Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure how SSSD should access RootDSE. #7846

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Configure how SSSD should access RootDSE. #7846

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/config/SSSDConfig/sssdoptions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,6 +358,7 @@ def __init__(self):
'ldap_uri': _('ldap_uri, The URI of the LDAP server'),
'ldap_backup_uri': _('ldap_backup_uri, The URI of the LDAP server'),
'ldap_search_base': _('The default base DN'),
'ldap_read_rootdse': _('How to read rootDSE from LDAP server'),
'ldap_schema': _('The Schema Type in use on the LDAP server, rfc2307'),
'ldap_pwmodify_mode': _('Mode used to change user password'),
'ldap_default_bind_dn': _('The default bind DN'),
Expand Down
1 change: 1 addition & 0 deletions src/config/cfg_rules.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -686,6 +686,7 @@ option = ldap_purge_cache_offset
option = ldap_pwd_attribute
option = ldap_pwdlockout_dn
option = ldap_pwd_policy
option = ldap_read_rootdse
option = ldap_referrals
option = ldap_rfc2307_fallback_to_local_users
option = ldap_rootdse_last_usn
Expand Down
39 changes: 39 additions & 0 deletions src/man/sssd-ldap.5.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,45 @@
</listitem>
</varlistentry>

<varlistentry>
<term>ldap_read_rootdse (string)</term>
<listitem>
<para>
SSSD reads RootDSE to get information about LDAP and
its capabilities. By default, this is done
anonymously. However, this may not be permitted by
the LDAP server. In such cases we can use this option
to influence SSSD behavior.
</para>
<para>
Allowed values are:
<itemizedlist>
<listitem>
<para>
anonymous
</para>
</listitem>
<listitem>
<para>
authenticated
</para>
</listitem>
<listitem>
<para>
never
</para>
</listitem>
</itemizedlist>
Note that when using the "anonymous" option, SSSD
may attempt to read RootDSE after authentication
if anonymous access fails.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't quite understand this statement. Can you elaborate?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it related to the comment in the code below?

     /* We did not read rootDSE during unauthenticated bind becase
     * it is unaccessible for anonymous user or because
     * ldap_read_rootdse is set to "authenticated"
     * Let's try to read it now */

</para>
<para>
Default: anonymous
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>ldap_schema (string)</term>
<listitem>
Expand Down
1 change: 1 addition & 0 deletions src/providers/ad/ad_opts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ struct dp_option ad_def_ldap_opts[] = {
{ "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_backup_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_read_rootdse", DP_OPT_STRING, { "anonymous" }, NULL_STRING },
{ "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
{ "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
Expand Down
1 change: 1 addition & 0 deletions src/providers/ipa/ipa_opts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ struct dp_option ipa_def_ldap_opts[] = {
{ "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_backup_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_read_rootdse", DP_OPT_STRING, { "anonymous" }, NULL_STRING },
{ "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
{ "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
Expand Down
1 change: 1 addition & 0 deletions src/providers/ldap/ldap_opts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ struct dp_option default_basic_opts[] = {
{ "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_backup_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_read_rootdse", DP_OPT_STRING, { "anonymous" }, NULL_STRING },
{ "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_default_authtok_type", DP_OPT_STRING, { "password" }, NULL_STRING},
{ "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
Expand Down
1 change: 1 addition & 0 deletions src/providers/ldap/sdap.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ enum sdap_basic_opt {
SDAP_URI = 0,
SDAP_BACKUP_URI,
SDAP_SEARCH_BASE,
SDAP_READ_ROOTDSE,
SDAP_DEFAULT_BIND_DN,
SDAP_DEFAULT_AUTHTOK_TYPE,
SDAP_DEFAULT_AUTHTOK,
Expand Down
55 changes: 50 additions & 5 deletions src/providers/ldap/sdap_async_connection.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,13 @@ struct sdap_rebind_proc_params {
bool use_ppolicy;
};

enum sdap_rootdse_read_opts {
SDAP_ROOTDSE_READ_ANONYMOUS,
SDAP_ROOTDSE_READ_AUTHENTICATED,
SDAP_ROOTDSE_READ_NEVER,
SDAP_ROOTDSE_READ_INVALID,
};

static int sdap_rebind_proc(LDAP *ldap, LDAP_CONST char *url, ber_tag_t request,
ber_int_t msgid, void *params);

Expand Down Expand Up @@ -1496,6 +1503,7 @@ struct sdap_cli_connect_state {
struct be_ctx *be;

bool use_rootdse;
enum sdap_rootdse_read_opts rootdse_access;
struct sysdb_attrs *rootdse;

struct sdap_handle *sh;
Expand Down Expand Up @@ -1525,6 +1533,35 @@ static errno_t sdap_cli_auth_reconnect(struct tevent_req *subreq);
static void sdap_cli_auth_reconnect_done(struct tevent_req *subreq);
static void sdap_cli_rootdse_auth_done(struct tevent_req *subreq);


enum sdap_rootdse_read_opts
decide_rootdse_access(struct dp_option *basic)
{
int i;
char *str;
struct read_rootdse_enum_str {
enum sdap_rootdse_read_opts option_enum;
const char *option_str;
};
static struct read_rootdse_enum_str read_rootdse_enum_str[] = {
{ SDAP_ROOTDSE_READ_ANONYMOUS, "anonymous"},
{ SDAP_ROOTDSE_READ_AUTHENTICATED, "authenticated"},
{ SDAP_ROOTDSE_READ_NEVER, "never"},
{ SDAP_ROOTDSE_READ_INVALID, NULL}
};

str = dp_opt_get_string (basic, SDAP_READ_ROOTDSE);
for (i = 0; read_rootdse_enum_str[i].option_str != NULL; i++) {
if (strcasecmp(read_rootdse_enum_str[i].option_str, str) == 0) {
return read_rootdse_enum_str[i].option_enum;
}
}
DEBUG(SSSDBG_CONF_SETTINGS,
"The ldap_read_rootdse option has an invalid value [%s], "
"using [anonymous]\n", str);
return SDAP_ROOTDSE_READ_ANONYMOUS;
}

static errno_t
decide_tls_usage(enum connect_tls force_tls, struct dp_option *basic,
const char *uri, bool *_use_tls)
Expand Down Expand Up @@ -1579,6 +1616,7 @@ struct tevent_req *sdap_cli_connect_send(TALLOC_CTX *memctx,
state->srv = NULL;
state->srv_opts = NULL;
state->use_rootdse = !skip_rootdse;
state->rootdse_access = decide_rootdse_access (opts->basic);
state->force_tls = force_tls;
state->do_auth = !skip_auth;

Expand Down Expand Up @@ -1695,15 +1733,19 @@ static void sdap_cli_connect_done(struct tevent_req *subreq)
}
state->retry_attempts = 0;

if (state->use_rootdse) {
if (state->use_rootdse &&
state->rootdse_access == SDAP_ROOTDSE_READ_ANONYMOUS) {

/* fetch the rootDSE this time */
sdap_cli_rootdse_step(req);
return;
}

sasl_mech = dp_opt_get_string(state->opts->basic, SDAP_SASL_MECH);

if (state->do_auth && sasl_mech && state->use_rootdse) {
if (state->do_auth && sasl_mech && state->use_rootdse &&
state->rootdse_access == SDAP_ROOTDSE_READ_ANONYMOUS) {

/* check if server claims to support the configured SASL MECH */
if (!sdap_is_sasl_mech_supported(state->sh, sasl_mech)) {
tevent_req_error(req, ENOTSUP);
Expand Down Expand Up @@ -2097,9 +2139,12 @@ static void sdap_cli_auth_done(struct tevent_req *subreq)
return;
}

if (state->use_rootdse && !state->rootdse) {
/* We weren't able to read rootDSE during unauthenticated bind.
* Let's try again now that we are authenticated */
if (state->use_rootdse && !state->rootdse &&
state->rootdse_access != SDAP_ROOTDSE_READ_NEVER) {
/* We did not read rootDSE during unauthenticated bind becase
* it is unaccessible for anonymous user or because
* ldap_read_rootdse is set to "authenticated"
* Let's try to read it now */
subreq = sdap_get_rootdse_send(state, state->ev,
state->opts, state->sh);
if (!subreq) {
Expand Down
Loading