summaryrefslogtreecommitdiffstats
path: root/phosphor-ldap-config
Commit message (Collapse)AuthorAgeFilesLines
* LDAP:change default values of GroupNameAttribute and UserNamAttributeHEADmasterraviteja-b2019-04-051-2/+2
| | | | | | | | | | | | | | | | Modify UserNameAttribute default value to "cn" and GroupNameAttribute default value to "gidNubmer" create config already enabled to make these attributes user configurable.these default values are to make sure ldap config works if user does not configure these attributes. Tested by: Configured LDAP without specifying group name and user name attributes and tested ldap user authentication Change-Id: I0091389122a384e0966659161566e9e543608628 Signed-off-by: raviteja-b <raviteja28031990@gmail.com>
* build: install into bin instead of sbinPatrick Venture2019-03-281-1/+1
| | | | | | | Installs into bin instead of sbin per guidelines. Signed-off-by: Patrick Venture <venture@google.com> Change-Id: Ie3fd4aa21c2644b2673f80a17dee13819b6b546e
* LDAP: Add the persistency for the "Enabled" propertyRatan Gupta2019-03-116-6/+141
| | | | | | | | | | | | | | | | This property will control that whether the LDAP service would be started or not. We are persisting this property using cereal, other properties is being persisted through nslcd.conf, nslcd doesn't give us a way to put this property under nslcd.conf. Tested By: Test the persistency of enabled property. Verified that it was getting persisted across restart/reboot. Change-Id: Id64b23b71865bac15d3be2d79abad615aa576bea Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* squash the following commitsRatan Gupta2019-03-112-57/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LDAP: Adding support for extra properties Implement GetUserInfo function in phosphor-user-manager Squashing the commits due to phosphor-dbus-interfaces dependency as the interface gets merged and it requires implementation so it is a deadlock for both the commits. Implement GetUserInfo function in phosphor-user-manager There was need to have api which return privilege for ldap user. it was discussed in this commit https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-dbus-interfaces/+/12027/ and decided to have generic api. -Checks if user is local user, then returns map of properties of local user like user privilege,list of user groups,user enabled state and user locked state. -If its not local user, then it checks if its a ldap user, then get the privilege mapping for the LDAP group and returns. TestedBy: 1) getUserInfo with local user verify user details. 2) getUserInfo with ldap user having privilege mapper entry, verify user details. 3) getUserInfo with no existing user. check for exception UserNameDoesNotExist. Change-Id: I44af41953db60ff96b39498d72839c2ab64bc8bd Signed-off-by: raviteja-b <raviteja28031990@gmail.com> LDAP: Adding support for extra properties This commit also decouple the ldap service(nslcd) start with each property update,Now there is a D-bus property ldap service enabled which controls that whether the LDAP service will be restarted after each property update,so now user have an option to disable the ldap service and do multi- property update and then enable the service again. TestedBy: 1) Create the config with new added properties Verify that it was getting reflected on the D-bus object. 2) After making the change restarted the ldap-conf service Verify that new properties(usernameattr,groupnameattr) are correctly updated. 3) Authenticaton test Verify that LDAP authentication worked fine. 4) Set the enabled property to true Verify that it starts the nslcd service 5) Set the enabled property to false Verify that it stops the nslcd.service 6) Set the enabled property to true and change any other config property Verify that it starts the nslcd.service 7) Set the enabled property to false which stops the nslcd service and change any other config property. Verify that it doesn't start the nslcd service. Change-Id: Ie3ca04a2adbbb1fe113764199348c4f7ac67f648 Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* Corrected the error log message.Ratan Gupta2019-03-061-2/+4
| | | | | Change-Id: I682dda32c0482e0849289a70d5b3ffa624bb915d Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* phosphor-ldap-conf: nslcd restart service getting called twiceNagaraju Goruganti2018-11-191-1/+0
| | | | | | | | In the createconfig path nslcd restart service is getting called twice in a row, which not needed. Change-Id: Ib60d43110815758360aa6f0de0478ad784cf5a5a Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* React to nsswitch config file changesDeepak Kodihalli2018-11-193-20/+1
| | | | | | | | | There's just one nsswitch config file now (instead of a default, an _linux and an _ldap). Make fixes in code relevant to this. Change-Id: I92362aac7a1f5e034cea06e9299f7e574dc2fab9 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: update nslcd.conf file with tls_cacertfile infoNagaraju Goruganti2018-11-193-15/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tls_cacertfile specifies the path to the X.509 certificate for peer authentication. Also updated the file with "tls_reqcert hard", to force the behavior: if no certificate is provided, or a bad certificate is provided, the session is immediately terminated. Tested: tested using below given commands 1.curl -c cjar -b cjar -k -H "Content-Type: application/json" -X POST -d \ '{"data":[true,"ldaps://<host_ip>/","cn=<user-id>,dc=Corp,dc=ibm,dc=com",\ "cn=Users,dc=Corp,dc=ibm,dc=com", "<password>",\ "xyz.openbmc_project.User.Ldap.Create.SearchScope.sub",\ "xyz.openbmc_project.User.Ldap.Create.Type.ActiveDirectory"] \ }' https://$BMC_IP//xyz/openbmc_project/user/ldap/action/CreateConfig 2.curl -b cjar -k -H "Content-Type: application/json" -X PUT -d '{"data":true}'\ https://$BMC_IP/xyz/openbmc_project/user/ldap/config/attr/SecureLDAP 3.curl -b cjar -k -H "Content-Type: application/json" -X PUT -d \ '{"data":"ldap://<host_ip>/"}' \ https://$BMC_IP/xyz/openbmc_project/ldap/config/attr/LDAPServerURI when "/etc/ssl/certs/Root-CA.pem" doesn't exist on target, we get below given exception(if we try to set SecureLDAP is true): "DBusException: xyz.openbmc_project.Common.Error.NoCACertificate: \ Server's CA certificate has not been provided." Change-Id: I56ffe8b08bb71307b4f2bfe9cf935b6113e4579a Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com> Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: add unit testsNagaraju Goruganti2018-11-193-17/+34
| | | | | | | | | Added uinit tests to create and to restore config file. Change-Id: Idf5231d46542cda1ff84241aa67aadd91a4788d6 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com> Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: Make correction in renaming path of nsswitch.confRatan Gupta2018-11-191-4/+1
| | | | | | | | | | | | | | | | By default nscd comes with nsswitch.conf, we had one more file for the ldap specific version, and we copy the content from the ldap nsswitch to the nsswitch.conf once LDAP config object gets created/deleted. We had some inconsistency during restarting of services so thought of clean logic where we would be having two files nsswitch_linux/nsswitch_ldap and when ldap config object gets created we copy the nsswitch_ldap to nsswitch.conf and when it gets deleted then copy the nsswitch_linux to nsswitch.conf Change-Id: I5a0af3ec82dd08fc54c7423fda1a80509769872d Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: Don't create the LDAP config objectRatan Gupta2018-11-191-0/+12
| | | | | | | | | | | | | | | | | | During restore path(i.e while phosphor-ldap-conf service restarts) after parsing the file if any of the LDAP parameter(BindDN,BaseDN,URI) is having empty value then don't create the LDAP config object. Before this commit the config object was not being created but it throws a unnecessary log in the journal due to creation of errorlog. In restore path we don't want the errorlog. This commit fixes the problem of creating unnecesary log in the journal. Change-Id: I074fe96a6c6382bc2d31e91df1275756b57c1045 Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: Don't map the uid with cn for openLDAPRatan Gupta2018-11-191-1/+0
| | | | | | | | User residing on the openLDAP server havibg the uid and the cn attribute so no need to map the uid with cn. Change-Id: Ie1ef9798191831d0b532b310960115c5dd8a1b33 Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com>
* phosphor-ldap-conf: update nslcd.conf file for OpenLdapNagaraju Goruganti2018-11-191-0/+1
| | | | | | | | update the config file with "filter group (objectclass=posixGroup)" for OpenLdap. Change-Id: I4a0a4693294745391d58d7ee9158c75468637f36 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: validate LDAP Server URINagaraju Goruganti2018-11-204-27/+101
| | | | | | | | | Validates given URI. Also updates secureLDAP property based on given URI. If URI is of LDAPS type, secureLDAP is set to true, else it is set to false. Change-Id: If96495c01a8bd911d255267ffbbbff7f28fa070b Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* ldap-config: remove Bindpassword and secureLDAP property from the interfaceNagaraju Goruganti2018-11-202-111/+55
| | | | | | | | | | | | This is a reaction to below given phosphor-dbus-interfaces changes https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-dbus-interfaces/+/14595/. and https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-dbus-interfaces/+/14718/ Change-Id: Id427d718b6fcc9b90dfb3bccb3b4cc665a107c46 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com> Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com> Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* phosphor-ldap-conf: change the permissions of the nslcd.conf fileRatan Gupta2018-10-231-0/+17
| | | | | | | | | | | | | If bindDN password is being written in the file then change the permission of the file to 640 so that it is not world readable. If bindDN password is not written then permission would be 644 which is default. Change-Id: I567285ad75e18c2a38c37918d3d3a5e61b0b39ea Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com> Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: add support for anonymous bindNagaraju Goruganti2018-10-231-2/+7
| | | | | | | | Add "bindpw <password>" entry into nslcd.conf file only if given password is not null. Change-Id: Ifa4a90c6fd41d5b36c62328dcf3e9bfc38dd0ebb Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: add support for validation of parametersNagaraju Goruganti2018-10-062-4/+54
| | | | | | | | Validate LDAP Server's URI, BaseDN and BindBN. Change-Id: If754e17c238069e04c9e1e8735a28d54dbf221cb TODO: Unit tests will be added in subsequent commits. Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: switch between config files while enabling/disabling LDAPNagaraju Goruganti2018-10-042-0/+56
| | | | | | | | While creating LDAP configuration take a backup of existing config files and restore them when LDAP configuration is disabled. Change-Id: Id37138107311a56c5066bc66137a2d55e1e23099 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: Implement the Delete interfaceNagaraju Goruganti2018-10-042-2/+22
| | | | | | | | Implement the xyz.openbmc_project.Object.Delete interface to delete LDAP config object. Change-Id: Ia7413fd10c91ad5c79286fbe4a00740ced42aad6 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: implement restore and add error handlingNagaraju Goruganti2018-10-042-62/+327
| | | | | | | | Upon startup, restore D-Bus properties from LDAP config file if it exists. Change-Id: I63b5a41eec8937ddbd5e8b4471936376602b6b0e Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* phosphor-ldap-conf: add application to configure LDAPNagaraju Goruganti2018-10-044-0/+475
The application implements the xyz.openbmc_project.User.Ldap.Config and xyz.openbmc_project.User.Ldap.Create D-Bus interfaces to create LDAP config file(for example generate nslcd.conf) Change-Id: Idc7cc643c4143f9bc51182019926e1dd6125da2f Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
OpenPOWER on IntegriCloud