mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
8b6d1ab854
[MS-ADTS] 6.1.6.9.3.2 requires msDS-TrustForestTrustInfo attribute of trusted domain information in Active Directory to conform certain rules. One side-effect of those rules is that list of UPN suffixes reported through the netr_DsRGetForestTrustInformation function is dynamically filtered to deduplicate subordinate suffixes. It means that if list of UPN suffixes contains the following top level names (TLNs): fabrikam.com sub.fabrikam.com then netr_DsRGetForestTrustInformation would only return 'fabrikam.com' as the TLN, fully filtering 'sub.fabrikam.com'. IPA KDB driver used exact comparison of the UPN suffixes so any subordinate had to be specified exactly. Modify logic so that if exact check does not succeed, we validate a realm to test being a subordinate of the known UPN suffixes. The subordinate check is done by making sure UPN suffix is at the end of the test realm and is immediately preceded with a dot. Because the function to check suffixes potentially called for every Kerberos principal, precalculate and cache length for each UPN suffix at the time we retrieve the list of them. Fixes: https://pagure.io/freeipa/issue/8554 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
56 lines
1.7 KiB
C
56 lines
1.7 KiB
C
/*
|
|
* MIT Kerberos KDC database backend for FreeIPA
|
|
* This head file contains private declarations for ipa_kdb_mspac.c and should
|
|
* be used only there or in unit-test.
|
|
*
|
|
* Authors: Sumit Bose <sbose@redhat.com>
|
|
*
|
|
* see file 'COPYING' for use and warranty information
|
|
*
|
|
* This program is free software you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
struct ipadb_mspac {
|
|
char *flat_domain_name;
|
|
char *flat_server_name;
|
|
struct dom_sid domsid;
|
|
|
|
char *fallback_group;
|
|
uint32_t fallback_rid;
|
|
|
|
int num_trusts;
|
|
struct ipadb_adtrusts *trusts;
|
|
time_t last_update;
|
|
};
|
|
|
|
struct ipadb_adtrusts {
|
|
char *domain_name;
|
|
char *flat_name;
|
|
char *domain_sid;
|
|
struct dom_sid domsid;
|
|
struct dom_sid *sid_blocklist_incoming;
|
|
int len_sid_blocklist_incoming;
|
|
struct dom_sid *sid_blocklist_outgoing;
|
|
int len_sid_blocklist_outgoing;
|
|
struct ipadb_adtrusts *parent;
|
|
char *parent_name;
|
|
char **upn_suffixes;
|
|
size_t *upn_suffixes_len;
|
|
};
|
|
|
|
int string_to_sid(const char *str, struct dom_sid *sid);
|
|
char *dom_sid_string(TALLOC_CTX *memctx, const struct dom_sid *dom_sid);
|