summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ipa_selinux: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | src/providers/ipa/ipa_selinux.c: In function 'ipa_selinux_handler_done': src/providers/ipa/ipa_selinux.c:927:16: error: 'sci' may be used uninitialized in this function [-Werror=maybe-uninitialized] state->sci = sci; ^ src/providers/ipa/ipa_selinux.c:333:33: note: 'sci' was declared here struct selinux_child_input *sci; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: make sure extdom expo data is availableSumit Bose2015-03-131-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: do not treat missing sub-domain users as errorSumit Bose2015-03-131-3/+7
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2444 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_initgr_check_timeout: add debug outputSumit Bose2015-03-131-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use the logon_name as the key for the PAM initgr cacheSumit Bose2015-03-131-13/+3
| | | | | | | | | | | | | Currently the name member of the pam_data struct is used as a key but it can change during a request. Especially for sub-domain users the name is changed from the short to the fully-qualified version before the cache entry is created. As a result the cache searches are always done with the short name while the entry was written with the fully-qualified name. The logon_name member of the pam_data struct contains the name which was send by the PAM client and is never changed during the request. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: return ERR_INTERNAL if more than one entry is foundPavel Březina2015-03-131-1/+1
| | | | | | | This means that the db is not in the expected format thus we should make the error more visible. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: parse input name if neededPavel Březina2015-03-134-27/+288
| | | | | | | | The input name is now parse automatically by cache_req if none particullar domain is specified. The parsed named is returned from _recv as an output parameter. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cmocka: include mock_parse_inp in header filePavel Březina2015-03-131-0/+2
| | | | | | | This is a non static function that is supposed to be used in tests but it was missing from header file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by idPavel Březina2015-03-133-1/+420
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove default branch from switchesPavel Březina2015-03-131-20/+4
| | | | | | | | | | | | Originaly, the cache_req used enum sss_dp_acct_type to indicate request type but not all types were implemented. Thus we used default branch to indicate unimplemented request type. Now when we switched to a custom enum type we can get rid of the default branch so the compiler can check if all switches contains all values. This proved to be useful during development of new request types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by namePavel Březina2015-03-133-1/+398
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for user by uidPavel Březina2015-03-134-11/+485
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: preparations for different input typePavel Březina2015-03-133-100/+310
| | | | | | | | | Currently cache_req takes only user name as an input parameter. However, this is not enough since we will need also UID and GID in the future. This patch creates a structure to hold input parameters so it can be simply extended to support other input types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: define user name constantPavel Březina2015-03-131-11/+14
| | | | | | | Using a constant here is better since the name is shared between the test function and testing _done function. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: rename test_user to test_user_by_namePavel Březina2015-03-131-25/+25
| | | | | | | This is done in order to distinguish those tests from other user tests that are about to come. For example: test_user_by_id. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus_codegen: Port to python3Lukas Slebodnik2015-03-131-8/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2017 Reviewed-by: Petr Viktorin <pviktori@redhat.com>
* test: Check ERR_LASTMichal Zidek2015-03-133-1/+12
| | | | | | Check if number of error codes and messages is the same. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Add missing strings for error messagesMichal Zidek2015-03-132-1/+4
| | | | | | | | We had more error codes than corresponding messages. Also order of two messages was wrong. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: libkrb5 and SSSD use different expansionsPavel Reichl2015-03-131-0/+9
| | | | | | | | | | Users often wrongly use SSSD expansions in libkrb5 expansion template for principals. State explicitly it won't work. Resolves: https://fedorahosted.org/sssd/ticket/2528 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add unit tests for initgroupsJakub Hrozek2015-03-121-0/+346
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-121-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: Add a getpwnam-by-UPN testJakub Hrozek2015-03-121-0/+97
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: ncache_hit must be an int to test UPNsJakub Hrozek2015-03-121-9/+9
| | | | | | | | In order to detect faulty cases where negcache would be checked twice, we need to convert the ncache_hit to integer and check exact amounts of hits. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: convert all unit tests to cmocka 1.0 or laterJakub Hrozek2015-03-1135-663/+769
| | | | | | All tests now use the cmocka-1.0-compatible API. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RPM: BuildRequire libcmocka >= 1.0Jakub Hrozek2015-03-111-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Only run cmocka tests if cmocka 1.0 or newer is availableJakub Hrozek2015-03-111-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: default_domain_suffix with use_fully_qualified_names.Michal Zidek2015-03-111-2/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2569 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Use FQDN if default domain was setMichal Zidek2015-03-113-4/+35
| | | | | | https://fedorahosted.org/sssd/ticket/2569 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ldap_child: fix coverity warningPavel Reichl2015-03-111-2/+12
| | | | | | | In ldap_child_get_tgt_sync() variable 'ret' got overriden in done section without ever before being read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Log reason in debug message why ldb_modify failedLukas Slebodnik2015-03-118-10/+68
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: More debugging for create_ccache()Jakub Hrozek2015-03-101-13/+41
| | | | | | | | It was difficult to find where the problem was without advanced techniques like strace. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAC: Fix memory leakLukas Slebodnik2015-03-091-0/+1
| | | | | | Reported by clang static analyser. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: use sysdb_user/group_dnPavel Březina2015-03-094-38/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: get rid of callback pointersPavel Březina2015-03-091-67/+31
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support groupsPavel Březina2015-03-085-0/+63
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support usersPavel Březina2015-03-085-0/+62
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: add sdap_refresh_initPavel Březina2015-03-085-30/+33
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refactor netgroups refreshPavel Březina2015-03-081-32/+77
| | | | | | | This is a preparation to support other object types without introducing duplicated code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_handle_acct_req_send: remove be_reqPavel Březina2015-03-084-17/+13
| | | | | | | | | | | be_req was used only as a talloc context for subreq. This memory context was replace by state of the parent request which is more suitable for tevent coding style. This change will allow us to use this function in be_refresh where none be_req is available. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refresh all domains in backendPavel Březina2015-03-084-37/+66
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: fix minor neglect in is_account_locked()Pavel Reichl2015-03-061-0/+2
| | | | | | | | | | It would be better to return explicit error code, although access is still denied and error message printed. Relates: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: initialized ccname_file_dummySumit Bose2015-03-061-1/+1
| | | | | | | | | | ccname_file_dummy is used in the done-block which is called before ccname_file_dummy is set to a value. This patch initializes ccname_file_dummy to NULL. Related to https://fedorahosted.org/sssd/ticket/2592 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Lock out ssh keys when account naturally expiresPavel Reichl2015-03-055-94/+254
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: convert GeneralizedTime to unix timePavel Reichl2015-03-056-3/+121
| | | | | | | | New utility function *sss_utc_to_time_t* to convert GeneralizedTime to unix time. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* selinux: Delete existing user mapping on empty defaultJakub Hrozek2015-03-042-7/+17
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2587 The case of SELinux default user mapping being an empty string is valid, it should translate into "pick the default context on the target machine". In case the context is empty, we need to delete the per-user mapping from the SELinux database to make sure the default is used. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: unlink ccname_file_dummy if there is an errorDaniel Hjorth2015-03-041-1/+11
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2592 If there is an error after ccname_file_dummy is created but before it is renamed then the file isn't removed. This can cause a lot of files to be created and take up inodes in a filesystem. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: enable change phase of pw expire policy checkPavel Reichl2015-03-037-1/+119
| | | | | | | | | | | | | Implement new option which does checking password expiration policy in accounting phase. This allows SSSD to issue shadow expiration warning even if alternate authentication method is used. Resolves: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: refactor pwexpire policyPavel Reichl2015-03-033-32/+91
| | | | | | | | | Move part of pwexpire policy code to a separate function. Relates to: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com>
* FO: Use SRV TTL in fail over codeJakub Hrozek2015-03-0311-9/+666
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1884 Removes the hardcoded SRV TTL timeout and uses TTL from the DNS instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* resolv: Use the same default timeout for SRV queries as previouslyJakub Hrozek2015-03-032-1/+7
| | | | | | | | | | | When we changed the resolver code to use the TTL values from the DNS queries instead of harcoded ones, we changed the default value by accident. Add a separate SRV TTL that is backwards-compatible with the old harcoded value. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 03:50:29 +0000