29 #include <ldb_errors.h>
41 #define CONFDB_DEFAULT_CFG_FILE_VER 2
42 #define CONFDB_FILE "config.ldb"
43 #define SSSD_CONFIG_FILE SSSD_CONF_DIR"/sssd.conf"
44 #define CONFDB_DEFAULT_CONFIG_DIR SSSD_CONF_DIR"/conf.d"
46 #define SSSD_LOCAL_MINID 1000
47 #define CONFDB_DEFAULT_SHELL_FALLBACK "/bin/sh"
53 #define CONFDB_SERVICE_PATH_TMPL "config/%s"
54 #define CONFDB_SERVICE_COMMAND "command"
55 #define CONFDB_SERVICE_DEBUG_LEVEL "debug_level"
56 #define CONFDB_SERVICE_DEBUG_LEVEL_ALIAS "debug"
57 #define CONFDB_SERVICE_DEBUG_TIMESTAMPS "debug_timestamps"
58 #define CONFDB_SERVICE_DEBUG_MICROSECONDS "debug_microseconds"
59 #define CONFDB_SERVICE_DEBUG_TO_FILES "debug_to_files"
60 #define CONFDB_SERVICE_RECON_RETRIES "reconnection_retries"
61 #define CONFDB_SERVICE_FD_LIMIT "fd_limit"
62 #define CONFDB_SERVICE_ALLOWED_UIDS "allowed_uids"
65 #define CONFDB_MONITOR_CONF_ENTRY "config/sssd"
66 #define CONFDB_MONITOR_SBUS_TIMEOUT "sbus_timeout"
67 #define CONFDB_MONITOR_ACTIVE_SERVICES "services"
68 #define CONFDB_MONITOR_ACTIVE_DOMAINS "domains"
69 #define CONFDB_MONITOR_TRY_INOTIFY "try_inotify"
70 #define CONFDB_MONITOR_KRB5_RCACHEDIR "krb5_rcache_dir"
71 #define CONFDB_MONITOR_DEFAULT_DOMAIN "default_domain_suffix"
72 #define CONFDB_MONITOR_OVERRIDE_SPACE "override_space"
73 #define CONFDB_MONITOR_USER_RUNAS "user"
74 #define CONFDB_MONITOR_CERT_VERIFICATION "certificate_verification"
75 #define CONFDB_MONITOR_DISABLE_NETLINK "disable_netlink"
76 #define CONFDB_MONITOR_ENABLE_FILES_DOM "enable_files_domain"
77 #define CONFDB_MONITOR_DOMAIN_RESOLUTION_ORDER "domain_resolution_order"
80 #define CONFDB_NAME_REGEX "re_expression"
81 #define CONFDB_FULL_NAME_FORMAT "full_name_format"
82 #define CONFDB_DEFAULT_FULL_NAME_FORMAT_INTERNAL "%1$s@%2$s%3$s"
83 #define CONFDB_DEFAULT_FULL_NAME_FORMAT "%1$s@%2$s"
86 #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout"
87 #define CONFDB_RESPONDER_CLI_IDLE_TIMEOUT "client_idle_timeout"
88 #define CONFDB_RESPONDER_CLI_IDLE_DEFAULT_TIMEOUT 60
89 #define CONFDB_RESPONDER_LOCAL_NEG_TIMEOUT "local_negative_timeout"
90 #define CONFDB_RESPONDER_LOCAL_NEG_TIMEOUT_DEFAULT 14400
91 #define CONFDB_RESPONDER_IDLE_TIMEOUT "responder_idle_timeout"
92 #define CONFDB_RESPONDER_IDLE_DEFAULT_TIMEOUT 300
93 #define CONFDB_RESPONDER_CACHE_FIRST "cache_first"
96 #define CONFDB_NSS_CONF_ENTRY "config/nss"
97 #define CONFDB_NSS_ENUM_CACHE_TIMEOUT "enum_cache_timeout"
98 #define CONFDB_NSS_ENTRY_CACHE_NOWAIT_PERCENTAGE "entry_cache_nowait_percentage"
99 #define CONFDB_NSS_ENTRY_NEG_TIMEOUT "entry_negative_timeout"
100 #define CONFDB_NSS_FILTER_USERS_IN_GROUPS "filter_users_in_groups"
101 #define CONFDB_NSS_FILTER_USERS "filter_users"
102 #define CONFDB_NSS_FILTER_GROUPS "filter_groups"
103 #define CONFDB_NSS_PWFIELD "pwfield"
104 #define CONFDB_NSS_OVERRIDE_HOMEDIR "override_homedir"
105 #define CONFDB_NSS_FALLBACK_HOMEDIR "fallback_homedir"
106 #define CONFDB_NSS_OVERRIDE_SHELL "override_shell"
107 #define CONFDB_NSS_VETOED_SHELL "vetoed_shells"
108 #define CONFDB_NSS_ALLOWED_SHELL "allowed_shells"
109 #define CONFDB_NSS_SHELL_FALLBACK "shell_fallback"
110 #define CONFDB_NSS_DEFAULT_SHELL "default_shell"
111 #define CONFDB_MEMCACHE_TIMEOUT "memcache_timeout"
112 #define CONFDB_NSS_HOMEDIR_SUBSTRING "homedir_substring"
113 #define CONFDB_DEFAULT_HOMEDIR_SUBSTRING "/home"
116 #define CONFDB_PAM_CONF_ENTRY "config/pam"
117 #define CONFDB_PAM_CRED_TIMEOUT "offline_credentials_expiration"
118 #define CONFDB_PAM_FAILED_LOGIN_ATTEMPTS "offline_failed_login_attempts"
119 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_ATTEMPTS 0
120 #define CONFDB_PAM_FAILED_LOGIN_DELAY "offline_failed_login_delay"
121 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_DELAY 5
122 #define CONFDB_PAM_VERBOSITY "pam_verbosity"
123 #define CONFDB_PAM_RESPONSE_FILTER "pam_response_filter"
124 #define CONFDB_PAM_ID_TIMEOUT "pam_id_timeout"
125 #define CONFDB_PAM_PWD_EXPIRATION_WARNING "pam_pwd_expiration_warning"
126 #define CONFDB_PAM_TRUSTED_USERS "pam_trusted_users"
127 #define CONFDB_PAM_PUBLIC_DOMAINS "pam_public_domains"
128 #define CONFDB_PAM_ACCOUNT_EXPIRED_MESSAGE "pam_account_expired_message"
129 #define CONFDB_PAM_ACCOUNT_LOCKED_MESSAGE "pam_account_locked_message"
130 #define CONFDB_PAM_CERT_AUTH "pam_cert_auth"
131 #define CONFDB_PAM_CERT_DB_PATH "pam_cert_db_path"
132 #define CONFDB_PAM_P11_CHILD_TIMEOUT "p11_child_timeout"
133 #define CONFDB_PAM_WAIT_FOR_CARD_TIMEOUT "p11_wait_for_card_timeout"
134 #define CONFDB_PAM_APP_SERVICES "pam_app_services"
135 #define CONFDB_PAM_P11_ALLOWED_SERVICES "pam_p11_allowed_services"
136 #define CONFDB_PAM_P11_URI "p11_uri"
139 #define CONFDB_SUDO_CONF_ENTRY "config/sudo"
140 #define CONFDB_SUDO_CACHE_TIMEOUT "sudo_cache_timeout"
141 #define CONFDB_DEFAULT_SUDO_CACHE_TIMEOUT 180
142 #define CONFDB_SUDO_TIMED "sudo_timed"
143 #define CONFDB_DEFAULT_SUDO_TIMED false
144 #define CONFDB_SUDO_INVERSE_ORDER "sudo_inverse_order"
145 #define CONFDB_DEFAULT_SUDO_INVERSE_ORDER false
146 #define CONFDB_SUDO_THRESHOLD "sudo_threshold"
147 #define CONFDB_DEFAULT_SUDO_THRESHOLD 50
150 #define CONFDB_AUTOFS_CONF_ENTRY "config/autofs"
151 #define CONFDB_AUTOFS_MAP_NEG_TIMEOUT "autofs_negative_timeout"
154 #define CONFDB_SSH_CONF_ENTRY "config/ssh"
155 #define CONFDB_SSH_HASH_KNOWN_HOSTS "ssh_hash_known_hosts"
156 #define CONFDB_DEFAULT_SSH_HASH_KNOWN_HOSTS true
157 #define CONFDB_SSH_KNOWN_HOSTS_TIMEOUT "ssh_known_hosts_timeout"
158 #define CONFDB_DEFAULT_SSH_KNOWN_HOSTS_TIMEOUT 180
159 #define CONFDB_SSH_CA_DB "ca_db"
161 #define CONFDB_DEFAULT_SSH_CA_DB SYSCONFDIR"/pki/nssdb"
163 #define CONFDB_DEFAULT_SSH_CA_DB SYSCONFDIR"/sssd/pki/sssd_auth_ca_db.pem"
165 #define CONFDB_SSH_USE_CERT_KEYS "ssh_use_certificate_keys"
166 #define CONFDB_DEFAULT_SSH_USE_CERT_KEYS true
169 #define CONFDB_PAC_CONF_ENTRY "config/pac"
170 #define CONFDB_PAC_LIFETIME "pac_lifetime"
173 #define CONFDB_IFP_CONF_ENTRY "config/ifp"
174 #define CONFDB_IFP_USER_ATTR_LIST "user_attributes"
175 #define CONFDB_IFP_WILDCARD_LIMIT "wildcard_limit"
178 #define CONFDB_SESSION_RECORDING_CONF_ENTRY "config/session_recording"
179 #define CONFDB_SESSION_RECORDING_SCOPE "scope"
180 #define CONFDB_SESSION_RECORDING_USERS "users"
181 #define CONFDB_SESSION_RECORDING_GROUPS "groups"
184 #define CONFDB_DOMAIN_PATH_TMPL "config/domain/%s"
185 #define CONFDB_DOMAIN_BASEDN "cn=domain,cn=config"
186 #define CONFDB_APP_DOMAIN_BASEDN "cn=application,cn=config"
187 #define CONFDB_DOMAIN_ID_PROVIDER "id_provider"
188 #define CONFDB_DOMAIN_AUTH_PROVIDER "auth_provider"
189 #define CONFDB_DOMAIN_ACCESS_PROVIDER "access_provider"
190 #define CONFDB_DOMAIN_CHPASS_PROVIDER "chpass_provider"
191 #define CONFDB_DOMAIN_SUDO_PROVIDER "sudo_provider"
192 #define CONFDB_DOMAIN_AUTOFS_PROVIDER "autofs_provider"
193 #define CONFDB_DOMAIN_SELINUX_PROVIDER "selinux_provider"
194 #define CONFDB_DOMAIN_HOSTID_PROVIDER "hostid_provider"
195 #define CONFDB_DOMAIN_SUBDOMAINS_PROVIDER "subdomains_provider"
196 #define CONFDB_DOMAIN_SESSION_PROVIDER "session_provider"
197 #define CONFDB_DOMAIN_COMMAND "command"
198 #define CONFDB_DOMAIN_TIMEOUT "timeout"
199 #define CONFDB_DOMAIN_ATTR "cn"
200 #define CONFDB_DOMAIN_ENUMERATE "enumerate"
201 #define CONFDB_SUBDOMAIN_ENUMERATE "subdomain_enumerate"
202 #define CONFDB_DEFAULT_SUBDOMAIN_ENUMERATE "none"
203 #define CONFDB_DOMAIN_MINID "min_id"
204 #define CONFDB_DOMAIN_MAXID "max_id"
205 #define CONFDB_DOMAIN_CACHE_CREDS "cache_credentials"
206 #define CONFDB_DOMAIN_CACHE_CREDS_MIN_FF_LENGTH \
207 "cache_credentials_minimal_first_factor_length"
208 #define CONFDB_DEFAULT_CACHE_CREDS_MIN_FF_LENGTH 8
209 #define CONFDB_DOMAIN_AUTO_UPG "auto_private_groups"
210 #define CONFDB_DOMAIN_FQ "use_fully_qualified_names"
211 #define CONFDB_DOMAIN_ENTRY_CACHE_TIMEOUT "entry_cache_timeout"
212 #define CONFDB_DOMAIN_ACCOUNT_CACHE_EXPIRATION "account_cache_expiration"
213 #define CONFDB_DOMAIN_OVERRIDE_GID "override_gid"
214 #define CONFDB_DOMAIN_CASE_SENSITIVE "case_sensitive"
215 #define CONFDB_DOMAIN_SUBDOMAIN_HOMEDIR "subdomain_homedir"
216 #define CONFDB_DOMAIN_DEFAULT_SUBDOMAIN_HOMEDIR "/home/%d/%u"
217 #define CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS "ignore_group_members"
218 #define CONFDB_DOMAIN_SUBDOMAIN_REFRESH "subdomain_refresh_interval"
219 #define CONFDB_DOMAIN_SUBDOMAIN_REFRESH_DEFAULT_VALUE 14400
221 #define CONFDB_DOMAIN_USER_CACHE_TIMEOUT "entry_cache_user_timeout"
222 #define CONFDB_DOMAIN_GROUP_CACHE_TIMEOUT "entry_cache_group_timeout"
223 #define CONFDB_DOMAIN_NETGROUP_CACHE_TIMEOUT "entry_cache_netgroup_timeout"
224 #define CONFDB_DOMAIN_SERVICE_CACHE_TIMEOUT "entry_cache_service_timeout"
225 #define CONFDB_DOMAIN_AUTOFS_CACHE_TIMEOUT "entry_cache_autofs_timeout"
226 #define CONFDB_DOMAIN_SUDO_CACHE_TIMEOUT "entry_cache_sudo_timeout"
227 #define CONFDB_DOMAIN_SSH_HOST_CACHE_TIMEOUT "entry_cache_ssh_host_timeout"
228 #define CONFDB_DOMAIN_PWD_EXPIRATION_WARNING "pwd_expiration_warning"
229 #define CONFDB_DOMAIN_REFRESH_EXPIRED_INTERVAL "refresh_expired_interval"
230 #define CONFDB_DOMAIN_OFFLINE_TIMEOUT "offline_timeout"
231 #define CONFDB_DOMAIN_SUBDOMAIN_INHERIT "subdomain_inherit"
232 #define CONFDB_DOMAIN_CACHED_AUTH_TIMEOUT "cached_auth_timeout"
233 #define CONFDB_DOMAIN_TYPE "domain_type"
234 #define CONFDB_DOMAIN_TYPE_POSIX "posix"
235 #define CONFDB_DOMAIN_TYPE_APP "application"
236 #define CONFDB_DOMAIN_INHERIT_FROM "inherit_from"
239 #define CONFDB_LOCAL_DEFAULT_SHELL "default_shell"
240 #define CONFDB_LOCAL_DEFAULT_BASEDIR "base_directory"
241 #define CONFDB_LOCAL_CREATE_HOMEDIR "create_homedir"
242 #define CONFDB_LOCAL_REMOVE_HOMEDIR "remove_homedir"
243 #define CONFDB_LOCAL_UMASK "homedir_umask"
244 #define CONFDB_LOCAL_SKEL_DIR "skel_dir"
245 #define CONFDB_LOCAL_MAIL_DIR "mail_dir"
246 #define CONFDB_LOCAL_USERDEL_CMD "userdel_cmd"
249 #define CONFDB_PROXY_LIBNAME "proxy_lib_name"
250 #define CONFDB_PROXY_PAM_TARGET "proxy_pam_target"
251 #define CONFDB_PROXY_FAST_ALIAS "proxy_fast_alias"
252 #define CONFDB_PROXY_MAX_CHILDREN "proxy_max_children"
255 #define CONFDB_FILES_PASSWD "passwd_files"
256 #define CONFDB_FILES_GROUP "group_files"
259 #define CONFDB_SEC_CONF_ENTRY "config/secrets"
260 #define CONFDB_SEC_CONTAINERS_NEST_LEVEL "containers_nest_level"
261 #define CONFDB_SEC_MAX_SECRETS "max_secrets"
262 #define CONFDB_SEC_MAX_UID_SECRETS "max_uid_secrets"
263 #define CONFDB_SEC_MAX_PAYLOAD_SIZE "max_payload_size"
266 #define CONFDB_KCM_CONF_ENTRY "config/kcm"
267 #define CONFDB_KCM_SOCKET "socket_path"
268 #define CONFDB_KCM_DB "ccache_storage"
269 #define CONFDB_KCM_MAX_CCACHES "max_ccaches"
270 #define CONFDB_KCM_MAX_UID_CCACHES "max_uid_ccaches"
271 #define CONFDB_KCM_MAX_CCACHE_SIZE "max_ccache_size"
274 #define CONFDB_CERTMAP_BASEDN "cn=certmap,cn=config"
275 #define CONFDB_CERTMAP_NAME "cn"
276 #define CONFDB_CERTMAP_MAPRULE "maprule"
277 #define CONFDB_CERTMAP_MATCHRULE "matchrule"
278 #define CONFDB_CERTMAP_DOMAINS "domains"
279 #define CONFDB_CERTMAP_PRIORITY "priority"
282 #define CONFDB_PC_CONF_ENTRY "config/prompting"
283 #define CONFDB_PC_TYPE_PASSWORD "password"
284 #define CONFDB_PC_PASSWORD_PROMPT "password_prompt"
285 #define CONFDB_PC_TYPE_2FA "2fa"
286 #define CONFDB_PC_2FA_SINGLE_PROMPT "single_prompt"
287 #define CONFDB_PC_2FA_1ST_PROMPT "first_prompt"
288 #define CONFDB_PC_2FA_2ND_PROMPT "second_prompt"
289 #define CONFDB_PC_TYPE_CERT_AUTH "cert_auth"
292 struct config_file_ctx;
325 enum sss_domain_mpg_mode {
345 enum sss_domain_mpg_mode mpg_mode;
346 bool ignore_group_members;
351 bool cache_credentials;
352 uint32_t cache_credentials_min_ff_length;
357 const char *override_homedir;
358 const char *fallback_homedir;
359 const char *subdomain_homedir;
360 const char *homedir_substr;
361 const char *override_shell;
362 const char *default_shell;
364 uint32_t user_timeout;
365 uint32_t group_timeout;
366 uint32_t netgroup_timeout;
367 uint32_t service_timeout;
368 uint32_t autofsmap_timeout;
369 uint32_t sudo_timeout;
370 uint32_t ssh_host_timeout;
372 uint32_t refresh_expired_interval;
373 uint32_t subdomain_refresh_interval;
374 uint32_t cached_auth_timeout;
376 int pwd_expiration_warning;
378 struct sysdb_ctx *sysdb;
379 struct sss_names_ctx *names;
386 uint32_t trust_direction;
387 struct timeval subdomains_last_checked;
390 const char *view_name;
403 const char **upn_suffixes;
405 struct certmap_info **certmaps;
426 struct confdb_ctx **cdb_ctx,
427 const char *confdb_location);
458 int confdb_expand_app_domains(
struct confdb_ctx *cdb);
473 struct confdb_ctx *cdb,
505 const char *attribute,
506 const char **values);
530 const char *attribute,
556 const char *section,
const char *attribute,
557 const char *defstr,
char **result);
583 const char *section,
const char *attribute,
584 int defval,
int *result);
611 const char *section,
const char *attribute,
612 bool defval,
bool *result);
633 const char *attribute,
663 const char *section,
const char *attribute,
687 struct confdb_ctx *cdb,
sss_domain_state
sssd domain state
Definition: confdb.h:295
int confdb_get_domains(struct confdb_ctx *cdb, struct sss_domain_info **domains)
Get a null-terminated linked-list of active domain objects.
int confdb_init(TALLOC_CTX *mem_ctx, struct confdb_ctx **cdb_ctx, const char *confdb_location)
Initialize the connection to the ConfDB.
int confdb_certmap_to_sysdb(struct confdb_ctx *cdb, struct sss_domain_info *dom)
Convenience function to write the certificate mapping and matching rules from the configuration datab...
int confdb_get_int(struct confdb_ctx *cdb, const char *section, const char *attribute, int defval, int *result)
Convenience function to retrieve a single-valued attribute as an integer.
int confdb_add_param(struct confdb_ctx *cdb, bool replace, const char *section, const char *attribute, const char **values)
Add an arbitrary parameter to the confdb.
int confdb_get_string_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx, const char *section, const char *attribute, char ***result)
Convenience function to retrieve a single-valued attribute as a null-terminated array of strings.
Data structure storing all of the basic features of a domain.
Definition: confdb.h:335
int confdb_get_bool(struct confdb_ctx *cdb, const char *section, const char *attribute, bool defval, bool *result)
Convenience function to retrieve a single-valued attribute as a boolean.
sss_domain_type
Whether the domain only supports looking up POSIX entries.
Definition: confdb.h:316
@ DOM_TYPE_APPLICATION
In this mode, entries are typically resolved only by name.
Definition: confdb.h:322
int confdb_get_sub_sections(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, const char *section, char ***sections, int *num_sections)
Convenience function to retrieve a list of subsections given a configuration section name.
@ DOM_TYPE_POSIX
This is the default domain type.
Definition: confdb.h:320
int confdb_get_domain(struct confdb_ctx *cdb, const char *name, struct sss_domain_info **domain)
Get a domain object for the named domain.
@ DOM_DISABLED
Domain was removed, should not be used be neither responders not providers.
Definition: confdb.h:303
@ DOM_INACTIVE
Domain cannot be contacted.
Definition: confdb.h:308
int confdb_set_string(struct confdb_ctx *cdb, const char *section, const char *attribute, const char *val)
Convenience function to set a single-valued attribute as a string.
int confdb_get_string(struct confdb_ctx *cdb, TALLOC_CTX *ctx, const char *section, const char *attribute, const char *defstr, char **result)
Convenience function to retrieve a single-valued attribute as a string.
@ DOM_ACTIVE
Domain is usable by both responders and providers.
Definition: confdb.h:299
@ DOM_INCONSISTENT
Domain is being updated.
Definition: confdb.h:312
int confdb_get_param(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx, const char *section, const char *attribute, char ***values)
Retrieve all values for an attribute.
int confdb_list_all_domain_names(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, char ***_names)
Get a null-terminated linked-list of all domain names.