certmap_get_search_filter (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size, char **filter, char ***domains)
 Get the LDAP filter string for a certificate. More...
 
void sss_certmap_free_filter_and_domains (char *filter, char **domains)
 Free data returned by sss_certmap_get_search_filter. More...
 

Detailed Description

Libsss_certmap provides a mechanism to map X509 certificate to users based on rules.

Macro Definition Documentation

#define SSS_CERTMAP_MIN_PRIO   UINT32_MAX

Lowest priority of a rule

Typedef Documentation

typedef void( sss_certmap_ext_debug)(void *pvt, const char *file, long line, const char *function, const char *format,...)

Typedef for external debug callback

Function Documentation

int sss_certmap_add_rule ( struct sss_certmap_ctx *  ctx,
uint32_t  priority,
const char *  match_rule,
const char *  map_rule,
const char **  domains 
)

Add a rule to the certmap context.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]prioritypriority of the rule, 0 is the hightest priority, the lowest is SSS_CERTMAP_MIN_PRIO
[in]match_ruleString with the matching rule
[in]map_ruleString with the mapping rule
[in]domainsNULL-terminated string array with a list of domains the rule should be valid for, i.e. only this domains should be searched for matching users
Returns
  • 0: success
void sss_certmap_free_ctx ( struct sss_certmap_ctx *  ctx)

Free certmap context.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init, may be NULL
void sss_certmap_free_filter_and_domains ( char *  filter,
char **  domains 
)

Free data returned by sss_certmap_get_search_filter.

Parameters
[in]filterLDAP filter strings returned by sss_certmap_get_search_filter
[in]domainsstring array of domains returned by sss_certmap_get_search_filter
int sss_certmap_get_search_filter ( struct sss_certmap_ctx *  ctx,
const uint8_t *  der_cert,
size_t  der_size,
char **  filter,
char ***  domains 
)

Get the LDAP filter string for a certificate.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]der_certbinary blog with the DER encoded certificate
[in]der_sizesize of the certificate blob
[out]filterLDAP filter string, caller should free the data by calling sss_certmap_free_filter_and_domains
[out]domainsNULL-terminated array of strings with the domains the rule applies, caller should free the data by calling sss_certmap_free_filter_and_domains
Returns
  • 0: certificate matches a rule
  • ENOENT: certificate does not match
  • EINVAL: internal error
int sss_certmap_init ( TALLOC_CTX *  mem_ctx,
sss_certmap_ext_debug debug,
void *  debug_priv,
struct sss_certmap_ctx **  ctx 
)

Initialize certmap context.

Parameters
[in]mem_ctxTalloc memory context, may be NULL
[in]debugCallback to handle debug output, may be NULL
[in]debug_privPrivate data for debugging callback, may be NULL
[out]ctxNew certmap context
Returns
  • 0: success
  • ENOMEM: failed to allocate internal Talloc context
  • EINVAL: ctx is NULL
int sss_certmap_match_cert ( struct sss_certmap_ctx *  ctx,
const uint8_t *  der_cert,
size_t  der_size 
)

Check if a certificate matches any of the applied rules.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]der_certbinary blog with the DER encoded certificate
[in]der_sizesize of the certificate blob
Returns
  • 0: certificate matches a rule
  • ENOENT: certificate does not match
  • EINVAL: internal error