sss_certmap
Loading...
Searching...
No Matches
Allow rule-based mapping of certificates to users

Macros

#define SSS_CERTMAP_MIN_PRIO   UINT32_MAX
 

Typedefs

typedef void sss_certmap_ext_debug(void *pvt, const char *file, long line, const char *function, const char *format,...)
 

Functions

int sss_certmap_init (TALLOC_CTX *mem_ctx, sss_certmap_ext_debug *debug, void *debug_priv, struct sss_certmap_ctx **ctx)
 Initialize certmap context.
 
void sss_certmap_free_ctx (struct sss_certmap_ctx *ctx)
 Free certmap context.
 
int sss_certmap_add_rule (struct sss_certmap_ctx *ctx, uint32_t priority, const char *match_rule, const char *map_rule, const char **domains)
 Add a rule to the certmap context.
 
int sss_certmap_match_cert (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size)
 Check if a certificate matches any of the applied rules.
 
int sss_certmap_get_search_filter (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size, char **filter, char ***domains)
 Get the LDAP filter string for a certificate.
 
int sss_certmap_expand_mapping_rule (struct sss_certmap_ctx *ctx, const uint8_t *der_cert, size_t der_size, char **_expanded, char ***_domains)
 Expand the mapping rule by replacing the templates.
 
void sss_certmap_free_filter_and_domains (char *filter, char **domains)
 Free data returned by sss_certmap_get_search_filter and sss_certmap_expand_mapping_rule.
 
int sss_certmap_display_cert_content (TALLOC_CTX *mem_cxt, const uint8_t *der_cert, size_t der_size, char **desc)
 Get a string with the content of the certificate used by the library.
 

Detailed Description

Libsss_certmap provides a mechanism to map X509 certificate to users based on rules.

Macro Definition Documentation

◆ SSS_CERTMAP_MIN_PRIO

#define SSS_CERTMAP_MIN_PRIO   UINT32_MAX

Lowest priority of a rule

Typedef Documentation

◆ sss_certmap_ext_debug

typedef void sss_certmap_ext_debug(void *pvt, const char *file, long line, const char *function, const char *format,...)

Typedef for external debug callback

Function Documentation

◆ sss_certmap_add_rule()

int sss_certmap_add_rule ( struct sss_certmap_ctx * ctx,
uint32_t priority,
const char * match_rule,
const char * map_rule,
const char ** domains )

Add a rule to the certmap context.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]prioritypriority of the rule, 0 is the hightest priority, the lowest is SSS_CERTMAP_MIN_PRIO
[in]match_ruleString with the matching rule
[in]map_ruleString with the mapping rule
[in]domainsNULL-terminated string array with a list of domains the rule should be valid for, i.e. only this domains should be searched for matching users
Returns
  • 0: success

◆ sss_certmap_display_cert_content()

int sss_certmap_display_cert_content ( TALLOC_CTX * mem_cxt,
const uint8_t * der_cert,
size_t der_size,
char ** desc )

Get a string with the content of the certificate used by the library.

Parameters
[in]mem_ctxTalloc memory context, may be NULL
[in]der_certbinary blob with the DER encoded certificate
[in]der_sizesize of the certificate blob
[out]descMultiline string showing the certificate content which is used by libsss_certmap
Returns
  • 0: success
  • EINVAL: certificate cannot be parsed
  • ENOMEM: memory allocation failure

◆ sss_certmap_expand_mapping_rule()

int sss_certmap_expand_mapping_rule ( struct sss_certmap_ctx * ctx,
const uint8_t * der_cert,
size_t der_size,
char ** _expanded,
char *** _domains )

Expand the mapping rule by replacing the templates.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]der_certbinary blob with the DER encoded certificate
[in]der_sizesize of the certificate blob
[out]expandedexpanded mapping rule, templates are filled in verbatim in contrast to sss_certmap_get_search_filter, caller should free the data by calling sss_certmap_free_filter_and_domains
[out]domainsNULL-terminated array of strings with the domains the rule applies, caller should free the data by calling sss_certmap_free_filter_and_domains
Returns
  • 0: certificate matches a rule
  • ENOENT: certificate does not match
  • EINVAL: internal error

◆ sss_certmap_free_ctx()

void sss_certmap_free_ctx ( struct sss_certmap_ctx * ctx)

Free certmap context.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init, may be NULL

◆ sss_certmap_free_filter_and_domains()

void sss_certmap_free_filter_and_domains ( char * filter,
char ** domains )

Free data returned by sss_certmap_get_search_filter and sss_certmap_expand_mapping_rule.

Parameters
[in]filterLDAP filter strings returned by sss_certmap_get_search_filter
[in]domainsstring array of domains returned by sss_certmap_get_search_filter

◆ sss_certmap_get_search_filter()

int sss_certmap_get_search_filter ( struct sss_certmap_ctx * ctx,
const uint8_t * der_cert,
size_t der_size,
char ** filter,
char *** domains )

Get the LDAP filter string for a certificate.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]der_certbinary blob with the DER encoded certificate
[in]der_sizesize of the certificate blob
[out]filterLDAP filter string, expanded templates are sanitized, caller should free the data by calling sss_certmap_free_filter_and_domains
[out]domainsNULL-terminated array of strings with the domains the rule applies, caller should free the data by calling sss_certmap_free_filter_and_domains
Returns
  • 0: certificate matches a rule
  • ENOENT: certificate does not match
  • EINVAL: internal error

◆ sss_certmap_init()

int sss_certmap_init ( TALLOC_CTX * mem_ctx,
sss_certmap_ext_debug * debug,
void * debug_priv,
struct sss_certmap_ctx ** ctx )

Initialize certmap context.

Parameters
[in]mem_ctxTalloc memory context, may be NULL
[in]debugCallback to handle debug output, may be NULL
[in]debug_privPrivate data for debugging callback, may be NULL
[out]ctxNew certmap context
Returns
  • 0: success
  • ENOMEM: failed to allocate internal Talloc context
  • EINVAL: ctx is NULL

◆ sss_certmap_match_cert()

int sss_certmap_match_cert ( struct sss_certmap_ctx * ctx,
const uint8_t * der_cert,
size_t der_size )

Check if a certificate matches any of the applied rules.

Parameters
[in]ctxcertmap context previously initialized with sss_certmap_init
[in]der_certbinary blob with the DER encoded certificate
[in]der_sizesize of the certificate blob
Returns
  • 0: certificate matches a rule
  • ENOENT: certificate does not match
  • EINVAL: internal error