|
 |
70a90c |
From 54b207649979475ea7f1fa5eaaea94be31d20935 Mon Sep 17 00:00:00 2001
|
|
|
70a90c |
From: Ray Strode <rstrode@redhat.com>
|
|
|
70a90c |
Date: Fri, 13 Dec 2019 15:16:06 -0500
|
|
|
70a90c |
Subject: [PATCH] daemon: if no local users, check if machine is enrolled in
|
|
|
70a90c |
network
|
|
|
70a90c |
|
|
|
70a90c |
GDM will show gnome initial-setup if a machine has no local users.
|
|
|
70a90c |
But it's totally possible that a machine has only remote users,
|
|
|
70a90c |
and shouldn't have a local user.
|
|
|
70a90c |
|
|
|
70a90c |
This commit detects that case, and avoids setting the HasNoUsers
|
|
|
70a90c |
property.
|
|
|
70a90c |
---
|
|
|
70a90c |
data/org.freedesktop.realmd.xml | 730 ++++++++++++++++++++++++++++++++
|
|
|
70a90c |
src/daemon.c | 63 ++-
|
|
|
70a90c |
src/meson.build | 1 +
|
|
|
70a90c |
src/org.freedesktop.realmd.xml | 730 ++++++++++++++++++++++++++++++++
|
|
|
70a90c |
4 files changed, 1520 insertions(+), 4 deletions(-)
|
|
|
70a90c |
create mode 100644 data/org.freedesktop.realmd.xml
|
|
|
70a90c |
create mode 100644 src/org.freedesktop.realmd.xml
|
|
|
70a90c |
|
|
|
70a90c |
diff --git a/data/org.freedesktop.realmd.xml b/data/org.freedesktop.realmd.xml
|
|
|
70a90c |
new file mode 100644
|
|
|
70a90c |
index 0000000..c34a47a
|
|
|
70a90c |
--- /dev/null
|
|
|
70a90c |
+++ b/data/org.freedesktop.realmd.xml
|
|
|
70a90c |
@@ -0,0 +1,730 @@
|
|
|
70a90c |
+
|
|
|
70a90c |
+ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
|
|
|
70a90c |
+<node name="/">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Provider:
|
|
|
70a90c |
+ @short_description: a realm provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various realm providers represent different software implementations
|
|
|
70a90c |
+ that provide access to realms or domains.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This interface is implemented by individual providers, but is
|
|
|
70a90c |
+ aggregated globally at the system bus name
|
|
|
70a90c |
+ <literal>org.freedesktop.realmd</literal>
|
|
|
70a90c |
+ with the object path <literal>/org/freedesktop/realmd</literal>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Provider">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Name: the name of the provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The name of the provider. This is not normally displayed
|
|
|
70a90c |
+ to the user, but may be useful for diagnostics or debugging.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Name" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Version: the version of the provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The version of the provider. This is not normally used in
|
|
|
70a90c |
+ logic, but may be useful for diagnostics or debugging.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Version" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Realms: a list of realms
|
|
|
70a90c |
+
|
|
|
70a90c |
+ A list of known, enrolled or discovered realms. All realms
|
|
|
70a90c |
+ that this provider knows about are listed here. As realms
|
|
|
70a90c |
+ are discovered they are added to this list.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Each realm is represented by the DBus object path of the
|
|
|
70a90c |
+ realm object.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Realms" type="ao" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Discover:
|
|
|
70a90c |
+ @string: an input string to discover realms for
|
|
|
70a90c |
+ @options: options for the discovery operation
|
|
|
70a90c |
+ @relevance: the relevance of the returned results
|
|
|
70a90c |
+ @realm: a list of realms discovered
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Discover realms for the given string. The input @string is
|
|
|
70a90c |
+ usually a domain or realm name, perhaps typed by a user. If
|
|
|
70a90c |
+ an empty string is provided, the realm provider should try to
|
|
|
70a90c |
+ discover a default realm, if possible (e.g. from DHCP).
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>client-software</literal>: a string
|
|
|
70a90c |
+ containing the client software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>server-software</literal>: a string
|
|
|
70a90c |
+ containing the client software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>membership-software</literal>: a string
|
|
|
70a90c |
+ containing the membership software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @relevance returned can be used to rank results from
|
|
|
70a90c |
+ different discover calls to different providers. Implementors
|
|
|
70a90c |
+ should return a positive number if the provider highly
|
|
|
70a90c |
+ recommends that the realms be handled by this provider,
|
|
|
70a90c |
+ or a zero if it can possibly handle the realms. Negative numbers
|
|
|
70a90c |
+ should be returned if no realms are found.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method does not return an error when no realms are
|
|
|
70a90c |
+ discovered. It simply returns an empty @realm list.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To see diagnostic information about the discovery process,
|
|
|
70a90c |
+ connect to the org.freedesktop.realmd.Service::Diagnostics
|
|
|
70a90c |
+ signal.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.discover-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may
|
|
|
70a90c |
+ return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the discovery could not be run for some reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform a discovery
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Discover">
|
|
|
70a90c |
+ <arg name="string" type="s" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ <arg name="relevance" type="i" direction="out"/>
|
|
|
70a90c |
+ <arg name="realm" type="ao" direction="out"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Service:
|
|
|
70a90c |
+ @short_description: the realmd service
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Global calls for managing the realmd service. Usually you'll want
|
|
|
70a90c |
+ to use #org.freedesktop.realmd.Provider instead.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This interface is implemented by the realmd service, and is always
|
|
|
70a90c |
+ available at the object path <literal>/org/freedesktop/realmd</literal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The service also implements the
|
|
|
70a90c |
+ <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
|
|
|
70a90c |
+ makes it easy to retrieve all realmd objects and properties in one go.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Service">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Cancel:
|
|
|
70a90c |
+ @operation: the operation to cancel
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Cancel a realmd operation. To be able to cancel an operation,
|
|
|
70a90c |
+ pass a uniquely chosen <literal>operation</literal> string
|
|
|
70a90c |
+ identifier as an option in the method's <literal>options</literal>
|
|
|
70a90c |
+ argument.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ These operation string identifiers should be unique per client
|
|
|
70a90c |
+ calling the realmd service.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It is not guaranteed that the service can or will cancel the
|
|
|
70a90c |
+ operation. For example, the operation may have already completed
|
|
|
70a90c |
+ by the time this method is handled. The caller of the operation
|
|
|
70a90c |
+ method will receive a
|
|
|
70a90c |
+ <literal>org.freedesktop.realmd.Error.Cancelled</literal>
|
|
|
70a90c |
+ if the operation was cancelled.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Cancel">
|
|
|
70a90c |
+ <arg name="operation" type="s" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SetLocale:
|
|
|
70a90c |
+ @locale: the locale for the client
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Set the language @locale for the client. This locale is used
|
|
|
70a90c |
+ for error messages. The locale is used until the next time
|
|
|
70a90c |
+ this method is called, the client disconnects, or the client
|
|
|
70a90c |
+ calls #org.freedesktop.realmd.Service.Release().
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="SetLocale">
|
|
|
70a90c |
+ <arg name="locale" type="s" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Diagnostics:
|
|
|
70a90c |
+ @data: diagnostic data
|
|
|
70a90c |
+ @operation: the operation this data resulted from
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This signal is fired when diagnostics result from an operation
|
|
|
70a90c |
+ in the provider or one of its realms.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It is not guaranteed that this signal is emitted once per line.
|
|
|
70a90c |
+ More than one line may be contained in @data, or a partial
|
|
|
70a90c |
+ line. New line characters are embedded in @data.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This signal is sent explicitly to the client which invoked an
|
|
|
70a90c |
+ operation method. In order to tell which operation this
|
|
|
70a90c |
+ diagnostic data results from, pass a unique
|
|
|
70a90c |
+ <literal>operation</literal> string identifier in the
|
|
|
70a90c |
+ <literal>options</literal> argument of the operation method.
|
|
|
70a90c |
+ That same identifier will be passed back via the @operation
|
|
|
70a90c |
+ argument of this signal.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <signal name="Diagnostics">
|
|
|
70a90c |
+ <arg name="data" type="s"/>
|
|
|
70a90c |
+ <arg name="operation" type="s"/>
|
|
|
70a90c |
+ </signal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Release:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Normally, realmd waits until all clients have disconnected
|
|
|
70a90c |
+ before exiting itself sometime later. Long lived clients
|
|
|
70a90c |
+ can call this method to allow the realmd service to quit.
|
|
|
70a90c |
+ This is an optimization. The daemon will not exit immediately.
|
|
|
70a90c |
+ It is safe to call this multiple times.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Release">
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Realm:
|
|
|
70a90c |
+ @short_description: a realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Represents one realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Contains generic information about a realm, and useful properties for
|
|
|
70a90c |
+ introspecting what kind of realm this is and how to work with
|
|
|
70a90c |
+ the realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Use #org.freedesktop.realmd.Provider:Realms or
|
|
|
70a90c |
+ #org.freedesktop.realmd.Provider.Discover() to get access to some
|
|
|
70a90c |
+ kerberos realm objects.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Realms will always implement additional interfaces, such as
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos. Do not assume that all realms
|
|
|
70a90c |
+ implement that kerberos interface. Use the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
|
|
|
70a90c |
+ which interfaces are supported.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Different realms support various ways to configure them on the
|
|
|
70a90c |
+ system. Use the #org.freedesktop.realmd.Realm:Configured property
|
|
|
70a90c |
+ to determine if a realm is configured. If it is configured, the
|
|
|
70a90c |
+ property will be set to the interface of the mechanism that was
|
|
|
70a90c |
+ used to configure it.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To configure a realm, look in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
|
|
|
70a90c |
+ recognized purpose-specific interface that can be used for
|
|
|
70a90c |
+ configuration, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership interface and its
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Join() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To deconfigure a realm from the current system, you can use the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
|
|
|
70a90c |
+ of the configuration specific interfaces provide methods to
|
|
|
70a90c |
+ deconfigure a realm in a specific way, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various properties are guaranteed to have been updated before
|
|
|
70a90c |
+ the operation methods return, if they change state.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Realm">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Name: the realm name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This is the name of the realm, appropriate for display to
|
|
|
70a90c |
+ end users where necessary.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Name" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Configured: whether this domain is configured and how
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this property is an empty string, then the realm is not
|
|
|
70a90c |
+ configured. Otherwise the realm is configured, and contains
|
|
|
70a90c |
+ a string which is the interface that represents how it was
|
|
|
70a90c |
+ configured, for example #org.freedesktop.realmd.KerberosMembership.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Configured" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Deconfigure: deconfigure this realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Deconfigure this realm from the local machine with standard
|
|
|
70a90c |
+ default behavior.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The behavior of this method depends on the which configuration
|
|
|
70a90c |
+ interface is present in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.Configured property. It does not
|
|
|
70a90c |
+ always delete membership accounts in the realm, but just
|
|
|
70a90c |
+ reconfigures the local machine so it no longer is configured
|
|
|
70a90c |
+ for the given realm. In some cases the implementation may try
|
|
|
70a90c |
+ to update membership accounts, but this is not guaranteed.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various configuration interfaces may support more specific ways
|
|
|
70a90c |
+ to deconfigure a realm in a specific way, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the deconfigure failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to deconfigure a
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
|
|
|
70a90c |
+ returned if this realm is not configured on the machine.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Deconfigure">
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedInterfaces:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Additional supported interfaces of this realm. This includes
|
|
|
70a90c |
+ interfaces that contain more information about the realm,
|
|
|
70a90c |
+ such as #org.freedesktop.realmd.Kerberos and interfaces
|
|
|
70a90c |
+ which contain methods for configuring a realm, such as
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedInterfaces" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Details: informational details about the realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Informational details about the realm. The following values
|
|
|
70a90c |
+ should be present:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>server-software</literal>:
|
|
|
70a90c |
+ identifier of the software running on the server (e.g.
|
|
|
70a90c |
+ <literal>active-directory</literal>).</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>client-software</literal>:
|
|
|
70a90c |
+ identifier of the software running on the client (e.g.
|
|
|
70a90c |
+ <literal>sssd</literal>).</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Details" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ RequiredPackages: prerequisite software
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Software packages that are required in order for a join to
|
|
|
70a90c |
+ succeed. These are either simple strings like <literal>sssd</literal>,
|
|
|
70a90c |
+ or strings with an operator and version number like
|
|
|
70a90c |
+ <literal>sssd >= 1.9.0</literal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ These values are specific to the packaging system that is
|
|
|
70a90c |
+ being run.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="RequiredPackages" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ LoginFormats: supported formats for login names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Supported formats for login to this realm. This is only
|
|
|
70a90c |
+ relevant once the realm has been enrolled. The formats
|
|
|
70a90c |
+ will contain a <literal>%U</literal> in the string, which
|
|
|
70a90c |
+ indicate where the user name should be placed. The formats
|
|
|
70a90c |
+ may contain a <literal>%D</literal> in the string which
|
|
|
70a90c |
+ indicate where a domain name should be placed.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The first format in the list is the preferred format for
|
|
|
70a90c |
+ login names.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="LoginFormats" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ LoginPolicy: the policy for logins using this realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The policy for logging into this computer using this realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The policy can be changed using the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The following policies are predefined. Not all providers
|
|
|
70a90c |
+ support all these policies and there may be provider specific
|
|
|
70a90c |
+ policies or multiple policies represented in the string:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>allow-any-login</literal>: allow
|
|
|
70a90c |
+ login by any authenticated user present in this
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>allow-realm-logins</literal>: allow
|
|
|
70a90c |
+ logins according to the realm or domain policy for logins
|
|
|
70a90c |
+ on this machine. This usually defaults to allowing any realm
|
|
|
70a90c |
+ user to log in.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>allow-permitted-logins</literal>:
|
|
|
70a90c |
+ only allow the logins permitted in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:PermittedLogins
|
|
|
70a90c |
+ property.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>deny-any-login</literal>:
|
|
|
70a90c |
+ don't allow any logins via authenticated users of this
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="LoginPolicy" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ PermittedLogins: the permitted login names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The list of permitted authenticated users allowed to login
|
|
|
70a90c |
+ into this computer. This is only relevant if the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property
|
|
|
70a90c |
+ contains the <literal>allow-permitted-logins</literal>
|
|
|
70a90c |
+ string.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="PermittedLogins" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ PermittedGroups: the permitted group names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The list of groups which users need to be in to be allowed
|
|
|
70a90c |
+ to log into this computer. This is only relevant if the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property
|
|
|
70a90c |
+ contains the <literal>allow-permitted-logins</literal>
|
|
|
70a90c |
+ string.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="PermittedGroups" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ ChangeLoginPolicy:
|
|
|
70a90c |
+ @login_policy: the new login policy, or an empty string
|
|
|
70a90c |
+ @permitted_add: a list of logins to permit
|
|
|
70a90c |
+ @permitted_remove: a list of logins to not permit
|
|
|
70a90c |
+ @options: options for this operation
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Change the login policy and/or permitted logins for this realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Not all realms support all the various login policies. An
|
|
|
70a90c |
+ error will be returned if the new login policy is not supported.
|
|
|
70a90c |
+ You may specify an empty string for the @login_policy argument
|
|
|
70a90c |
+ which will cause no change in the policy itself. If the policy
|
|
|
70a90c |
+ is changed, it will be reflected in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @permitted_add and @permitted_remove arguments represent
|
|
|
70a90c |
+ lists of login names that should be added and removed from
|
|
|
70a90c |
+ the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>groups</literal>: boolean which if
|
|
|
70a90c |
+ set to <literal>TRUE</literal> means that the names in
|
|
|
70a90c |
+ @permitted_add and @permitted_remove are group names instead
|
|
|
70a90c |
+ of login names.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.login-policy</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the policy change failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to change login policy
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
|
|
|
70a90c |
+ returned if the realm is not configured.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="ChangeLoginPolicy">
|
|
|
70a90c |
+ <arg name="login_policy" type="s" direction="in"/>
|
|
|
70a90c |
+ <arg name="permitted_add" type="as" direction="in"/>
|
|
|
70a90c |
+ <arg name="permitted_remove" type="as" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Kerberos:
|
|
|
70a90c |
+ @short_description: a kerberos realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ An interface that describes a kerberos realm in more detail. This
|
|
|
70a90c |
+ is always implemented on an DBus object path that also implements
|
|
|
70a90c |
+ the #org.freedesktop.realmd.Realm interface.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Kerberos">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ RealmName: the kerberos realm name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The kerberos name for this realm. This is usually in upper
|
|
|
70a90c |
+ case.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="RealmName" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ DomainName: the DNS domain name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The DNS domain name for this realm.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="DomainName" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.KerberosMembership:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ An interface used to configure this machine by joining a realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It sets up a computer/host account in the realm for this machine
|
|
|
70a90c |
+ and a keytab to track the credentials for that account.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various properties are guaranteed to have been updated before
|
|
|
70a90c |
+ the operation methods return, if they change state.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.KerberosMembership">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SuggestedAdministrator: common administrator name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The common administrator name for this type of realm. This
|
|
|
70a90c |
+ can be used by clients as a hint when prompting the user for
|
|
|
70a90c |
+ administrative authentication.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SuggestedAdministrator" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedJoinCredentials: credentials supported for joining
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various kinds of credentials that are supported when calling the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos.Join() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Each credential is represented by a type and an owner. The type
|
|
|
70a90c |
+ denotes which kind of credential is passed to the method. The
|
|
|
70a90c |
+ owner indicates to the client how to prompt the user or obtain
|
|
|
70a90c |
+ the credential, and to the service how to use the credential.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various types are:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>ccache</literal>:
|
|
|
70a90c |
+ the credentials should contain an array of bytes as a
|
|
|
70a90c |
+ <literal>ay</literal> containing the data from a kerberos
|
|
|
70a90c |
+ credential cache file.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>password</literal>:
|
|
|
70a90c |
+ the credentials should contain a pair of strings as a
|
|
|
70a90c |
+ <literal>(ss)</literal> representing a name and
|
|
|
70a90c |
+ password. The name may contain a realm in the standard
|
|
|
70a90c |
+ kerberos format. If a realm is missing, it will default
|
|
|
70a90c |
+ to this realm. </para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>secret</literal>:
|
|
|
70a90c |
+ the credentials should contain a string secret as an
|
|
|
70a90c |
+ <literal>ay</literal> array of bytes. This is usually used
|
|
|
70a90c |
+ for one time passwords. To pass a string here, encode it
|
|
|
70a90c |
+ in UTF-8, and place the resulting bytes in the
|
|
|
70a90c |
+ value.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>automatic</literal>:
|
|
|
70a90c |
+ the credentials should contain an empty string as a
|
|
|
70a90c |
+ <literal>s</literal>. Using <literal>automatic</literal>
|
|
|
70a90c |
+ indicates that default or system credentials are to be
|
|
|
70a90c |
+ used.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various owners are:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>administrator</literal>:
|
|
|
70a90c |
+ the credentials belong to a kerberos administrator principal.
|
|
|
70a90c |
+ The caller may use this as a hint to prompt the user
|
|
|
70a90c |
+ for administrative credentials.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>user</literal>:
|
|
|
70a90c |
+ the credentials belong to a kerberos user principal.
|
|
|
70a90c |
+ The caller may use this as a hint to prompt the user
|
|
|
70a90c |
+ for his (possibly non-administrative)
|
|
|
70a90c |
+ credentials.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>computer</literal>:
|
|
|
70a90c |
+ the credentials belong to a computer account.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>none</literal>:
|
|
|
70a90c |
+ the credentials have an unspecified owner, such as a one
|
|
|
70a90c |
+ time password.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedLeaveCredentials: credentials supported for leaving
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various kinds of credentials that are supported when calling the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
|
|
|
70a90c |
+ a discussion of what the values represent.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Join:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Join this machine to the realm and enroll the machine.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this method returns successfully, then the machine will be
|
|
|
70a90c |
+ joined to the realm. It is not necessary to restart services or the
|
|
|
70a90c |
+ machine afterward. Relevant properties on the realm will be updated
|
|
|
70a90c |
+ before the method returns.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @credentials should be set according to one of the
|
|
|
70a90c |
+ supported credentials returned by
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
|
|
|
70a90c |
+ The first string in the tuple is the type, the second string
|
|
|
70a90c |
+ is the owner, and the variant contains the credential contents
|
|
|
70a90c |
+ See the discussion at
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
|
|
|
70a90c |
+ for more information.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>automatic-id-mapping</literal>: a boolean
|
|
|
70a90c |
+ value whether to turn on automatic UID/GID mapping. If not
|
|
|
70a90c |
+ specified the default will come from realmd.conf
|
|
|
70a90c |
+ configuration.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>computer-ou</literal>: a string
|
|
|
70a90c |
+ containing an LDAP DN for an organizational unit where the
|
|
|
70a90c |
+ computer account should be created</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>user-principal</literal>: a string
|
|
|
70a90c |
+ containing an kerberos user principal name to be set on the
|
|
|
70a90c |
+ computer account</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>membership-software</literal>: a string
|
|
|
70a90c |
+ containing the membership software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>manage-system</literal>: a boolean
|
|
|
70a90c |
+ which controls whether this machine should be managed by
|
|
|
70a90c |
+ the realm or domain or not. Defaults to true.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.configure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the join failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform a join
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
|
|
|
70a90c |
+ returned if the credentials passed did not authenticate against the realm
|
|
|
70a90c |
+ correctly. It is appropriate to prompt the user again.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
|
|
|
70a90c |
+ returned if already enrolled in this realm, or if already enrolled in another realm
|
|
|
70a90c |
+ (if enrolling in multiple realms is not supported).</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
|
|
|
70a90c |
+ returned if the machine has a hostname that is not usable for a join
|
|
|
70a90c |
+ or is in conflict with those in the domain.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Join">
|
|
|
70a90c |
+ <arg name="credentials" type="(ssv)" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Leave:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Leave the realm and unenroll the machine.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this method returns successfully, then the machine will have
|
|
|
70a90c |
+ left the domain and been unenrolled. It is not necessary to restart
|
|
|
70a90c |
+ services or the machine afterward. Relevant properties on the realm
|
|
|
70a90c |
+ will be updated before the method returns.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @credentials should be set according to one of the
|
|
|
70a90c |
+ supported credentials returned by
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
|
|
|
70a90c |
+ The first string in the tuple is the type, the second string
|
|
|
70a90c |
+ is the owner, and the variant contains the credential contents
|
|
|
70a90c |
+ See the discussion at
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
|
|
|
70a90c |
+ for more information.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the unenroll failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform an unenroll
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
|
|
|
70a90c |
+ returned if the credentials passed did not authenticate against the realm
|
|
|
70a90c |
+ correctly. It is appropriate to prompt the user again.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
|
|
|
70a90c |
+ returned if not enrolled in this realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Leave">
|
|
|
70a90c |
+ <arg name="credentials" type="(ssv)" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+</node>
|
|
|
70a90c |
diff --git a/src/daemon.c b/src/daemon.c
|
|
|
70a90c |
index c52bda3..5ce0216 100644
|
|
|
70a90c |
--- a/src/daemon.c
|
|
|
70a90c |
+++ b/src/daemon.c
|
|
|
70a90c |
@@ -20,60 +20,61 @@
|
|
|
70a90c |
* Written by: Matthias Clasen <mclasen@redhat.com>
|
|
|
70a90c |
*/
|
|
|
70a90c |
|
|
|
70a90c |
#include "config.h"
|
|
|
70a90c |
|
|
|
70a90c |
#include <stdlib.h>
|
|
|
70a90c |
#include <stdio.h>
|
|
|
70a90c |
#include <sys/types.h>
|
|
|
70a90c |
#include <sys/stat.h>
|
|
|
70a90c |
#include <fcntl.h>
|
|
|
70a90c |
#include <sys/wait.h>
|
|
|
70a90c |
#include <pwd.h>
|
|
|
70a90c |
#ifdef HAVE_SHADOW_H
|
|
|
70a90c |
#include <shadow.h>
|
|
|
70a90c |
#endif
|
|
|
70a90c |
#include <unistd.h>
|
|
|
70a90c |
#include <errno.h>
|
|
|
70a90c |
#include <sys/types.h>
|
|
|
70a90c |
|
|
|
70a90c |
#include <glib.h>
|
|
|
70a90c |
#include <glib/gi18n.h>
|
|
|
70a90c |
#include <glib-object.h>
|
|
|
70a90c |
#include <glib/gstdio.h>
|
|
|
70a90c |
#include <gio/gio.h>
|
|
|
70a90c |
#include <polkit/polkit.h>
|
|
|
70a90c |
|
|
|
70a90c |
#include "user-classify.h"
|
|
|
70a90c |
#include "wtmp-helper.h"
|
|
|
70a90c |
#include "daemon.h"
|
|
|
70a90c |
#include "util.h"
|
|
|
70a90c |
+#include "realmd-generated.h"
|
|
|
70a90c |
|
|
|
70a90c |
#define PATH_PASSWD "/etc/passwd"
|
|
|
70a90c |
#define PATH_SHADOW "/etc/shadow"
|
|
|
70a90c |
#define PATH_GROUP "/etc/group"
|
|
|
70a90c |
|
|
|
70a90c |
enum {
|
|
|
70a90c |
PROP_0,
|
|
|
70a90c |
PROP_DAEMON_VERSION
|
|
|
70a90c |
};
|
|
|
70a90c |
|
|
|
70a90c |
typedef struct {
|
|
|
70a90c |
GDBusConnection *bus_connection;
|
|
|
70a90c |
|
|
|
70a90c |
GHashTable *users;
|
|
|
70a90c |
gsize number_of_normal_users;
|
|
|
70a90c |
GList *explicitly_requested_users;
|
|
|
70a90c |
|
|
|
70a90c |
User *autologin;
|
|
|
70a90c |
|
|
|
70a90c |
GFileMonitor *passwd_monitor;
|
|
|
70a90c |
GFileMonitor *shadow_monitor;
|
|
|
70a90c |
GFileMonitor *group_monitor;
|
|
|
70a90c |
GFileMonitor *gdm_monitor;
|
|
|
70a90c |
GFileMonitor *wtmp_monitor;
|
|
|
70a90c |
|
|
|
70a90c |
GQueue *pending_list_cached_users;
|
|
|
70a90c |
|
|
|
70a90c |
guint reload_id;
|
|
|
70a90c |
guint autologin_id;
|
|
|
70a90c |
|
|
|
70a90c |
@@ -425,110 +426,167 @@ load_entries (Daemon *daemon,
|
|
|
70a90c |
} else {
|
|
|
70a90c |
g_object_ref (user);
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
/* freeze & update users not already in the new list */
|
|
|
70a90c |
g_object_freeze_notify (G_OBJECT (user));
|
|
|
70a90c |
user_update_from_pwent (user, pwent, spent);
|
|
|
70a90c |
|
|
|
70a90c |
g_hash_table_insert (users, g_strdup (user_get_user_name (user)), user);
|
|
|
70a90c |
g_debug ("loaded user: %s", user_get_user_name (user));
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
if (!explicitly_requested) {
|
|
|
70a90c |
user_set_cached (user, TRUE);
|
|
|
70a90c |
}
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
/* Generator should have cleaned up */
|
|
|
70a90c |
g_assert (generator_state == NULL);
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
static GHashTable *
|
|
|
70a90c |
create_users_hash_table (void)
|
|
|
70a90c |
{
|
|
|
70a90c |
return g_hash_table_new_full (g_str_hash,
|
|
|
70a90c |
g_str_equal,
|
|
|
70a90c |
g_free,
|
|
|
70a90c |
g_object_unref);
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
+static gboolean
|
|
|
70a90c |
+ensure_bus_connection (Daemon *daemon)
|
|
|
70a90c |
+{
|
|
|
70a90c |
+ DaemonPrivate *priv = daemon_get_instance_private (daemon);
|
|
|
70a90c |
+ g_autoptr (GError) error = NULL;
|
|
|
70a90c |
+
|
|
|
70a90c |
+ if (priv->bus_connection != NULL)
|
|
|
70a90c |
+ return TRUE;
|
|
|
70a90c |
+
|
|
|
70a90c |
+ priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
|
|
|
70a90c |
+ if (priv->bus_connection == NULL) {
|
|
|
70a90c |
+ if (error != NULL)
|
|
|
70a90c |
+ g_critical ("error getting system bus: %s", error->message);
|
|
|
70a90c |
+ return FALSE;
|
|
|
70a90c |
+ }
|
|
|
70a90c |
+
|
|
|
70a90c |
+ return TRUE;
|
|
|
70a90c |
+}
|
|
|
70a90c |
+
|
|
|
70a90c |
+static gboolean
|
|
|
70a90c |
+has_network_realms (Daemon *daemon)
|
|
|
70a90c |
+{
|
|
|
70a90c |
+ DaemonPrivate *priv = daemon_get_instance_private (daemon);
|
|
|
70a90c |
+ g_autoptr (AccountsRealmdProvider) realmd_provider = NULL;
|
|
|
70a90c |
+ g_autoptr (GError) error = NULL;
|
|
|
70a90c |
+ const char *const *realms = NULL;
|
|
|
70a90c |
+
|
|
|
70a90c |
+ if (!ensure_bus_connection (daemon)) {
|
|
|
70a90c |
+ return FALSE;
|
|
|
70a90c |
+ }
|
|
|
70a90c |
+
|
|
|
70a90c |
+ realmd_provider = accounts_realmd_provider_proxy_new_sync (priv->bus_connection,
|
|
|
70a90c |
+ G_DBUS_PROXY_FLAGS_NONE,
|
|
|
70a90c |
+ "org.freedesktop.realmd",
|
|
|
70a90c |
+ "/org/freedesktop/realmd",
|
|
|
70a90c |
+ NULL,
|
|
|
70a90c |
+ &error);
|
|
|
70a90c |
+ if (realmd_provider == NULL) {
|
|
|
70a90c |
+ g_debug ("failed to contact realmd: %s", error->message);
|
|
|
70a90c |
+ return FALSE;
|
|
|
70a90c |
+ }
|
|
|
70a90c |
+
|
|
|
70a90c |
+ realms = accounts_realmd_provider_get_realms (realmd_provider);
|
|
|
70a90c |
+
|
|
|
70a90c |
+ if (!realms) {
|
|
|
70a90c |
+ g_debug("realmd provider 'Realms' property is unset");
|
|
|
70a90c |
+ return FALSE;
|
|
|
70a90c |
+ }
|
|
|
70a90c |
+
|
|
|
70a90c |
+ return realms[0] != NULL;
|
|
|
70a90c |
+}
|
|
|
70a90c |
+
|
|
|
70a90c |
static void
|
|
|
70a90c |
reload_users (Daemon *daemon)
|
|
|
70a90c |
{
|
|
|
70a90c |
DaemonPrivate *priv = daemon_get_instance_private (daemon);
|
|
|
70a90c |
AccountsAccounts *accounts = ACCOUNTS_ACCOUNTS (daemon);
|
|
|
70a90c |
gboolean had_no_users, has_no_users, had_multiple_users, has_multiple_users;
|
|
|
70a90c |
GHashTable *users;
|
|
|
70a90c |
GHashTable *old_users;
|
|
|
70a90c |
GHashTable *local;
|
|
|
70a90c |
GHashTableIter iter;
|
|
|
70a90c |
gsize number_of_normal_users = 0;
|
|
|
70a90c |
gpointer name, value;
|
|
|
70a90c |
|
|
|
70a90c |
/* Track the users that we saw during our (re)load */
|
|
|
70a90c |
users = create_users_hash_table ();
|
|
|
70a90c |
|
|
|
70a90c |
/*
|
|
|
70a90c |
* NOTE: As we load data from all the sources, notifies are
|
|
|
70a90c |
* frozen in load_entries() and then thawed as we process
|
|
|
70a90c |
* them below.
|
|
|
70a90c |
*/
|
|
|
70a90c |
|
|
|
70a90c |
/* Load the local users into our hash table */
|
|
|
70a90c |
load_entries (daemon, users, FALSE, entry_generator_fgetpwent);
|
|
|
70a90c |
local = g_hash_table_new (g_str_hash, g_str_equal);
|
|
|
70a90c |
g_hash_table_iter_init (&iter, users);
|
|
|
70a90c |
while (g_hash_table_iter_next (&iter, &name, NULL))
|
|
|
70a90c |
g_hash_table_add (local, name);
|
|
|
70a90c |
|
|
|
70a90c |
/* and add users to hash table that were explicitly requested */
|
|
|
70a90c |
load_entries (daemon, users, TRUE, entry_generator_requested_users);
|
|
|
70a90c |
|
|
|
70a90c |
/* Now add/update users from other sources, possibly non-local */
|
|
|
70a90c |
load_entries (daemon, users, FALSE, entry_generator_cachedir);
|
|
|
70a90c |
|
|
|
70a90c |
wtmp_helper_update_login_frequencies (users);
|
|
|
70a90c |
|
|
|
70a90c |
/* Count the non-system users. Mark which users are local, which are not. */
|
|
|
70a90c |
g_hash_table_iter_init (&iter, users);
|
|
|
70a90c |
while (g_hash_table_iter_next (&iter, &name, &value)) {
|
|
|
70a90c |
User *user = value;
|
|
|
70a90c |
if (!user_get_system_account (user))
|
|
|
70a90c |
number_of_normal_users++;
|
|
|
70a90c |
user_update_local_account_property (user, g_hash_table_lookup (local, name) != NULL);
|
|
|
70a90c |
}
|
|
|
70a90c |
g_hash_table_destroy (local);
|
|
|
70a90c |
|
|
|
70a90c |
had_no_users = accounts_accounts_get_has_no_users (accounts);
|
|
|
70a90c |
has_no_users = number_of_normal_users == 0;
|
|
|
70a90c |
|
|
|
70a90c |
+ if (has_no_users && has_network_realms (daemon)) {
|
|
|
70a90c |
+ g_debug ("No local users, but network realms detected, presuming there are remote users");
|
|
|
70a90c |
+ has_no_users = FALSE;
|
|
|
70a90c |
+ }
|
|
|
70a90c |
+
|
|
|
70a90c |
if (had_no_users != has_no_users)
|
|
|
70a90c |
accounts_accounts_set_has_no_users (accounts, has_no_users);
|
|
|
70a90c |
|
|
|
70a90c |
had_multiple_users = accounts_accounts_get_has_multiple_users (accounts);
|
|
|
70a90c |
has_multiple_users = number_of_normal_users > 1;
|
|
|
70a90c |
|
|
|
70a90c |
if (had_multiple_users != has_multiple_users)
|
|
|
70a90c |
accounts_accounts_set_has_multiple_users (accounts, has_multiple_users);
|
|
|
70a90c |
|
|
|
70a90c |
/* Swap out the users */
|
|
|
70a90c |
old_users = priv->users;
|
|
|
70a90c |
priv->users = users;
|
|
|
70a90c |
|
|
|
70a90c |
/* Remove all the old users */
|
|
|
70a90c |
g_hash_table_iter_init (&iter, old_users);
|
|
|
70a90c |
while (g_hash_table_iter_next (&iter, &name, &value)) {
|
|
|
70a90c |
User *user = value;
|
|
|
70a90c |
User *refreshed_user;
|
|
|
70a90c |
|
|
|
70a90c |
refreshed_user = g_hash_table_lookup (users, name);
|
|
|
70a90c |
|
|
|
70a90c |
if (!refreshed_user || (user_get_cached (user) && !user_get_cached (refreshed_user))) {
|
|
|
70a90c |
accounts_accounts_emit_user_deleted (ACCOUNTS_ACCOUNTS (daemon),
|
|
|
70a90c |
user_get_object_path (user));
|
|
|
70a90c |
user_unregister (user);
|
|
|
70a90c |
}
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
/* Register all the new users */
|
|
|
70a90c |
g_hash_table_iter_init (&iter, users);
|
|
|
70a90c |
@@ -766,64 +824,61 @@ daemon_finalize (GObject *object)
|
|
|
70a90c |
priv = daemon_get_instance_private (daemon);
|
|
|
70a90c |
|
|
|
70a90c |
if (priv->bus_connection != NULL)
|
|
|
70a90c |
g_object_unref (priv->bus_connection);
|
|
|
70a90c |
|
|
|
70a90c |
g_queue_free_full (priv->pending_list_cached_users,
|
|
|
70a90c |
(GDestroyNotify) list_user_data_free);
|
|
|
70a90c |
|
|
|
70a90c |
g_list_free_full (priv->explicitly_requested_users, g_free);
|
|
|
70a90c |
|
|
|
70a90c |
g_hash_table_destroy (priv->users);
|
|
|
70a90c |
|
|
|
70a90c |
g_hash_table_unref (priv->extension_ifaces);
|
|
|
70a90c |
|
|
|
70a90c |
G_OBJECT_CLASS (daemon_parent_class)->finalize (object);
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
static gboolean
|
|
|
70a90c |
register_accounts_daemon (Daemon *daemon)
|
|
|
70a90c |
{
|
|
|
70a90c |
DaemonPrivate *priv = daemon_get_instance_private (daemon);
|
|
|
70a90c |
g_autoptr(GError) error = NULL;
|
|
|
70a90c |
|
|
|
70a90c |
priv->authority = polkit_authority_get_sync (NULL, &error);
|
|
|
70a90c |
if (priv->authority == NULL) {
|
|
|
70a90c |
if (error != NULL)
|
|
|
70a90c |
g_critical ("error getting polkit authority: %s", error->message);
|
|
|
70a90c |
return FALSE;
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
- priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
|
|
|
70a90c |
- if (priv->bus_connection == NULL) {
|
|
|
70a90c |
- if (error != NULL)
|
|
|
70a90c |
- g_critical ("error getting system bus: %s", error->message);
|
|
|
70a90c |
+ if (!ensure_bus_connection (daemon)) {
|
|
|
70a90c |
return FALSE;
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
if (!g_dbus_interface_skeleton_export (G_DBUS_INTERFACE_SKELETON (daemon),
|
|
|
70a90c |
priv->bus_connection,
|
|
|
70a90c |
"/org/freedesktop/Accounts",
|
|
|
70a90c |
&error)) {
|
|
|
70a90c |
if (error != NULL)
|
|
|
70a90c |
g_critical ("error exporting interface: %s", error->message);
|
|
|
70a90c |
return FALSE;
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
return TRUE;
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
Daemon *
|
|
|
70a90c |
daemon_new (void)
|
|
|
70a90c |
{
|
|
|
70a90c |
g_autoptr(Daemon) daemon = NULL;
|
|
|
70a90c |
|
|
|
70a90c |
daemon = DAEMON (g_object_new (TYPE_DAEMON, NULL));
|
|
|
70a90c |
|
|
|
70a90c |
if (!register_accounts_daemon (DAEMON (daemon))) {
|
|
|
70a90c |
return NULL;
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
return g_steal_pointer (&daemon);
|
|
|
70a90c |
}
|
|
|
70a90c |
|
|
|
70a90c |
static void
|
|
|
70a90c |
diff --git a/src/meson.build b/src/meson.build
|
|
|
70a90c |
index 20d5276..3970749 100644
|
|
|
70a90c |
--- a/src/meson.build
|
|
|
70a90c |
+++ b/src/meson.build
|
|
|
70a90c |
@@ -1,37 +1,38 @@
|
|
|
70a90c |
sources = []
|
|
|
70a90c |
|
|
|
70a90c |
gdbus_headers = []
|
|
|
70a90c |
|
|
|
70a90c |
ifaces = [
|
|
|
70a90c |
['accounts-generated', 'org.freedesktop.', 'Accounts'],
|
|
|
70a90c |
['accounts-user-generated', act_namespace + '.', 'User'],
|
|
|
70a90c |
+ ['realmd-generated', 'org.freedesktop.', 'realmd'],
|
|
|
70a90c |
]
|
|
|
70a90c |
|
|
|
70a90c |
foreach iface: ifaces
|
|
|
70a90c |
gdbus_sources = gnome.gdbus_codegen(
|
|
|
70a90c |
iface[0],
|
|
|
70a90c |
join_paths(data_dir, iface[1] + iface[2] + '.xml'),
|
|
|
70a90c |
interface_prefix: iface[1],
|
|
|
70a90c |
namespace: 'Accounts',
|
|
|
70a90c |
)
|
|
|
70a90c |
sources += gdbus_sources
|
|
|
70a90c |
gdbus_headers += gdbus_sources[1]
|
|
|
70a90c |
endforeach
|
|
|
70a90c |
|
|
|
70a90c |
deps = [
|
|
|
70a90c |
gio_dep,
|
|
|
70a90c |
gio_unix_dep,
|
|
|
70a90c |
]
|
|
|
70a90c |
|
|
|
70a90c |
cflags = [
|
|
|
70a90c |
'-DLOCALSTATEDIR="@0@"'.format(act_localstatedir),
|
|
|
70a90c |
'-DDATADIR="@0@"'.format(act_datadir),
|
|
|
70a90c |
'-DICONDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'icons')),
|
|
|
70a90c |
'-DUSERDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'users')),
|
|
|
70a90c |
]
|
|
|
70a90c |
|
|
|
70a90c |
libaccounts_generated = static_library(
|
|
|
70a90c |
'accounts-generated',
|
|
|
70a90c |
sources: sources,
|
|
|
70a90c |
include_directories: top_inc,
|
|
|
70a90c |
dependencies: deps,
|
|
|
70a90c |
diff --git a/src/org.freedesktop.realmd.xml b/src/org.freedesktop.realmd.xml
|
|
|
70a90c |
new file mode 100644
|
|
|
70a90c |
index 0000000..c34a47a
|
|
|
70a90c |
--- /dev/null
|
|
|
70a90c |
+++ b/src/org.freedesktop.realmd.xml
|
|
|
70a90c |
@@ -0,0 +1,730 @@
|
|
|
70a90c |
+
|
|
|
70a90c |
+ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
|
|
|
70a90c |
+<node name="/">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Provider:
|
|
|
70a90c |
+ @short_description: a realm provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various realm providers represent different software implementations
|
|
|
70a90c |
+ that provide access to realms or domains.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This interface is implemented by individual providers, but is
|
|
|
70a90c |
+ aggregated globally at the system bus name
|
|
|
70a90c |
+ <literal>org.freedesktop.realmd</literal>
|
|
|
70a90c |
+ with the object path <literal>/org/freedesktop/realmd</literal>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Provider">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Name: the name of the provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The name of the provider. This is not normally displayed
|
|
|
70a90c |
+ to the user, but may be useful for diagnostics or debugging.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Name" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Version: the version of the provider
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The version of the provider. This is not normally used in
|
|
|
70a90c |
+ logic, but may be useful for diagnostics or debugging.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Version" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Realms: a list of realms
|
|
|
70a90c |
+
|
|
|
70a90c |
+ A list of known, enrolled or discovered realms. All realms
|
|
|
70a90c |
+ that this provider knows about are listed here. As realms
|
|
|
70a90c |
+ are discovered they are added to this list.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Each realm is represented by the DBus object path of the
|
|
|
70a90c |
+ realm object.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Realms" type="ao" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Discover:
|
|
|
70a90c |
+ @string: an input string to discover realms for
|
|
|
70a90c |
+ @options: options for the discovery operation
|
|
|
70a90c |
+ @relevance: the relevance of the returned results
|
|
|
70a90c |
+ @realm: a list of realms discovered
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Discover realms for the given string. The input @string is
|
|
|
70a90c |
+ usually a domain or realm name, perhaps typed by a user. If
|
|
|
70a90c |
+ an empty string is provided, the realm provider should try to
|
|
|
70a90c |
+ discover a default realm, if possible (e.g. from DHCP).
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>client-software</literal>: a string
|
|
|
70a90c |
+ containing the client software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>server-software</literal>: a string
|
|
|
70a90c |
+ containing the client software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>membership-software</literal>: a string
|
|
|
70a90c |
+ containing the membership software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @relevance returned can be used to rank results from
|
|
|
70a90c |
+ different discover calls to different providers. Implementors
|
|
|
70a90c |
+ should return a positive number if the provider highly
|
|
|
70a90c |
+ recommends that the realms be handled by this provider,
|
|
|
70a90c |
+ or a zero if it can possibly handle the realms. Negative numbers
|
|
|
70a90c |
+ should be returned if no realms are found.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method does not return an error when no realms are
|
|
|
70a90c |
+ discovered. It simply returns an empty @realm list.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To see diagnostic information about the discovery process,
|
|
|
70a90c |
+ connect to the org.freedesktop.realmd.Service::Diagnostics
|
|
|
70a90c |
+ signal.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.discover-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may
|
|
|
70a90c |
+ return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the discovery could not be run for some reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform a discovery
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Discover">
|
|
|
70a90c |
+ <arg name="string" type="s" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ <arg name="relevance" type="i" direction="out"/>
|
|
|
70a90c |
+ <arg name="realm" type="ao" direction="out"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Service:
|
|
|
70a90c |
+ @short_description: the realmd service
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Global calls for managing the realmd service. Usually you'll want
|
|
|
70a90c |
+ to use #org.freedesktop.realmd.Provider instead.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This interface is implemented by the realmd service, and is always
|
|
|
70a90c |
+ available at the object path <literal>/org/freedesktop/realmd</literal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The service also implements the
|
|
|
70a90c |
+ <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
|
|
|
70a90c |
+ makes it easy to retrieve all realmd objects and properties in one go.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Service">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Cancel:
|
|
|
70a90c |
+ @operation: the operation to cancel
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Cancel a realmd operation. To be able to cancel an operation,
|
|
|
70a90c |
+ pass a uniquely chosen <literal>operation</literal> string
|
|
|
70a90c |
+ identifier as an option in the method's <literal>options</literal>
|
|
|
70a90c |
+ argument.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ These operation string identifiers should be unique per client
|
|
|
70a90c |
+ calling the realmd service.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It is not guaranteed that the service can or will cancel the
|
|
|
70a90c |
+ operation. For example, the operation may have already completed
|
|
|
70a90c |
+ by the time this method is handled. The caller of the operation
|
|
|
70a90c |
+ method will receive a
|
|
|
70a90c |
+ <literal>org.freedesktop.realmd.Error.Cancelled</literal>
|
|
|
70a90c |
+ if the operation was cancelled.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Cancel">
|
|
|
70a90c |
+ <arg name="operation" type="s" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SetLocale:
|
|
|
70a90c |
+ @locale: the locale for the client
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Set the language @locale for the client. This locale is used
|
|
|
70a90c |
+ for error messages. The locale is used until the next time
|
|
|
70a90c |
+ this method is called, the client disconnects, or the client
|
|
|
70a90c |
+ calls #org.freedesktop.realmd.Service.Release().
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="SetLocale">
|
|
|
70a90c |
+ <arg name="locale" type="s" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Diagnostics:
|
|
|
70a90c |
+ @data: diagnostic data
|
|
|
70a90c |
+ @operation: the operation this data resulted from
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This signal is fired when diagnostics result from an operation
|
|
|
70a90c |
+ in the provider or one of its realms.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It is not guaranteed that this signal is emitted once per line.
|
|
|
70a90c |
+ More than one line may be contained in @data, or a partial
|
|
|
70a90c |
+ line. New line characters are embedded in @data.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This signal is sent explicitly to the client which invoked an
|
|
|
70a90c |
+ operation method. In order to tell which operation this
|
|
|
70a90c |
+ diagnostic data results from, pass a unique
|
|
|
70a90c |
+ <literal>operation</literal> string identifier in the
|
|
|
70a90c |
+ <literal>options</literal> argument of the operation method.
|
|
|
70a90c |
+ That same identifier will be passed back via the @operation
|
|
|
70a90c |
+ argument of this signal.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <signal name="Diagnostics">
|
|
|
70a90c |
+ <arg name="data" type="s"/>
|
|
|
70a90c |
+ <arg name="operation" type="s"/>
|
|
|
70a90c |
+ </signal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Release:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Normally, realmd waits until all clients have disconnected
|
|
|
70a90c |
+ before exiting itself sometime later. Long lived clients
|
|
|
70a90c |
+ can call this method to allow the realmd service to quit.
|
|
|
70a90c |
+ This is an optimization. The daemon will not exit immediately.
|
|
|
70a90c |
+ It is safe to call this multiple times.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Release">
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Realm:
|
|
|
70a90c |
+ @short_description: a realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Represents one realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Contains generic information about a realm, and useful properties for
|
|
|
70a90c |
+ introspecting what kind of realm this is and how to work with
|
|
|
70a90c |
+ the realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Use #org.freedesktop.realmd.Provider:Realms or
|
|
|
70a90c |
+ #org.freedesktop.realmd.Provider.Discover() to get access to some
|
|
|
70a90c |
+ kerberos realm objects.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Realms will always implement additional interfaces, such as
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos. Do not assume that all realms
|
|
|
70a90c |
+ implement that kerberos interface. Use the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
|
|
|
70a90c |
+ which interfaces are supported.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Different realms support various ways to configure them on the
|
|
|
70a90c |
+ system. Use the #org.freedesktop.realmd.Realm:Configured property
|
|
|
70a90c |
+ to determine if a realm is configured. If it is configured, the
|
|
|
70a90c |
+ property will be set to the interface of the mechanism that was
|
|
|
70a90c |
+ used to configure it.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To configure a realm, look in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
|
|
|
70a90c |
+ recognized purpose-specific interface that can be used for
|
|
|
70a90c |
+ configuration, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership interface and its
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Join() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ To deconfigure a realm from the current system, you can use the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
|
|
|
70a90c |
+ of the configuration specific interfaces provide methods to
|
|
|
70a90c |
+ deconfigure a realm in a specific way, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various properties are guaranteed to have been updated before
|
|
|
70a90c |
+ the operation methods return, if they change state.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Realm">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Name: the realm name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This is the name of the realm, appropriate for display to
|
|
|
70a90c |
+ end users where necessary.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Name" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Configured: whether this domain is configured and how
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this property is an empty string, then the realm is not
|
|
|
70a90c |
+ configured. Otherwise the realm is configured, and contains
|
|
|
70a90c |
+ a string which is the interface that represents how it was
|
|
|
70a90c |
+ configured, for example #org.freedesktop.realmd.KerberosMembership.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Configured" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Deconfigure: deconfigure this realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Deconfigure this realm from the local machine with standard
|
|
|
70a90c |
+ default behavior.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The behavior of this method depends on the which configuration
|
|
|
70a90c |
+ interface is present in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.Configured property. It does not
|
|
|
70a90c |
+ always delete membership accounts in the realm, but just
|
|
|
70a90c |
+ reconfigures the local machine so it no longer is configured
|
|
|
70a90c |
+ for the given realm. In some cases the implementation may try
|
|
|
70a90c |
+ to update membership accounts, but this is not guaranteed.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various configuration interfaces may support more specific ways
|
|
|
70a90c |
+ to deconfigure a realm in a specific way, such as the
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the deconfigure failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to deconfigure a
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
|
|
|
70a90c |
+ returned if this realm is not configured on the machine.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Deconfigure">
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedInterfaces:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Additional supported interfaces of this realm. This includes
|
|
|
70a90c |
+ interfaces that contain more information about the realm,
|
|
|
70a90c |
+ such as #org.freedesktop.realmd.Kerberos and interfaces
|
|
|
70a90c |
+ which contain methods for configuring a realm, such as
|
|
|
70a90c |
+ #org.freedesktop.realmd.KerberosMembership.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedInterfaces" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Details: informational details about the realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Informational details about the realm. The following values
|
|
|
70a90c |
+ should be present:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>server-software</literal>:
|
|
|
70a90c |
+ identifier of the software running on the server (e.g.
|
|
|
70a90c |
+ <literal>active-directory</literal>).</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>client-software</literal>:
|
|
|
70a90c |
+ identifier of the software running on the client (e.g.
|
|
|
70a90c |
+ <literal>sssd</literal>).</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="Details" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ RequiredPackages: prerequisite software
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Software packages that are required in order for a join to
|
|
|
70a90c |
+ succeed. These are either simple strings like <literal>sssd</literal>,
|
|
|
70a90c |
+ or strings with an operator and version number like
|
|
|
70a90c |
+ <literal>sssd >= 1.9.0</literal>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ These values are specific to the packaging system that is
|
|
|
70a90c |
+ being run.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="RequiredPackages" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ LoginFormats: supported formats for login names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Supported formats for login to this realm. This is only
|
|
|
70a90c |
+ relevant once the realm has been enrolled. The formats
|
|
|
70a90c |
+ will contain a <literal>%U</literal> in the string, which
|
|
|
70a90c |
+ indicate where the user name should be placed. The formats
|
|
|
70a90c |
+ may contain a <literal>%D</literal> in the string which
|
|
|
70a90c |
+ indicate where a domain name should be placed.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The first format in the list is the preferred format for
|
|
|
70a90c |
+ login names.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="LoginFormats" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ LoginPolicy: the policy for logins using this realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The policy for logging into this computer using this realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The policy can be changed using the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The following policies are predefined. Not all providers
|
|
|
70a90c |
+ support all these policies and there may be provider specific
|
|
|
70a90c |
+ policies or multiple policies represented in the string:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>allow-any-login</literal>: allow
|
|
|
70a90c |
+ login by any authenticated user present in this
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>allow-realm-logins</literal>: allow
|
|
|
70a90c |
+ logins according to the realm or domain policy for logins
|
|
|
70a90c |
+ on this machine. This usually defaults to allowing any realm
|
|
|
70a90c |
+ user to log in.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>allow-permitted-logins</literal>:
|
|
|
70a90c |
+ only allow the logins permitted in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:PermittedLogins
|
|
|
70a90c |
+ property.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>deny-any-login</literal>:
|
|
|
70a90c |
+ don't allow any logins via authenticated users of this
|
|
|
70a90c |
+ realm.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="LoginPolicy" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ PermittedLogins: the permitted login names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The list of permitted authenticated users allowed to login
|
|
|
70a90c |
+ into this computer. This is only relevant if the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property
|
|
|
70a90c |
+ contains the <literal>allow-permitted-logins</literal>
|
|
|
70a90c |
+ string.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="PermittedLogins" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ PermittedGroups: the permitted group names
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The list of groups which users need to be in to be allowed
|
|
|
70a90c |
+ to log into this computer. This is only relevant if the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property
|
|
|
70a90c |
+ contains the <literal>allow-permitted-logins</literal>
|
|
|
70a90c |
+ string.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="PermittedGroups" type="as" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ ChangeLoginPolicy:
|
|
|
70a90c |
+ @login_policy: the new login policy, or an empty string
|
|
|
70a90c |
+ @permitted_add: a list of logins to permit
|
|
|
70a90c |
+ @permitted_remove: a list of logins to not permit
|
|
|
70a90c |
+ @options: options for this operation
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Change the login policy and/or permitted logins for this realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Not all realms support all the various login policies. An
|
|
|
70a90c |
+ error will be returned if the new login policy is not supported.
|
|
|
70a90c |
+ You may specify an empty string for the @login_policy argument
|
|
|
70a90c |
+ which will cause no change in the policy itself. If the policy
|
|
|
70a90c |
+ is changed, it will be reflected in the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Realm:LoginPolicy property.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @permitted_add and @permitted_remove arguments represent
|
|
|
70a90c |
+ lists of login names that should be added and removed from
|
|
|
70a90c |
+ the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>groups</literal>: boolean which if
|
|
|
70a90c |
+ set to <literal>TRUE</literal> means that the names in
|
|
|
70a90c |
+ @permitted_add and @permitted_remove are group names instead
|
|
|
70a90c |
+ of login names.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.login-policy</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the policy change failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to change login policy
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
|
|
|
70a90c |
+ returned if the realm is not configured.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="ChangeLoginPolicy">
|
|
|
70a90c |
+ <arg name="login_policy" type="s" direction="in"/>
|
|
|
70a90c |
+ <arg name="permitted_add" type="as" direction="in"/>
|
|
|
70a90c |
+ <arg name="permitted_remove" type="as" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.Kerberos:
|
|
|
70a90c |
+ @short_description: a kerberos realm
|
|
|
70a90c |
+
|
|
|
70a90c |
+ An interface that describes a kerberos realm in more detail. This
|
|
|
70a90c |
+ is always implemented on an DBus object path that also implements
|
|
|
70a90c |
+ the #org.freedesktop.realmd.Realm interface.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.Kerberos">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ RealmName: the kerberos realm name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The kerberos name for this realm. This is usually in upper
|
|
|
70a90c |
+ case.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="RealmName" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ DomainName: the DNS domain name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The DNS domain name for this realm.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="DomainName" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ org.freedesktop.realmd.KerberosMembership:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ An interface used to configure this machine by joining a realm.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ It sets up a computer/host account in the realm for this machine
|
|
|
70a90c |
+ and a keytab to track the credentials for that account.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various properties are guaranteed to have been updated before
|
|
|
70a90c |
+ the operation methods return, if they change state.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <interface name="org.freedesktop.realmd.KerberosMembership">
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SuggestedAdministrator: common administrator name
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The common administrator name for this type of realm. This
|
|
|
70a90c |
+ can be used by clients as a hint when prompting the user for
|
|
|
70a90c |
+ administrative authentication.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SuggestedAdministrator" type="s" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedJoinCredentials: credentials supported for joining
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various kinds of credentials that are supported when calling the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos.Join() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Each credential is represented by a type and an owner. The type
|
|
|
70a90c |
+ denotes which kind of credential is passed to the method. The
|
|
|
70a90c |
+ owner indicates to the client how to prompt the user or obtain
|
|
|
70a90c |
+ the credential, and to the service how to use the credential.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various types are:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>ccache</literal>:
|
|
|
70a90c |
+ the credentials should contain an array of bytes as a
|
|
|
70a90c |
+ <literal>ay</literal> containing the data from a kerberos
|
|
|
70a90c |
+ credential cache file.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>password</literal>:
|
|
|
70a90c |
+ the credentials should contain a pair of strings as a
|
|
|
70a90c |
+ <literal>(ss)</literal> representing a name and
|
|
|
70a90c |
+ password. The name may contain a realm in the standard
|
|
|
70a90c |
+ kerberos format. If a realm is missing, it will default
|
|
|
70a90c |
+ to this realm. </para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>secret</literal>:
|
|
|
70a90c |
+ the credentials should contain a string secret as an
|
|
|
70a90c |
+ <literal>ay</literal> array of bytes. This is usually used
|
|
|
70a90c |
+ for one time passwords. To pass a string here, encode it
|
|
|
70a90c |
+ in UTF-8, and place the resulting bytes in the
|
|
|
70a90c |
+ value.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>automatic</literal>:
|
|
|
70a90c |
+ the credentials should contain an empty string as a
|
|
|
70a90c |
+ <literal>s</literal>. Using <literal>automatic</literal>
|
|
|
70a90c |
+ indicates that default or system credentials are to be
|
|
|
70a90c |
+ used.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The various owners are:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>administrator</literal>:
|
|
|
70a90c |
+ the credentials belong to a kerberos administrator principal.
|
|
|
70a90c |
+ The caller may use this as a hint to prompt the user
|
|
|
70a90c |
+ for administrative credentials.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>user</literal>:
|
|
|
70a90c |
+ the credentials belong to a kerberos user principal.
|
|
|
70a90c |
+ The caller may use this as a hint to prompt the user
|
|
|
70a90c |
+ for his (possibly non-administrative)
|
|
|
70a90c |
+ credentials.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>computer</literal>:
|
|
|
70a90c |
+ the credentials belong to a computer account.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>none</literal>:
|
|
|
70a90c |
+ the credentials have an unspecified owner, such as a one
|
|
|
70a90c |
+ time password.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ SupportedLeaveCredentials: credentials supported for leaving
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Various kinds of credentials that are supported when calling the
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos.Leave() method.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
|
|
|
70a90c |
+ a discussion of what the values represent.
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Join:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Join this machine to the realm and enroll the machine.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this method returns successfully, then the machine will be
|
|
|
70a90c |
+ joined to the realm. It is not necessary to restart services or the
|
|
|
70a90c |
+ machine afterward. Relevant properties on the realm will be updated
|
|
|
70a90c |
+ before the method returns.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @credentials should be set according to one of the
|
|
|
70a90c |
+ supported credentials returned by
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
|
|
|
70a90c |
+ The first string in the tuple is the type, the second string
|
|
|
70a90c |
+ is the owner, and the variant contains the credential contents
|
|
|
70a90c |
+ See the discussion at
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
|
|
|
70a90c |
+ for more information.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>automatic-id-mapping</literal>: a boolean
|
|
|
70a90c |
+ value whether to turn on automatic UID/GID mapping. If not
|
|
|
70a90c |
+ specified the default will come from realmd.conf
|
|
|
70a90c |
+ configuration.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>computer-ou</literal>: a string
|
|
|
70a90c |
+ containing an LDAP DN for an organizational unit where the
|
|
|
70a90c |
+ computer account should be created</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>user-principal</literal>: a string
|
|
|
70a90c |
+ containing an kerberos user principal name to be set on the
|
|
|
70a90c |
+ computer account</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>membership-software</literal>: a string
|
|
|
70a90c |
+ containing the membership software identifier that the returned
|
|
|
70a90c |
+ realms should match.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>manage-system</literal>: a boolean
|
|
|
70a90c |
+ which controls whether this machine should be managed by
|
|
|
70a90c |
+ the realm or domain or not. Defaults to true.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.configure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the join failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform a join
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
|
|
|
70a90c |
+ returned if the credentials passed did not authenticate against the realm
|
|
|
70a90c |
+ correctly. It is appropriate to prompt the user again.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
|
|
|
70a90c |
+ returned if already enrolled in this realm, or if already enrolled in another realm
|
|
|
70a90c |
+ (if enrolling in multiple realms is not supported).</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
|
|
|
70a90c |
+ returned if the machine has a hostname that is not usable for a join
|
|
|
70a90c |
+ or is in conflict with those in the domain.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Join">
|
|
|
70a90c |
+ <arg name="credentials" type="(ssv)" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Leave:
|
|
|
70a90c |
+
|
|
|
70a90c |
+ Leave the realm and unenroll the machine.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ If this method returns successfully, then the machine will have
|
|
|
70a90c |
+ left the domain and been unenrolled. It is not necessary to restart
|
|
|
70a90c |
+ services or the machine afterward. Relevant properties on the realm
|
|
|
70a90c |
+ will be updated before the method returns.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ The @credentials should be set according to one of the
|
|
|
70a90c |
+ supported credentials returned by
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
|
|
|
70a90c |
+ The first string in the tuple is the type, the second string
|
|
|
70a90c |
+ is the owner, and the variant contains the credential contents
|
|
|
70a90c |
+ See the discussion at
|
|
|
70a90c |
+ #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
|
|
|
70a90c |
+ for more information.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ @options can contain, but is not limited to, the following values:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>operation</literal>: a string
|
|
|
70a90c |
+ identifier chosen by the client, which can then later be
|
|
|
70a90c |
+ passed to org.freedesktop.realmd.Service.Cancel() in order
|
|
|
70a90c |
+ to cancel the operation</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ This method requires authorization for the PolicyKit action
|
|
|
70a90c |
+ called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
|
|
|
70a90c |
+
|
|
|
70a90c |
+ In addition to common DBus error results, this method may return:
|
|
|
70a90c |
+ <itemizedlist>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
|
|
|
70a90c |
+ may be returned if the unenroll failed for a generic reason.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
|
|
|
70a90c |
+ returned if the operation was cancelled.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
|
|
|
70a90c |
+ returned if the calling client is not permitted to perform an unenroll
|
|
|
70a90c |
+ operation.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
|
|
|
70a90c |
+ returned if the credentials passed did not authenticate against the realm
|
|
|
70a90c |
+ correctly. It is appropriate to prompt the user again.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
|
|
|
70a90c |
+ returned if not enrolled in this realm.</para></listitem>
|
|
|
70a90c |
+ <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
|
|
|
70a90c |
+ returned if the service is currently performing another operation like
|
|
|
70a90c |
+ join or leave.</para></listitem>
|
|
|
70a90c |
+ </itemizedlist>
|
|
|
70a90c |
+ -->
|
|
|
70a90c |
+ <method name="Leave">
|
|
|
70a90c |
+ <arg name="credentials" type="(ssv)" direction="in"/>
|
|
|
70a90c |
+ <arg name="options" type="a{sv}" direction="in"/>
|
|
|
70a90c |
+ </method>
|
|
|
70a90c |
+
|
|
|
70a90c |
+ </interface>
|
|
|
70a90c |
+
|
|
|
70a90c |
+</node>
|
|
|
70a90c |
--
|
|
|
70a90c |
2.27.0
|
|
|
70a90c |
|