summaryrefslogtreecommitdiffstats
path: root/src/plugins/kdb/ldap
Commit message (Collapse)AuthorAgeFilesLines
* Conditionalize use of LDAP_OPT_DEBUG_LEVELGreg Hudson2014-02-281-0/+2
| | | | | | | | | The LDAP debug level option (#7551) causes a build failure with the Solaris LDAP library, which does not have LDAP_OPT_DEBUG_LEVEL. ticket: 7870 (new) target_version: 1.12.2 tags: pullup
* Improve LDAP KDB initialization error messagesGreg Hudson2013-10-301-7/+7
| | | | | | | | | | | | | In krb5_ldap_initialize, don't just blat the LDAP error into the extended message; give an indication of which LDAP operation we were trying to do and show what parameters we gave to it. (Also, krb5_set_error_message can handle a null context argument, so don't bother to check before calling.) ticket: 7739 (new) target_version: 1.12 tags: pullup
* Avoid allocating zero key_data structuresGreg Hudson2013-07-151-1/+2
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Fix various warningsGreg Hudson2013-06-077-43/+36
|
* Reduce boilerplate in makefilesGreg Hudson2013-05-163-21/+0
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Assume mutex locking cannot failGreg Hudson2013-05-142-13/+6
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Improve LDAP password file error messagesGreg Hudson2013-05-081-2/+6
| | | | | | | If we cannot open the LDAP password file or cannot find the bind DN in it, include the filename and DN in the error message. ticket: 7632
* Simplify krb5_ldap_readpasswordGreg Hudson2013-03-291-19/+2
| | | | | | There's no need to check whether the file exists and is readable before opening it, and setting an extended error message which is just strerror_r() of the errno value isn't useful.
* Fix kdb_ldap_create_principal cleanupGreg Hudson2013-03-281-2/+2
| | | | entry must be initialized before all code which can jump to cleanup.
* Fix more password_policy cleanup codeGreg Hudson2013-03-281-11/+6
| | | | | Initialize policy_dn in krb5_ldap_create_password_policy; free values unconditionally in all ldap_pwd_policy.c cleanup handlers.
* Get rid of krb5_xfreeGreg Hudson2013-03-282-23/+23
|
* Fix krb5_ldap_put_password_policy cleanupGreg Hudson2013-03-281-3/+2
| | | | | Initialize policy_dn since we clean it up. Also free it unconditionally.
* make dependGreg Hudson2013-03-243-102/+94
|
* Eliminate unused variablesGreg Hudson2013-03-151-1/+1
|
* Initialize status in krb5_ldap_parse_db_paramsGreg Hudson2013-03-111-1/+1
| | | | | | | | If db_args is non-null but empty, status could be returned without being initialized; gcc with optimization correctly warns about this, causing a build failure. (This bug was introduced by 0b1dc2f93da4c860dd27f1ac997617b712dff383 which was pushed after the 1.11 release branch, so it isn't in any release.)
* Modernize k5bufGreg Hudson2013-02-142-9/+9
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-092-17/+8
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Simplify LDAP password decodingGreg Hudson2013-02-012-113/+45
| | | | | | Make dec_password a static function in ldap_service_stash.c and remove some impedance mismatch with krb5_ldap_readpassword() by making it operate on C strings and return a krb5_error_code.
* Remove partial LDAP client cert supportGreg Hudson2013-01-314-138/+40
| | | | | | | | The LDAP KDB module has some code to interpret {FILE} values in stash files, and set the service_cert_path/pass fields in the ldap context. But there was no code to actually use those values to do client cert authentication, so it wasn't useful. Remove the partial implementation.
* Fix prepend_err_str in LDAP KDB moduleGreg Hudson2013-01-291-3/+4
| | | | | | Use the oerr parameter to fetch the existing message. Stop handling oerr == 0, since no call sites were using it. Free the old error message before returning.
* Add LDAP debug DB optionGreg Hudson2013-01-283-0/+4
| | | | | | | Add a DB option in the LDAP KDB module to turn on debugging messages. Adapted from a patch by Zoran Pericic <zpericic@inet.hr>. ticket: 7551 (new)
* Refactor LDAP DB option parsing codeGreg Hudson2013-01-285-378/+167
| | | | | | | | | | krb5_ldap_open and krb5_ldap_create contain two large, almost identical blocks of DB option processing code. Factor it out into a new function krb5_ldap_parse_db_params in ldap_misc.c, and simplify the factored-out code. Create a helper function to add server entries and use it to simplify krb5_ldap_read_server_params as well as DB option parsing. Since the new DB option helper uses isspace instead of isblank, we no longer require portability goop for isblank.
* make dependGreg Hudson2013-01-103-8/+8
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-091-7/+0
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Stop loading policy for pw_expiration in LDAPGreg Hudson2013-01-091-24/+0
| | | | | | | | | | | populate_krb5_db_entry() performs a subsidiary LDAP search to load the password policy, which it uses to update the pw_expiration field. This has some minimal value (it causes pw_expiration values in principals to auto-update whenever the pw_max_life field of a policy changes), but it's complicated, expensive, and inconsistent with the DB2 back end. Get rid of it. ticket: 7535 (new)
* Get rid of KRB5_KDB_SRV_TYPE_PASSWDGreg Hudson2012-12-201-2/+0
| | | | | | Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it. (kpasswdd is part of kadmind and interacts with the KDB using KRB5_KDB_SRV_TYPE_ADMIN.)
* Generate dependencies for kdb5_ldap_utilGreg Hudson2012-12-202-1/+105
|
* Remove LDAP realm krbTicketPolicyReference codeGreg Hudson2012-12-202-51/+1
| | | | | | ldap_realm.c had some code intended to handle a krbTicketPolicyReference from a krbRealmContainer object, but there wasn't enough of it to ever do anything. Remove it.
* Simplify LDAP KDB module container DN handlingGreg Hudson2012-12-2011-290/+87
| | | | | | | | | | | | | | | | | Outside of krb5_ldap_read_krbcontainer_params and krb5_ldap_create_krbcontainer, no fields of krb5_ldap_krbcontainer_params were used except for the DN. There was code to create a krbTicketPolicyReference attribute (which would fail because the schema doesn't allow that attribute, and was never exercised because kdb5_ldap_util would never set the parameter) and to read fields like max ticket life from the referenced ticket policy, but those fields were never used. Eliminate the structure and just store the container DN in krb5_ldap_context. Continue creating the container object when creating a realm (by calling krb5_ldap_create_krbcontainer unconditionally; it now exits successfully if the container already exists), but don't ever read it.
* Remove unneeded code in krb5_ldap_put_principalGreg Hudson2012-12-201-17/+7
| | | | | | krb5_ldap_put_principal contained some conditionals for the case where entry->princ is NULL, but only after entry->princ was dereferenced unconditionally. It's not necessary to handle this case, so don't.
* Remove unused functions in the LDAP KDB moduleGreg Hudson2012-12-205-342/+0
|
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-192-24/+24
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Fix quoting issues in LDAP KDB moduleGreg Hudson2012-11-173-81/+30
| | | | | | | | | | | | | | | Modify ldap_filter_correct() to quote special characters for DN strings as well as filters, since it is already used to quote a DN string in krb5_ldap_name_to_policydn() and there's no harm in over-quoting. In krb5_ldap_put_principal(), quote the unparsed principal name for use in DNs we choose. In krb5_ldap_create_password_policy(), use the policy name for the CN of the policy entry instead of the (possibly quoted) first element of the DN. Adapted from a patch by Jim Shi <hanmao_shi@apple.com>. ticket: 7296
* Remove install-oldmanBen Kaduk2012-10-171-3/+0
| | | | | | The old man pages are gone, so we can't install them anymore. Also clean up install and install-unix targets that were installing the old man pages by hand.
* Remove nroff man pagesBen Kaduk2012-10-161-938/+0
| | | | | | | We generate man pages from RST sources now; they are checked into the tree in src/man/. The gen-manpages directory is no longer needed.
* Add LDAP back end support for policy extensionsGreg Hudson2012-07-303-2/+127
| | | | ticket: 7223
* Remove eDirectory support code in LDAP KDB moduleGreg Hudson2012-07-2918-5136/+23
|
* Factor out LDAP policy marshallingGreg Hudson2012-07-261-32/+55
| | | | | | Use a helper function add_policy_mods() in krb5_ldap_create_password_policy() and krb5_ldap_put_password_policy() to avoid duplicating code for each field.
* Remove obsolete code in ldap_pwd_policy.cGreg Hudson2012-07-261-36/+0
| | | | | r18750 refactored some policy fetching code into populate_policy(), and left the old code in #if 0 blocks. Get rid of those blocks now.
* Allow using locales when gettext is absentBen Kaduk2012-07-061-0/+1
| | | | | | | | | | | Previously, if configure did not detect dgettext(), we disabled anything that smelled like localization, inadvertently including setlocale(). Now that we use setlocale(LC_ALL, ""), we have localized dates available as well as messages, so we should not disable calls to setlocale() any more. Since the routines from locale.h are only used in a relatively small number of places, just include the header directly in those files and remove it from k5-platform.h.
* Enable all localizations in main functionsBen Kaduk2012-07-061-1/+1
| | | | | | | | | | | | | | | Bite the bullet and pass LC_ALL to setlocale() instead of just LC_MESSAGES. Calls to setlocale() itself were introduced in fabbf9e443459e8c0161c84563690ed70c7f6a61 for ticket 6918, but only for LC_MESSAGES since only localized strings were needed and that was the most conservative option. However, klist, kadmin, and kinit (and perhaps others) would benefit from localized formats for times (i.e., LC_TIME). If potentially localized data is being sent on the wire, that is a bug that should be fixed. No such bugs are found with the current test suite, so we are comfortable enabling LC_ALL at this time. ticket: 7192
* Patch from Richard Basch to work around Solaris 8 lacking isblank()Tom Yu2012-02-271-1/+7
| | | | | | | | ticket: 7074 target_version: 1.10.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25716 dc483132-0cff-0310-8789-dd5450dbe970
* Data-driven ASN.1 decoderGreg Hudson2012-02-111-0/+10
| | | | | | | | | | | | | | | | | | Add a general ASN.1 decoder implementation in asn1_encode.c using the same data structures as the encoder (augmented where necessary), and use it to define decoder functions in asn1_k_encode.c. Add a boolean type to atype_info, as it is needed for the pa_pac_req decoder. For the moment, just #if out the old decoder functions; they and their support code can be cleaned up later after a a few remaining utility functions are addressed. Changes to encoder and decoder interfaces are minimized, but there are two small ones. ldap_seqof_key_data has a kvno field added, and some of the decoder logic is pushed up into the caller. The safe_with_body decoder now outputs an allocated krb5_data * instead of a krb5_data with aliases into the input buffer. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25693 dc483132-0cff-0310-8789-dd5450dbe970
* install sphinx-generated manpagesTom Yu2012-01-091-0/+2
| | | | | | | | | | | | | | | | | Install sphinx-generated manpages. Original nroff manpages remain for reference until proofreading is complete. Modify doc/rst_source/conf.py to better deal with shadow manpages -- sphinx will now build k5login.5 instead of .k5login.5, and kadmin.1 instead of both kadmin.1 and kadmin.local.8. Proofreaders should ensure that the original nroff manpages (and associated Makefile rules) are deleted once their reST format equivalents have been proofread. ticket: 7064 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25625 dc483132-0cff-0310-8789-dd5450dbe970
* Ldap dependency for parallel buildsSam Hartman2011-11-291-0/+3
| | | | | | | | | | The ldap plugin needs to declare a dependency on the ldap library ticket: 7030 tags: pullup target_version: 1.10 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25494 dc483132-0cff-0310-8789-dd5450dbe970
* Fix failure interval of 0 in LDAP lockout codeGreg Hudson2011-11-201-1/+1
| | | | | | | | | | | | | | | | A failure count interval of 0 caused krb5_ldap_lockout_check_policy to pass the lockout check (but didn't cause a reset of the failure count in krb5_ldap_lockout_audit). It should be treated as forever, as in the DB2 back end. This bug is the previously unknown cause of the assertion failure fixed in CVE-2011-1528. ticket: 7021 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25480 dc483132-0cff-0310-8789-dd5450dbe970
* Clean up more stuff in make cleanGreg Hudson2011-11-041-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25437 dc483132-0cff-0310-8789-dd5450dbe970
* Get rid of fake-installGreg Hudson2011-11-041-1/+1
| | | | | | | | | Instead, use $(BUILDTOP)/plugins as the plugin base for tests. For each real plugin module, create a link in the parent directory if we're doing a shared-library build--so built KDB modules can be found in plugins/kdb, preauth modules in plugins/preauth, etc.. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25436 dc483132-0cff-0310-8789-dd5450dbe970
* SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]Tom Yu2011-10-182-2/+13
| | | | | | | | | | | Fix null pointer dereference and assertion failure conditions that could cause a denial of service. ticket: 6981 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25368 dc483132-0cff-0310-8789-dd5450dbe970
* Create e_data as pa_data in KDC interfacesGreg Hudson2011-10-042-2/+2
| | | | | | | | | | | | All current known uses of e_data are encoded as pa-data or typed-data. FAST requires that e_data be expressed as pa-data. Change the DAL and kdcpreauth interfaces so that e_data is returned as a sequence of pa-data elements. Add a preauth module flag to indicate that the sequence should be encoded as typed-data in non-FAST errors. ticket: 6969 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25298 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-26 09:50:12 +0000