summaryrefslogtreecommitdiffstats
path: root/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix a free before use bug, it may lead to crashes but usually just corruptsrelease-1-2-0Simo Sorce2008-11-141-3/+2
| | | | | | the changepw dn we store so that it won't match. This causes normal password changes to be interpreted as password resets instead, and the new legit password is immediately expired.
* Make the list of users that can skip passwrod policies configurable.Simo Sorce2008-11-121-48/+105
| | | | | | | | | | | Addresses bz#471130 Also fix bugs in ipapwd_start. Also remove mutex, it is not necessary with the current code, we needed it when we used to change reload the configuration and keep it referenced in a static pointer. ipapwd_start runs only once and the global variables it sets are fixed in stone until DS is restarted.
* Retrieve the kerberos configuration every time a new, it will be a bit slowerSimo Sorce2008-09-101-252/+234
| | | | | but will allow for changing configurations without having to restart DS. Password operations are slow and rare enough this is an acceptable compromise.
* Fix segfault cause by empty target entrySimo Sorce2008-08-191-3/+22
|
* Comment out code that generates keys with a random salt, apparently this ↵Simo Sorce2008-08-151-0/+4
| | | | does not work as expected and generates faulty keys
* Implement password operation checks and key material generation for theSimo Sorce2008-08-121-93/+1018
| | | | | | | | | | | ldap add and modify operation performed on the userPassword attribute. Add helper functions to reduce code duplication. Do not enforce encrypted connections on ldap add/ldap mod for compatibility reasons. (We cannot enforce people not to send the password in the clear anyway, we can only refuse to accept it at the most which does not gain you much if someone then re-send you the same password previously exposed)
* Treat Jan 1 1970 in krbPrincipalExpiration as a special date that meansSimo Sorce2008-08-071-4/+5
| | | | the account Never Expires
* Fix a stupidty introduced recently in a fix to a segfault.Simo Sorce2008-07-241-3/+5
|
* If krbPasswordExpiration or krbLastPwdChange are not present on the entrySimo Sorce2008-07-071-11/+21
| | | | | we might segfault trying a direct strcmp(), check they are not NULL. Also fix a couple of memleaks.
* Fix some small issues that caused compiler warnings, like uninitialized or ↵Martin Nagy2008-06-301-0/+3
| | | | unused variables or missing krb5 prototypes.
* slapi_pw_find_sv() expects an array, make sure we have a NULL terminatedSimo Sorce2008-06-301-5/+9
| | | | | one to avoid potential segfaults Avoid leaking memory too.
* Let DS encode the password, this will allow IPA -> AD passwordSimo Sorce2008-06-111-10/+4
| | | | synchronization to work again.
* remove useless if-before-free testsJim Meyering2008-05-151-24/+12
| | | | | | | | | | | | I've been on a crusade (;-) to remove useless if-before-free tests, so ran a script that spotted some here. I think I removed the first batch (without braces) automatically, then manually removed the ones with curly braces around the free statements. You may well have doubts about the portability of removing those tests, but as long as you don't care about SunOS4 or earlier, you'll be fine. I've done similar things for e.g., coreutils, glibc, and git, and have had no problems.
* * ipa_pwd_extop.c (encrypt_encode_key): Handle malloc failure.Jim Meyering2008-05-151-0/+5
|
* Password policy checks fixes.Simo Sorce2008-04-071-37/+94
| | | | | | - don't let a user set a password identical to the current one. - don't check more then the policy defined number of passwords in history - don't set an history longer than policy defined
* Purely indentiation, trailing spaces, cosmetic fixesSimo Sorce2008-02-211-133/+173
|
* Support getting in a principal with out the REALM partSimo Sorce2007-12-211-2/+15
|
* Big changeset that includes the work around keytab management.Simo Sorce2007-12-211-499/+1167
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following the changelog history from my dev tree, some comments are useful imo ------------------------------------------------------ user: Simo Sorce <ssorce@redhat.com> date: Fri Dec 21 03:05:36 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c description: Remove remnants of the initial test tool changeset: 563:4fe574b7bdf1 user: Simo Sorce <ssorce@redhat.com> date: Fri Dec 21 02:58:37 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c description: Maybe actually encrypting the keys will help :-) changeset: 562:488ded41242a user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 23:53:50 2007 -0500 files: ipa-server/ipa-install/share/Makefile.am ipa-server/ipa-install/share/default-aci.ldif description: Fixes changeset: 561:4518f6f5ecaf user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 23:53:32 2007 -0500 files: ipa-admintools/Makefile ipa-admintools/ipa-addservice description: transform the old ipa-getkeytab in a tool to add services as the new ipa-getkeytab won't do it (and IMO it makes more sense to keep the two functions separate anyway). changeset: 559:25a7f8ee973d user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 23:48:59 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c description: Bugfixes changeset: 558:28fcabe4aeba user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 23:48:29 2007 -0500 files: ipa-client/configure.ac ipa-client/ipa-client.spec ipa-client/ipa-client.spec.in ipa-client/ipa-getkeytab.c description: Configure fixes Add ipa-getkeytab to spec Client fixes changeset: 557:e92a4ffdcda4 user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 20:57:10 2007 -0500 files: ipa-client/Makefile.am ipa-client/configure.ac description: Try to make ipa-getkeytab build via autotools changeset: 556:224894175d6b user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 20:35:56 2007 -0500 files: ipa-admintools/ipa-getkeytab ipa-client/ipa-getkeytab.c description: Messed a bit with hg commands. To make it short: - Remove the python ipa-getkeytab program - Rename the keytab plugin test program to ipa-getkeytab - Put the program in ipa-client as it should be distributed with the client tools changeset: 555:5e1a068f2e90 user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 20:20:40 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c description: Polish the client program changeset: 554:0a5b19a167cf user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 18:53:49 2007 -0500 files: ipa-server/ipa-install/share/default-aci.ldif ipa-server/ipa-install/share/default-keytypes.ldif ipa-server/ipa-install/share/kdc.conf.template ipa-server/ipa-install/share/kerberos.ldif ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c ipa-server/ipaserver/krbinstance.py description: Support retrieving enctypes from LDAP Filter enctypes Update test program changeset: 553:f75d7886cb91 user: Simo Sorce <ssorce@redhat.com> date: Thu Dec 20 00:17:40 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c description: Fix ber generation and remove redundant keys changeset: 552:0769cafe6dcd user: Simo Sorce <ssorce@redhat.com> date: Wed Dec 19 19:31:37 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c description: Avoid stupid segfault changeset: 551:1acd5fdb5788 user: Simo Sorce <ssorce@redhat.com> date: Wed Dec 19 18:39:12 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c description: If ber_peek_tag() returns LBER_ERROR it may just be that we are at the end of the buffer. Unfortunately ber_scanf is broken in the sense that it doesn't actually really consider sequence endings (due probably to the fact they are just representation and do not reflect in the underlieing DER encoding.) changeset: 550:e974fb2726a4 user: Simo Sorce <ssorce@redhat.com> date: Wed Dec 19 18:35:07 2007 -0500 files: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c description: First shot at the new method
* Min Pwd Change Time Check after Password reset and other minor fixesSimo Sorce2007-11-301-25/+33
|
* Fix bad segfault when pwvals is nullSimo Sorce2007-11-191-34/+24
|
* Small fix from Rob to pwd-extop-pluginKarl MacMillan2007-11-171-1/+1
|
* - Store Master Key in Ldap (Makes it easier to set up replicas)Simo Sorce2007-11-161-177/+468
| | | | | | | | | | | | | | - Does not require dirsrv access to stash file - Finalize password history support - Fix strict password length default in pwd_extop (fix install sctript too) - fix plugin configuration - Introduce 3 kind of password change: normal, admin, and ds manager - normal require adherence to policies - admin does not but password is immediately expired - ds manager can just change the password any way he likes. Initial code to read the Kerberos Master Key from the Directory
* Initial implementation of policies support.Simo Sorce2007-11-131-103/+528
| | | | | | | | | | | | | | | | | | | This patch uses the kerberos schema policy, this is the same policy used by kadmin. While this patch allows for krbPwdPolicy objects anywhere the kldap module will make the kdc fail to provide tickets if the "krbPwdPolicyReference" points to any object that is not a child of cn=<REALM>,cn=kerberos,dc=.... To let us set policies anywhere in the tree I enabled the code to actually look at parent entries and the user entry itself and specify policies directly on these objects by adding the krbPwdPolicy objectclass to them (I know its structural but DS seem to allow multiple Structural classes on the same entry). The only side effect is that kadmin will not understand this, but we don't want to use kadmin anyway as it does not understand way too many things about the directory. I've tested a few scenarios and all seem working as expected, but further testing is welcome of course.
* Properly increment kvno and keep recent key material aroundSimo Sorce2007-10-311-13/+162
| | | | | | This is necessary for services that need to be able to respond to requests from client that acquired a service ticket just before a password change.
* Add password request for admin userSimo Sorce2007-08-311-1/+1
| | | | | | | | | Set password for admin user using the Directory Mangaer account and the mozldapldappaswd binary to get and SSL connection Fix some timeout problems with deploying keytabs Fix ipa_pwd_extop to actuallt correctly detect an SSL connection Do not ask for the user to use for the directory unless 'dirsrv' is an existing user which may clash, create it silently
* Remove dependncy on libmhash and use openssl md4 functionsSimo Sorce2007-08-201-7/+18
| | | | | | | Remove all dependencies on mhash Remove code optimizatrion from Makefiles, right now these are developers targeted builds, so it is better to have debugging symbols around
* in F7 all directory names have changed from fedora-ds to dirsrvSimo Sorce2007-08-151-1/+1
| | | | which should also be the name used in DS 8.0, change all occurences
* Clean-up code to avoid Wall warningsSimo Sorce2007-08-151-30/+19
|
* Add dependency and a commentSimo Sorce2007-08-081-0/+5
|
* Reorganized repo to reflect packaging.Karl MacMillan2007-07-271-0/+1359
generated by cgit (git 2.34.1) at 2024-05-21 00:50:25 +0000