summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add support for FreeIPA ID viewsidviewsAlexander Bokovoy2014-10-017-29/+618
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FreeIPA ID views allow to override POSIX attributes for certain users and groups. A support is added to allow using specific ID view when serving compatibility tree. Each user or group entry which has an override in the view is amended with the overridden values from the view before served out to the LDAP client. A view to use is specified as a part of base DN: cn=<view>,cn=views,cn=compat,$SUFFIX where cn=compat,$SUFFIX is the original compatibility tree base DN. Each entry, when served through the view, gets new DN rewritten to specify the view. Additionally, if override in the view changes uid (for users) or cn (for groups) attribute, the entry's RDN is changed accordingly. For groups memberUid attribute is modified as well in case there is an override in the view that changes uid value of that member. FreeIPA ID views support overrides for users of trusted Active Directory domains. In case of a trusted AD domain's user or group is returned via compatibility tree, view overrides are applied in two stages: 1. SSSD applies default view for AD users 2. slapi-nis applies explicitly specified (host-specific) view on top of the entry returned by SSSD Thus, slapi-nis does not need to apply default view for AD users and if there are no host-specific views in use, there is no need to specify a view in the base DN, making overhead of a default view for AD users lower.
* tag 0.53HEADmasterNalin Dahyabhai2014-04-222-3/+9
|
* Tweak the self-tests just a bitNalin Dahyabhai2014-04-222-5/+17
|
* Correct the NIS defaults for "hosts" mapsNalin Dahyabhai2014-04-221-4/+4
| | | | | The values for NIS hosts.byname and hosts.byaddr maps should start with addresses, not names. Reported by Rik Megens.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-8/+6
| | | | | Avoid calling strdup() in a situation where we don't need to, so that we can better handle cases where it fails (static analysis).
* Accept schema-compat-lookup-nsswitch: passwdNalin Dahyabhai2014-03-171-1/+8
| | | | | | Treat "schema-compat-lookup-nsswitch: passwd" in the configuration the same as "schema-compat-lookup-nsswitch: user", to not fail for people who forget and try to use the nsswitch database name.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-4/+20
| | | | | | | If we hit out-of-memory (strdup() failures) while reading the configuration, don't crash (static analysis). In some cases, this means we proceed with garbage data until the copy_config() function sanity-checks its input and output.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-2/+15
| | | | | If we hit out-of-memory (strdup() failures) while reading the configuration, don't crash (static analysis).
* Ignore unnamed entries when constructing NIS mapsNalin Dahyabhai2014-03-141-2/+3
|
* Fix a couple of memory leaks (static analysis)Nalin Dahyabhai2014-03-141-1/+3
|
* Check for OOM in format_expand_simple()Nalin Dahyabhai2014-03-131-1/+4
|
* Fixup nsswitch tests to allow the server to resolve its userNalin Dahyabhai2014-02-175-2/+15
|
* Add free() of a NULL pointer to make tools happyNalin Dahyabhai2014-02-171-0/+4
|
* Cast away type-mismatches calling xdr_free() (static analysis)Nalin Dahyabhai2014-02-171-9/+9
|
* Don't leak ftmp on out-of-memory (static analysis)Nalin Dahyabhai2014-02-171-0/+1
|
* Resync with latest mass rebuildNalin Dahyabhai2014-01-201-2/+5
|
* Tweak exclusiveArch on EL7Nalin Dahyabhai2014-01-201-2/+6
| | | | | Limit ExclusiveArch to EL releases < 7, since 7 apparently gets 389-ds-base on all arches by default.
* Add a couple of bug references to RPM's changelogNalin Dahyabhai2013-12-171-2/+2
|
* tag 0.52Nalin Dahyabhai2013-12-163-2/+12
|
* Removing domains and maps correctlyNalin Dahyabhai2013-12-161-6/+6
| | | | | On domain or map removal, fill in gaps in the list of domains or maps correctly.
* Actually allow TXN support to be enabled (ugh)Nalin Dahyabhai2013-12-131-1/+1
|
* Remove an unused local variableNalin Dahyabhai2013-12-121-1/+1
|
* Stop checking if a non-NULL value has a NULL valueNalin Dahyabhai2013-12-121-2/+2
|
* Silence a compiler warningNalin Dahyabhai2013-12-121-1/+2
|
* tag 0.51Nalin Dahyabhai2013-12-093-2/+8
|
* Accept slightly larger fragments (8K vs 8K - 4)Nalin Dahyabhai2013-12-091-4/+4
|
* Don't leak arguments to yp_all() (more of #967468)Nalin Dahyabhai2013-12-091-0/+1
|
* Merge branch 'master' of git.fedorahosted.org:/git/slapi-nisNalin Dahyabhai2013-11-251-4/+6
|\
| * Remove a possible memmove() of 0 bytesNalin Dahyabhai2013-11-191-4/+6
| | | | | | | | | | Don't bother memmove()ing a 0-byte chunk of data. Found by static analysis.
* | Whitespace fixupNalin Dahyabhai2013-11-151-2/+0
|/
* Note Alexander's changes in the next NEWS fileNalin Dahyabhai2013-11-151-0/+1
|
* Perform tests with fewer threadsNalin Dahyabhai2013-11-151-0/+1
|
* Correct syntax errorsNalin Dahyabhai2013-11-151-2/+2
| | | | | The object class definitions were missing closing parentheses. So yay for the new schema parsing code in 389.
* Coverity#11940: do not leak memory in the pam wrapper testAlexander Bokovoy2013-11-151-3/+5
|
* Coverity#11937: use proper structure to pass to map_data_set_entry()Alexander Bokovoy2013-11-151-6/+8
| | | | | map_data_set_entry() passes pointers to the lengths of the key and the value to map_data_save_list() which interpretes them as arrays of integers.
* tag 0.50Nalin Dahyabhai2013-10-013-2/+9
|
* Try reconnecting if rpcbind EPIPEs usNalin Dahyabhai2013-10-013-60/+94
| | | | | | | If the NIS server encounters an EPIPE while attempting to communicate with the portmapper, try to reconnect before giving up on registering. Depending on which RPC implementation is used, rpcbind may drop idle clients after 30 seconds, and our startup can take longer than that.
* Use MSG_NOSIGNAL when sending a request to portmapNalin Dahyabhai2013-10-011-1/+1
|
* Up the log severity on portmap errorsNalin Dahyabhai2013-10-011-9/+9
| | | | | | Log errors encountered while talking to portmap/rpcbind at level SLAPI_LOG_FATAL rather than at the previous SLAPI_LOG_PLUGIN, so that they show up even when we're not actively debugging.
* update for 0.49, too lateNalin Dahyabhai2013-09-191-0/+4
|
* tag 0.49Nalin Dahyabhai2013-09-192-2/+7
|
* Add ignore-subtree and restrict-subtree settingsNalin Dahyabhai2013-09-1950-96/+1056
| | | | | | | | | | | | | | Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees out of which we ignore contents and updates, if set) settings, and default the former to "cn=tasks,cn=config". This should avoid cases where we're looking through the ldbm backend for entries which have a dangling reference to a newly-added task (which, because it's in the DSE, means we acquire an ldbm lock after acquiring our internal lock) while also updating a compat entry after its source entry is modified (for example, by the memberOf plugin, which results in us attempting to acquire our lock while the ldbm lock is already held).
* Add a missing word in a commentNalin Dahyabhai2013-09-121-1/+1
|
* Add nis-relevant-subtree and nis-ignore-subtreeNalin Dahyabhai2013-09-122-7/+21
|
* Add schema-compat-relevant-subtreeNalin Dahyabhai2013-09-125-5/+47
| | | | | | | | | | Add a schema-compat-relevant-subtree configuration option, listing the only parts of the DIT that we should ever look at, either as source entries or as other entries which contain data which might be pulled in as part of computing the contents of compat entries. This is more or less the whitelist to schema-compat-ignore-subtree's blacklist.
* Add schema-compat-ignore-subtreeNalin Dahyabhai2013-09-126-1/+118
| | | | | | | Add a schema-compat-ignore-subtree configuration option, listing parts of the DIT that we should never look at, neither as source entries nor as random other entries which contain data which might be pulled in as part of computing the contents of compat entries.
* Force LC_ALL to "C", just in caseNalin Dahyabhai2013-09-061-0/+1
|
* Remove a pair of unused variablesNalin Dahyabhai2013-08-281-2/+0
|
* Warn if we fail to set SO_LINGER for TCP clientsNalin Dahyabhai2013-08-271-1/+7
|
* Warn if non-blocking-ifying a client socket failsNalin Dahyabhai2013-08-271-1/+7
|
generated by cgit (git 2.34.1) at 2025-08-31 16:00:11 +0000