29 #include <ldb_errors.h> 41 #define CONFDB_DEFAULT_CFG_FILE_VER 2 42 #define CONFDB_FILE "config.ldb" 43 #define SSSD_CONFIG_FILE SSSD_CONF_DIR"/sssd.conf" 44 #define CONFDB_DEFAULT_CONFIG_DIR SSSD_CONF_DIR"/conf.d" 46 #define SSSD_LOCAL_MINID 1000 47 #define CONFDB_DEFAULT_SHELL_FALLBACK "/bin/sh" 53 #define CONFDB_SERVICE_PATH_TMPL "config/%s" 54 #define CONFDB_SERVICE_COMMAND "command" 55 #define CONFDB_SERVICE_DEBUG_LEVEL "debug_level" 56 #define CONFDB_SERVICE_DEBUG_LEVEL_ALIAS "debug" 57 #define CONFDB_SERVICE_DEBUG_TIMESTAMPS "debug_timestamps" 58 #define CONFDB_SERVICE_DEBUG_MICROSECONDS "debug_microseconds" 59 #define CONFDB_SERVICE_DEBUG_TO_FILES "debug_to_files" 60 #define CONFDB_SERVICE_RECON_RETRIES "reconnection_retries" 61 #define CONFDB_SERVICE_FD_LIMIT "fd_limit" 62 #define CONFDB_SERVICE_ALLOWED_UIDS "allowed_uids" 65 #define CONFDB_MONITOR_CONF_ENTRY "config/sssd" 66 #define CONFDB_MONITOR_SBUS_TIMEOUT "sbus_timeout" 67 #define CONFDB_MONITOR_ACTIVE_SERVICES "services" 68 #define CONFDB_MONITOR_ACTIVE_DOMAINS "domains" 69 #define CONFDB_MONITOR_TRY_INOTIFY "try_inotify" 70 #define CONFDB_MONITOR_KRB5_RCACHEDIR "krb5_rcache_dir" 71 #define CONFDB_MONITOR_DEFAULT_DOMAIN "default_domain_suffix" 72 #define CONFDB_MONITOR_OVERRIDE_SPACE "override_space" 73 #define CONFDB_MONITOR_USER_RUNAS "user" 74 #define CONFDB_MONITOR_CERT_VERIFICATION "certificate_verification" 75 #define CONFDB_MONITOR_DISABLE_NETLINK "disable_netlink" 76 #define CONFDB_MONITOR_ENABLE_FILES_DOM "enable_files_domain" 77 #define CONFDB_MONITOR_DOMAIN_RESOLUTION_ORDER "domain_resolution_order" 80 #define CONFDB_NAME_REGEX "re_expression" 81 #define CONFDB_FULL_NAME_FORMAT "full_name_format" 82 #define CONFDB_DEFAULT_FULL_NAME_FORMAT_INTERNAL "%1$s@%2$s%3$s" 83 #define CONFDB_DEFAULT_FULL_NAME_FORMAT "%1$s@%2$s" 86 #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout" 87 #define CONFDB_RESPONDER_CLI_IDLE_TIMEOUT "client_idle_timeout" 88 #define CONFDB_RESPONDER_CLI_IDLE_DEFAULT_TIMEOUT 60 89 #define CONFDB_RESPONDER_LOCAL_NEG_TIMEOUT "local_negative_timeout" 90 #define CONFDB_RESPONDER_LOCAL_NEG_TIMEOUT_DEFAULT 14400 91 #define CONFDB_RESPONDER_IDLE_TIMEOUT "responder_idle_timeout" 92 #define CONFDB_RESPONDER_IDLE_DEFAULT_TIMEOUT 300 93 #define CONFDB_RESPONDER_CACHE_FIRST "cache_first" 96 #define CONFDB_NSS_CONF_ENTRY "config/nss" 97 #define CONFDB_NSS_ENUM_CACHE_TIMEOUT "enum_cache_timeout" 98 #define CONFDB_NSS_ENTRY_CACHE_NOWAIT_PERCENTAGE "entry_cache_nowait_percentage" 99 #define CONFDB_NSS_ENTRY_NEG_TIMEOUT "entry_negative_timeout" 100 #define CONFDB_NSS_FILTER_USERS_IN_GROUPS "filter_users_in_groups" 101 #define CONFDB_NSS_FILTER_USERS "filter_users" 102 #define CONFDB_NSS_FILTER_GROUPS "filter_groups" 103 #define CONFDB_NSS_PWFIELD "pwfield" 104 #define CONFDB_NSS_OVERRIDE_HOMEDIR "override_homedir" 105 #define CONFDB_NSS_FALLBACK_HOMEDIR "fallback_homedir" 106 #define CONFDB_NSS_OVERRIDE_SHELL "override_shell" 107 #define CONFDB_NSS_VETOED_SHELL "vetoed_shells" 108 #define CONFDB_NSS_ALLOWED_SHELL "allowed_shells" 109 #define CONFDB_NSS_SHELL_FALLBACK "shell_fallback" 110 #define CONFDB_NSS_DEFAULT_SHELL "default_shell" 111 #define CONFDB_MEMCACHE_TIMEOUT "memcache_timeout" 112 #define CONFDB_NSS_HOMEDIR_SUBSTRING "homedir_substring" 113 #define CONFDB_DEFAULT_HOMEDIR_SUBSTRING "/home" 116 #define CONFDB_PAM_CONF_ENTRY "config/pam" 117 #define CONFDB_PAM_CRED_TIMEOUT "offline_credentials_expiration" 118 #define CONFDB_PAM_FAILED_LOGIN_ATTEMPTS "offline_failed_login_attempts" 119 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_ATTEMPTS 0 120 #define CONFDB_PAM_FAILED_LOGIN_DELAY "offline_failed_login_delay" 121 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_DELAY 5 122 #define CONFDB_PAM_VERBOSITY "pam_verbosity" 123 #define CONFDB_PAM_RESPONSE_FILTER "pam_response_filter" 124 #define CONFDB_PAM_ID_TIMEOUT "pam_id_timeout" 125 #define CONFDB_PAM_PWD_EXPIRATION_WARNING "pam_pwd_expiration_warning" 126 #define CONFDB_PAM_TRUSTED_USERS "pam_trusted_users" 127 #define CONFDB_PAM_PUBLIC_DOMAINS "pam_public_domains" 128 #define CONFDB_PAM_ACCOUNT_EXPIRED_MESSAGE "pam_account_expired_message" 129 #define CONFDB_PAM_ACCOUNT_LOCKED_MESSAGE "pam_account_locked_message" 130 #define CONFDB_PAM_CERT_AUTH "pam_cert_auth" 131 #define CONFDB_PAM_CERT_DB_PATH "pam_cert_db_path" 132 #define CONFDB_PAM_P11_CHILD_TIMEOUT "p11_child_timeout" 133 #define CONFDB_PAM_WAIT_FOR_CARD_TIMEOUT "p11_wait_for_card_timeout" 134 #define CONFDB_PAM_APP_SERVICES "pam_app_services" 135 #define CONFDB_PAM_P11_ALLOWED_SERVICES "pam_p11_allowed_services" 136 #define CONFDB_PAM_P11_URI "p11_uri" 139 #define CONFDB_SUDO_CONF_ENTRY "config/sudo" 140 #define CONFDB_SUDO_CACHE_TIMEOUT "sudo_cache_timeout" 141 #define CONFDB_DEFAULT_SUDO_CACHE_TIMEOUT 180 142 #define CONFDB_SUDO_TIMED "sudo_timed" 143 #define CONFDB_DEFAULT_SUDO_TIMED false 144 #define CONFDB_SUDO_INVERSE_ORDER "sudo_inverse_order" 145 #define CONFDB_DEFAULT_SUDO_INVERSE_ORDER false 146 #define CONFDB_SUDO_THRESHOLD "sudo_threshold" 147 #define CONFDB_DEFAULT_SUDO_THRESHOLD 50 150 #define CONFDB_AUTOFS_CONF_ENTRY "config/autofs" 151 #define CONFDB_AUTOFS_MAP_NEG_TIMEOUT "autofs_negative_timeout" 154 #define CONFDB_SSH_CONF_ENTRY "config/ssh" 155 #define CONFDB_SSH_HASH_KNOWN_HOSTS "ssh_hash_known_hosts" 156 #define CONFDB_DEFAULT_SSH_HASH_KNOWN_HOSTS true 157 #define CONFDB_SSH_KNOWN_HOSTS_TIMEOUT "ssh_known_hosts_timeout" 158 #define CONFDB_DEFAULT_SSH_KNOWN_HOSTS_TIMEOUT 180 159 #define CONFDB_SSH_CA_DB "ca_db" 161 #define CONFDB_DEFAULT_SSH_CA_DB SYSCONFDIR"/pki/nssdb" 163 #define CONFDB_DEFAULT_SSH_CA_DB SYSCONFDIR"/sssd/pki/sssd_auth_ca_db.pem" 165 #define CONFDB_SSH_USE_CERT_KEYS "ssh_use_certificate_keys" 166 #define CONFDB_DEFAULT_SSH_USE_CERT_KEYS true 169 #define CONFDB_PAC_CONF_ENTRY "config/pac" 170 #define CONFDB_PAC_LIFETIME "pac_lifetime" 173 #define CONFDB_IFP_CONF_ENTRY "config/ifp" 174 #define CONFDB_IFP_USER_ATTR_LIST "user_attributes" 175 #define CONFDB_IFP_WILDCARD_LIMIT "wildcard_limit" 178 #define CONFDB_SESSION_RECORDING_CONF_ENTRY "config/session_recording" 179 #define CONFDB_SESSION_RECORDING_SCOPE "scope" 180 #define CONFDB_SESSION_RECORDING_USERS "users" 181 #define CONFDB_SESSION_RECORDING_GROUPS "groups" 184 #define CONFDB_DOMAIN_PATH_TMPL "config/domain/%s" 185 #define CONFDB_DOMAIN_BASEDN "cn=domain,cn=config" 186 #define CONFDB_APP_DOMAIN_BASEDN "cn=application,cn=config" 187 #define CONFDB_DOMAIN_ID_PROVIDER "id_provider" 188 #define CONFDB_DOMAIN_AUTH_PROVIDER "auth_provider" 189 #define CONFDB_DOMAIN_ACCESS_PROVIDER "access_provider" 190 #define CONFDB_DOMAIN_CHPASS_PROVIDER "chpass_provider" 191 #define CONFDB_DOMAIN_SUDO_PROVIDER "sudo_provider" 192 #define CONFDB_DOMAIN_AUTOFS_PROVIDER "autofs_provider" 193 #define CONFDB_DOMAIN_SELINUX_PROVIDER "selinux_provider" 194 #define CONFDB_DOMAIN_HOSTID_PROVIDER "hostid_provider" 195 #define CONFDB_DOMAIN_SUBDOMAINS_PROVIDER "subdomains_provider" 196 #define CONFDB_DOMAIN_SESSION_PROVIDER "session_provider" 197 #define CONFDB_DOMAIN_COMMAND "command" 198 #define CONFDB_DOMAIN_TIMEOUT "timeout" 199 #define CONFDB_DOMAIN_ATTR "cn" 200 #define CONFDB_DOMAIN_ENUMERATE "enumerate" 201 #define CONFDB_SUBDOMAIN_ENUMERATE "subdomain_enumerate" 202 #define CONFDB_DEFAULT_SUBDOMAIN_ENUMERATE "none" 203 #define CONFDB_DOMAIN_MINID "min_id" 204 #define CONFDB_DOMAIN_MAXID "max_id" 205 #define CONFDB_DOMAIN_CACHE_CREDS "cache_credentials" 206 #define CONFDB_DOMAIN_CACHE_CREDS_MIN_FF_LENGTH \ 207 "cache_credentials_minimal_first_factor_length" 208 #define CONFDB_DEFAULT_CACHE_CREDS_MIN_FF_LENGTH 8 209 #define CONFDB_DOMAIN_AUTO_UPG "auto_private_groups" 210 #define CONFDB_DOMAIN_FQ "use_fully_qualified_names" 211 #define CONFDB_DOMAIN_ENTRY_CACHE_TIMEOUT "entry_cache_timeout" 212 #define CONFDB_DOMAIN_ACCOUNT_CACHE_EXPIRATION "account_cache_expiration" 213 #define CONFDB_DOMAIN_OVERRIDE_GID "override_gid" 214 #define CONFDB_DOMAIN_CASE_SENSITIVE "case_sensitive" 215 #define CONFDB_DOMAIN_SUBDOMAIN_HOMEDIR "subdomain_homedir" 216 #define CONFDB_DOMAIN_DEFAULT_SUBDOMAIN_HOMEDIR "/home/%d/%u" 217 #define CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS "ignore_group_members" 218 #define CONFDB_DOMAIN_SUBDOMAIN_REFRESH "subdomain_refresh_interval" 219 #define CONFDB_DOMAIN_SUBDOMAIN_REFRESH_DEFAULT_VALUE 14400 221 #define CONFDB_DOMAIN_USER_CACHE_TIMEOUT "entry_cache_user_timeout" 222 #define CONFDB_DOMAIN_GROUP_CACHE_TIMEOUT "entry_cache_group_timeout" 223 #define CONFDB_DOMAIN_NETGROUP_CACHE_TIMEOUT "entry_cache_netgroup_timeout" 224 #define CONFDB_DOMAIN_SERVICE_CACHE_TIMEOUT "entry_cache_service_timeout" 225 #define CONFDB_DOMAIN_AUTOFS_CACHE_TIMEOUT "entry_cache_autofs_timeout" 226 #define CONFDB_DOMAIN_SUDO_CACHE_TIMEOUT "entry_cache_sudo_timeout" 227 #define CONFDB_DOMAIN_SSH_HOST_CACHE_TIMEOUT "entry_cache_ssh_host_timeout" 228 #define CONFDB_DOMAIN_PWD_EXPIRATION_WARNING "pwd_expiration_warning" 229 #define CONFDB_DOMAIN_REFRESH_EXPIRED_INTERVAL "refresh_expired_interval" 230 #define CONFDB_DOMAIN_OFFLINE_TIMEOUT "offline_timeout" 231 #define CONFDB_DOMAIN_SUBDOMAIN_INHERIT "subdomain_inherit" 232 #define CONFDB_DOMAIN_CACHED_AUTH_TIMEOUT "cached_auth_timeout" 233 #define CONFDB_DOMAIN_TYPE "domain_type" 234 #define CONFDB_DOMAIN_TYPE_POSIX "posix" 235 #define CONFDB_DOMAIN_TYPE_APP "application" 236 #define CONFDB_DOMAIN_INHERIT_FROM "inherit_from" 239 #define CONFDB_LOCAL_DEFAULT_SHELL "default_shell" 240 #define CONFDB_LOCAL_DEFAULT_BASEDIR "base_directory" 241 #define CONFDB_LOCAL_CREATE_HOMEDIR "create_homedir" 242 #define CONFDB_LOCAL_REMOVE_HOMEDIR "remove_homedir" 243 #define CONFDB_LOCAL_UMASK "homedir_umask" 244 #define CONFDB_LOCAL_SKEL_DIR "skel_dir" 245 #define CONFDB_LOCAL_MAIL_DIR "mail_dir" 246 #define CONFDB_LOCAL_USERDEL_CMD "userdel_cmd" 249 #define CONFDB_PROXY_LIBNAME "proxy_lib_name" 250 #define CONFDB_PROXY_PAM_TARGET "proxy_pam_target" 251 #define CONFDB_PROXY_FAST_ALIAS "proxy_fast_alias" 252 #define CONFDB_PROXY_MAX_CHILDREN "proxy_max_children" 255 #define CONFDB_FILES_PASSWD "passwd_files" 256 #define CONFDB_FILES_GROUP "group_files" 259 #define CONFDB_SEC_CONF_ENTRY "config/secrets" 260 #define CONFDB_SEC_CONTAINERS_NEST_LEVEL "containers_nest_level" 261 #define CONFDB_SEC_MAX_SECRETS "max_secrets" 262 #define CONFDB_SEC_MAX_UID_SECRETS "max_uid_secrets" 263 #define CONFDB_SEC_MAX_PAYLOAD_SIZE "max_payload_size" 266 #define CONFDB_KCM_CONF_ENTRY "config/kcm" 267 #define CONFDB_KCM_SOCKET "socket_path" 268 #define CONFDB_KCM_DB "ccache_storage" 269 #define CONFDB_KCM_MAX_CCACHES "max_ccaches" 270 #define CONFDB_KCM_MAX_UID_CCACHES "max_uid_ccaches" 271 #define CONFDB_KCM_MAX_CCACHE_SIZE "max_ccache_size" 274 #define CONFDB_CERTMAP_BASEDN "cn=certmap,cn=config" 275 #define CONFDB_CERTMAP_NAME "cn" 276 #define CONFDB_CERTMAP_MAPRULE "maprule" 277 #define CONFDB_CERTMAP_MATCHRULE "matchrule" 278 #define CONFDB_CERTMAP_DOMAINS "domains" 279 #define CONFDB_CERTMAP_PRIORITY "priority" 282 #define CONFDB_PC_CONF_ENTRY "config/prompting" 283 #define CONFDB_PC_TYPE_PASSWORD "password" 284 #define CONFDB_PC_PASSWORD_PROMPT "password_prompt" 285 #define CONFDB_PC_TYPE_2FA "2fa" 286 #define CONFDB_PC_2FA_SINGLE_PROMPT "single_prompt" 287 #define CONFDB_PC_2FA_1ST_PROMPT "first_prompt" 288 #define CONFDB_PC_2FA_2ND_PROMPT "second_prompt" 289 #define CONFDB_PC_TYPE_CERT_AUTH "cert_auth" 292 struct config_file_ctx;
325 enum sss_domain_mpg_mode {
345 enum sss_domain_mpg_mode mpg_mode;
346 bool ignore_group_members;
351 bool cache_credentials;
352 uint32_t cache_credentials_min_ff_length;
357 const char *override_homedir;
358 const char *fallback_homedir;
359 const char *subdomain_homedir;
360 const char *homedir_substr;
361 const char *override_shell;
362 const char *default_shell;
364 uint32_t user_timeout;
365 uint32_t group_timeout;
366 uint32_t netgroup_timeout;
367 uint32_t service_timeout;
368 uint32_t autofsmap_timeout;
369 uint32_t sudo_timeout;
370 uint32_t ssh_host_timeout;
372 uint32_t refresh_expired_interval;
373 uint32_t subdomain_refresh_interval;
374 uint32_t cached_auth_timeout;
376 int pwd_expiration_warning;
378 struct sysdb_ctx *sysdb;
379 struct sss_names_ctx *names;
386 uint32_t trust_direction;
387 struct timeval subdomains_last_checked;
390 const char *view_name;
403 const char **upn_suffixes;
405 struct certmap_info **certmaps;
426 struct confdb_ctx **cdb_ctx,
427 const char *confdb_location);
458 int confdb_expand_app_domains(
struct confdb_ctx *cdb);
473 struct confdb_ctx *cdb,
505 const char *attribute,
506 const char **values);
530 const char *attribute,
556 const char *section,
const char *attribute,
557 const char *defstr,
char **result);
583 const char *section,
const char *attribute,
584 int defval,
int *result);
611 const char *section,
const char *attribute,
612 bool defval,
bool *result);
633 const char *attribute,
663 const char *section,
const char *attribute,
687 struct confdb_ctx *cdb,
int confdb_get_param(struct confdb_ctx *cdb, TALLOC_CTX *mem_ctx, const char *section, const char *attribute, char ***values)
Retrieve all values for an attribute.
int confdb_certmap_to_sysdb(struct confdb_ctx *cdb, struct sss_domain_info *dom)
Convenience function to write the certificate mapping and matching rules from the configuration datab...
Domain is being updated.
Definition: confdb.h:312
int confdb_list_all_domain_names(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, char ***_names)
Get a null-terminated linked-list of all domain names.
sss_domain_type
Whether the domain only supports looking up POSIX entries.
Definition: confdb.h:316
int confdb_get_domains(struct confdb_ctx *cdb, struct sss_domain_info **domains)
Get a null-terminated linked-list of active domain objects.
int confdb_get_bool(struct confdb_ctx *cdb, const char *section, const char *attribute, bool defval, bool *result)
Convenience function to retrieve a single-valued attribute as a boolean.
int confdb_add_param(struct confdb_ctx *cdb, bool replace, const char *section, const char *attribute, const char **values)
Add an arbitrary parameter to the confdb.
int confdb_set_string(struct confdb_ctx *cdb, const char *section, const char *attribute, const char *val)
Convenience function to set a single-valued attribute as a string.
int confdb_get_string(struct confdb_ctx *cdb, TALLOC_CTX *ctx, const char *section, const char *attribute, const char *defstr, char **result)
Convenience function to retrieve a single-valued attribute as a string.
int confdb_get_domain(struct confdb_ctx *cdb, const char *name, struct sss_domain_info **domain)
Get a domain object for the named domain.
Data structure storing all of the basic features of a domain.
Definition: confdb.h:335
Domain was removed, should not be used be neither responders not providers.
Definition: confdb.h:303
Domain is usable by both responders and providers.
Definition: confdb.h:299
sss_domain_state
sssd domain state
Definition: confdb.h:295
int confdb_get_sub_sections(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, const char *section, char ***sections, int *num_sections)
Convenience function to retrieve a list of subsections given a configuration section name...
int confdb_get_int(struct confdb_ctx *cdb, const char *section, const char *attribute, int defval, int *result)
Convenience function to retrieve a single-valued attribute as an integer.
In this mode, entries are typically resolved only by name.
Definition: confdb.h:322
This is the default domain type.
Definition: confdb.h:320
int confdb_init(TALLOC_CTX *mem_ctx, struct confdb_ctx **cdb_ctx, const char *confdb_location)
Initialize the connection to the ConfDB.
Domain cannot be contacted.
Definition: confdb.h:308
int confdb_get_string_as_list(struct confdb_ctx *cdb, TALLOC_CTX *ctx, const char *section, const char *attribute, char ***result)
Convenience function to retrieve a single-valued attribute as a null-terminated array of strings...