summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* p11child: set restrictive umask and clear environmentpk11childJakub Hrozek2015-08-131-0/+3
| | | | | | | https://fedorahosted.org/sssd/ticket/2754 Before doing any calls, set a very restrictive umask and clear environment variables to harden p11child execution.
* test_memory_cache: Fix few python issuesLukas Slebodnik2015-08-131-5/+5
| | | | | | | | | | W:438,17: Unused variable 'gids' (unused-variable) W:438,10: Unused variable 'errno' (unused-variable) E:618,31: Undefined variable 'user' (undefined-variable) W:443,17: Unused variable 'gids' (unused-variable) W:443,10: Unused variable 'errno' (unused-variable) Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_cache: Wait a while for invalidation of mc by nss responderLukas Slebodnik2015-08-131-0/+34
| | | | | | | | | | | | | | | | The sss_cache cannot invalidate memory cache directly because the nss responder owns file locks to memory caches. Therefore sss_cache just "tell" nss responder to invalidate memory cache. However there might be short interval between calling the utility sss_cache and stopping sssd. So nss responder needn't be so fast and therefore memory cache needn't be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2748 Reviewed-by: Michal Židek <mzidek@redhat.com>
* krb5_utils-tests: Remove unused variablesLukas Slebodnik2015-08-101-3/+0
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Improve messages about failuresPavel Reichl2015-08-073-4/+11
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* krb5: assume online state if KDC proxy is configuredSumit Bose2015-08-051-0/+6
| | | | | | | | | | | If a KDC proxy is configured a request in the KRB5 provider will assume online state even if the backend is offline without changing the state of the backend. Resolves https://fedorahosted.org/sssd/ticket/2700 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not create kdcinfo file if proxy configuration existsSumit Bose2015-08-051-0/+7
| | | | | | | Resolves https://fedorahosted.org/sssd/ticket/2652 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5 utils: add sss_krb5_realm_has_proxy()Sumit Bose2015-08-055-0/+85
| | | | | Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_memory_cache: Test invalidation with sss_cacheLukas Slebodnik2015-08-051-0/+176
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* test_memory_cache: Test mmap cache after initgroupsLukas Slebodnik2015-08-051-0/+89
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB5: Do not try to remove missing ccacheLukas Slebodnik2015-08-051-0/+5
| | | | | | | | | There was a misleading debug message in krb5_child [[sssd[krb5_child[16629]]]] [get_and_save_tgt] (0x0080): Failed to remove old ccache file [(null)], please remove it manually. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SPEC: Workaround for build with rpm 4.13Lukas Slebodnik2015-08-051-0/+3
| | | | | | | | | | | | | If the tarball is generated with minimal dependencies extracted from spec file then translated manual pages are not generated due to missing script po4a. This step is not necessary for regular nightly/developer builds. The tarball is created faster without such step. However rpm >= 4.13 will fail due to empty manifest file. Resolves: https://fedorahosted.org/sssd/ticket/2738 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_memory_cache: Add test for initgroups mc with fq namesLukas Slebodnik2015-08-051-2/+138
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: Initgr memory cache should work with fq namesLukas Slebodnik2015-08-055-19/+53
| | | | | | | | | | | | | | | | | | | | | We need to stored two versions of name to the initgroups memory cache. Otherwise it could be stored many times if sssd is configured with case_sensitive = false. It would be impossible to invalidate all version of names after user login. As a result of this wrong user groups could be returned from initgroups memory cache. Therefore we store raw name provided by glibc function and internal sanitized fully qualified name, which is unique for particular user. This patch also increase average space for initgroups because there are also stored two quite long names in case of fq names. Resolves: https://fedorahosted.org/sssd/ticket/2712 Reviewed-by: Michal Židek <mzidek@redhat.com>
* intg_test: Add integration test for memory cacheLukas Slebodnik2015-08-052-0/+348
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* intg_test: Add module for simulation of utility idLukas Slebodnik2015-08-052-0/+120
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Update integrity check of records in mmap cacheLukas Slebodnik2015-08-053-32/+33
| | | | | | | | | | | | | | | | | | | | The function sss_nss_mc_get_record return copy of record from memory cache in last argument. Because we should not access data directly to avoid problems with consistency of record. The function sss_nss_mc_get_record also check whether length of record is within data area (with macro MC_CHECK_RECORD_LENGTH) However we also tried to do the same check in functions sss_nss_mc_get{gr, pw}* Pointer to end of strings in record was compared to pointer to the end of data table. But these two pointers are not within the same allocated area and does not make sense to compare them. Sometimes record can be allocated before mmaped area and sometime after. Sometimes it will return cached data and other time will fall back to responder. Resolves: https://fedorahosted.org/sssd/ticket/2743 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap: Invalidate initgroups memory cache after any changeLukas Slebodnik2015-08-051-8/+9
| | | | | | | | | | Initgroups memory cache was invalidated only in case on removed user. it should be invalidated also after changes in group membership. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap_cache: "Override" functions for initgr mmap cacheLukas Slebodnik2015-08-053-9/+28
| | | | | | | | | | | | | | | | | | Functions sss_mc_get_strs_offset and sss_mc_get_strs_len provides data about strings for individual memory caches (passwd, ...) Their are used in generic responder mmap cache code to find a record in mmap cache (sss_mc_find_record). Data provided from functions sss_mc_get_* are used for checking the validity of record. So in case of corrupted record the whole mmap cache can be invalidated. Functions sss_mc_get_strs_offset and sss_mc_get_strs_len did not provide data for initgroups mmap cache and therefore particular record could not be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap_cache: Rename variablesLukas Slebodnik2015-08-054-16/+16
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* intg: Modernize 'except' clausesLukas Slebodnik2015-08-043-46/+46
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 dropped the "comma" syntax. Reviewed-by: Christian Heimes <cheimes@redhat.com>
* SSSDConfig: Return correct types in python3Lukas Slebodnik2015-08-042-2/+4
| | | | | | | | | | In Python 3, dict.keys() returns a view rather than a list. Since dict keys aren't in any particular order, indexing them doesn't make sense. Resolves: https://fedorahosted.org/sssd/ticket/2699 Reviewed-by: Christian Heimes <cheimes@redhat.com>
* IPA: Remove MPG groups if getgrgid was called before getpw()Jakub Hrozek2015-07-311-2/+39
| | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2724 This bug only affects IPA clients that are connected to IPA servers with AD trust and ID mapping in effect. If an IPA client calls getgrgid() for an ID that matches a user, the user's private group would be returned and stored as a group entry. Subsequent queries for that user would fail, because MPG domains impose uniqueness restriction for both the ID and name space across groups and users. To work around that, we remove the UPG groups in MPG domains during a group lookup. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: rename SDAP_CACHE_PURGE_TIMEOUTPavel Reichl2015-07-316-13/+13
| | | | | | | | | Enum member SDAP_CACHE_PURGE_TIMEOUT has counter-intuitive name as it's used to access 'ldap_purge_cache_timeout' option. SDAP_CACHE_PURGE_TIMEOUT is more fitting name. Reviewed-by: Petr Cech <pcech@redhat.com>
* ssh: generate public keys from certificateSumit Bose2015-07-3112-13/+364
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2711 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: add sc supportSumit Bose2015-07-312-1/+96
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add certificate support to PAM (pre-)auth requestsSumit Bose2015-07-3113-39/+1378
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authok: add support for Smart Card related authtokensSumit Bose2015-07-314-0/+187
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pack_message_v3: allow empty nameSumit Bose2015-07-311-3/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add NSS version of p11_childSumit Bose2015-07-313-1/+661
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add NSS version of cert utilsSumit Bose2015-07-315-6/+244
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not send SSS_OTP if two factors were usedSumit Bose2015-07-291-1/+6
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2729 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Update spec file for krb5_local_auth_pluginLukas Slebodnik2015-07-291-5/+2
| | | | | | | | | | | | | | | | krb5_localauth_plugin could be build only with MIT kerberos >= 1.12. However, this feature was backported in downstream to older version of kerberos. So there were packaging failures error: Installed (but unpackaged) file(s) found: /usr/lib/sssd/modules/sssd_krb5_localauth_plugin.so RPM build errors: Installed (but unpackaged) file(s) found: /usr/lib/sssd/modules/sssd_krb5_localauth_plugin.so Child returncode was: 1 EXCEPTION: Command failed. See logs for output. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: Use ad_site also when site search failsPavel Březina2015-07-291-2/+10
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2725 Some deployments use the ad_site option for cases where the AD clients are not able to find a site for one reason or another. With our current code, the ad_site option value can only override a site that the client found, not supply the value for cases no site could be found. This patch fixes the issue. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Repair dependecies on deprecated librariesPetr Cech2015-07-282-13/+29
| | | | | | | | | | | Modules libsystemd-journal and libsystemd-login are deprecated and "libsystemd" should be used instead of them. Resolves: https://fedorahosted.org/sssd/ticket/2733 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: fix compiler warningsPavel Reichl2015-07-282-3/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Handle sssd-owned keytabs when running as rootJakub Hrozek2015-07-282-8/+41
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2718 This patch handles the case where the keytab is created with sssd:sssd ownership (perhaps by the IPA oddjob script) but SSSD runs as root, which is the default in many distributions. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* UTIL: Lower debug level in perform_checks()Jakub Hrozek2015-07-281-4/+4
| | | | | | | Failures in perform_checks() don't have to be fatal, therefore the debug messages shouldn't be either. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: Better debuggingJakub Hrozek2015-07-281-0/+3
| | | | Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* TOOLS: add sss_override for local overridesPavel Březina2015-07-276-1/+845
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: add common command frameworkPavel Březina2015-07-273-1/+501
| | | | | | | | | | Add general framework to simplify creating "cmd COMMAND [OPTIONS...]" style tools. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: prepare for LOCAL viewPavel Březina2015-07-274-2/+88
| | | | | | | | | | | | Objects doesn't have to have overrideDN specified when using LOCAL view. Since the view is not stored on the server we do not want to contact LDAP therefore we special case LOCAL view saying that it is OK that this attribute is missing. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* VIEWS TEST: add null-checkPavel Březina2015-07-271-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: use negative cache for sid-by-id requestsSumit Bose2015-07-271-0/+55
| | | | | | | | | | | | | | | | | | | Since requests by ID are not assized to a specific domain SSSD might check the ID in domains where the ID does not exists even if the ID is already in the sysdb cache of the right domain. For requests where already a memory cache is available like e.g. getpwuid() and getgrgid() this has no negative impact because the requests are answered directly from the cache most of the time without hitting SSSD. As long as there is no use-case which does not use the memory cache those requests do not need an update. But for request like sid-by-id where currently no memory cache is available there are quite some additional costs especially for trusted domains. Resolves https://fedorahosted.org/sssd/ticket/2731 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* negcache: allow domain name for UID and GIDSumit Bose2015-07-277-49/+82
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2731 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Handle cases where no GPOs applyStephen Gallagher2015-07-261-3/+43
| | | | | | | | | | | | | | | | | It is possible to have a machine where none of the GPOs associated with it include access-control rules. Currently, this results in a denial-by-system-error. We need to treat this case as allowing the user (see the test cases in https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration We also need to delete the result object from the cache to ensure that offline operation will also grant access. Resolves: https://fedorahosted.org/sssd/ticket/2713 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* intg: Invalidate memory cache before removing filesLukas Slebodnik2015-07-241-0/+1
| | | | | | | Workaround for: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* DYNDNS: support for dualstackPavel Reichl2015-07-244-39/+302
| | | | | | | | | | | | When dyndns_iface option was not used, address of connection to LDAP was used. This patch proposes following change: * Interface containing address of connection is found. * All A and AAAA addresses of this interface are collected. * Collected addresses are sent during DDNS update. * Function sss_iface_addr_add() is removed. Resolves: https://fedorahosted.org/sssd/ticket/2558
* TESTS: dyndns tests support AAAA addressesPavel Reichl2015-07-241-13/+38
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2558
* DYNDNS: special value '*' for dyndns_iface optionPavel Reichl2015-07-243-11/+24
| | | | | Option dyndns_iface has now special value '*' which implies that IPs from add interfaces should be sent during DDNS update.
generated by cgit (git 2.34.1) at 2024-04-27 02:45:26 +0000