|
typedef void( | sss_certmap_ext_debug )(void *pvt, const char *file, long line, const char *function, const char *format,...) |
|
|
int | sss_certmap_init (TALLOC_CTX *mem_ctx, sss_certmap_ext_debug *debug, void *debug_priv, struct sss_certmap_ctx **ctx) |
| Initialize certmap context. More...
|
|
void | sss_certmap_free_ctx (struct sss_certmap_ctx *ctx) |
| Free certmap context. More...
|
|
int | sss_certmap_add_rule (struct sss_certmap_ctx *ctx, uint32_t priority, const char *match_rule, const char *map_rule, const char **domains) |
| Add a rule to the certmap context. More...
|
|
int | sss_certmap_match_cert (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size) |
| Check if a certificate matches any of the applied rules. More...
|
|
int | sss_certmap_get_search_filter (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size, char **filter, char ***domains) |
| Get the LDAP filter string for a certificate. More...
|
|
void | sss_certmap_free_filter_and_domains (char *filter, char **domains) |
| Free data returned by sss_certmap_get_search_filter. More...
|
|
Libsss_certmap provides a mechanism to map X509 certificate to users based on rules.
#define SSS_CERTMAP_MIN_PRIO UINT32_MAX |
Lowest priority of a rule
typedef void( sss_certmap_ext_debug)(void *pvt, const char *file, long line, const char *function, const char *format,...) |
Typedef for external debug callback
int sss_certmap_add_rule |
( |
struct sss_certmap_ctx * |
ctx, |
|
|
uint32_t |
priority, |
|
|
const char * |
match_rule, |
|
|
const char * |
map_rule, |
|
|
const char ** |
domains |
|
) |
| |
Add a rule to the certmap context.
- Parameters
-
[in] | ctx | certmap context previously initialized with sss_certmap_init |
[in] | priority | priority of the rule, 0 is the hightest priority, the lowest is SSS_CERTMAP_MIN_PRIO |
[in] | match_rule | String with the matching rule |
[in] | map_rule | String with the mapping rule |
[in] | domains | NULL-terminated string array with a list of domains the rule should be valid for, i.e. only this domains should be searched for matching users |
- Returns
-
void sss_certmap_free_ctx |
( |
struct sss_certmap_ctx * |
ctx | ) |
|
Free certmap context.
- Parameters
-
[in] | ctx | certmap context previously initialized with sss_certmap_init, may be NULL |
void sss_certmap_free_filter_and_domains |
( |
char * |
filter, |
|
|
char ** |
domains |
|
) |
| |
Free data returned by sss_certmap_get_search_filter.
- Parameters
-
[in] | filter | LDAP filter strings returned by sss_certmap_get_search_filter |
[in] | domains | string array of domains returned by sss_certmap_get_search_filter |
int sss_certmap_get_search_filter |
( |
struct sss_certmap_ctx * |
ctx, |
|
|
const uint8_t * |
der_cert, |
|
|
size_t |
der_size, |
|
|
char ** |
filter, |
|
|
char *** |
domains |
|
) |
| |
Get the LDAP filter string for a certificate.
- Parameters
-
[in] | ctx | certmap context previously initialized with sss_certmap_init |
[in] | der_cert | binary blog with the DER encoded certificate |
[in] | der_size | size of the certificate blob |
[out] | filter | LDAP filter string, caller should free the data by calling sss_certmap_free_filter_and_domains |
[out] | domains | NULL-terminated array of strings with the domains the rule applies, caller should free the data by calling sss_certmap_free_filter_and_domains |
- Returns
- 0: certificate matches a rule
- ENOENT: certificate does not match
- EINVAL: internal error
int sss_certmap_init |
( |
TALLOC_CTX * |
mem_ctx, |
|
|
sss_certmap_ext_debug * |
debug, |
|
|
void * |
debug_priv, |
|
|
struct sss_certmap_ctx ** |
ctx |
|
) |
| |
Initialize certmap context.
- Parameters
-
[in] | mem_ctx | Talloc memory context, may be NULL |
[in] | debug | Callback to handle debug output, may be NULL |
[in] | debug_priv | Private data for debugging callback, may be NULL |
[out] | ctx | New certmap context |
- Returns
- 0: success
- ENOMEM: failed to allocate internal Talloc context
- EINVAL: ctx is NULL
int sss_certmap_match_cert |
( |
struct sss_certmap_ctx * |
ctx, |
|
|
const uint8_t * |
der_cert, |
|
|
size_t |
der_size |
|
) |
| |
Check if a certificate matches any of the applied rules.
- Parameters
-
[in] | ctx | certmap context previously initialized with sss_certmap_init |
[in] | der_cert | binary blog with the DER encoded certificate |
[in] | der_size | size of the certificate blob |
- Returns
- 0: certificate matches a rule
- ENOENT: certificate does not match
- EINVAL: internal error