summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* AD-GPO: add ad_gpo_cache_timeout optionYassir Elley2014-07-3110-107/+259
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: set port status to not working if previous srv lookup failedPavel Březina2014-07-311-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The meta server status consists of two parts: A) port status - managed by failover mechanism B) SRV lookup status - managed by SRV resolver Both parts are resetted to "neutral" after some time, having B timeout greater than A timeout. We were hitting the following issue: 1. SRV lookup fails (DNS is not reachable), this will set A to "not working and B to "resolve error". Then the next server is tried but fails as well. 2. If SSSD tries to go back online the failover will set A to "neutral" and it will try to resolve SRV again. But B status is still set to "resolve error" since we haven't reached the timeout yet and SRV resolution fails immediately. But the next server is not tried since the port status (A) remains "neutral". This patch sets the port status to "not working" making the failover to continue with the next server as expected. https://fedorahosted.org/sssd/ticket/2390 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Exit offline mode only if server is available.Michal Zidek2014-07-312-17/+52
| | | | | | | | | | | | | | | | | | | | | This patch adds periodic check to test if backend can exit offline mode and only marks backend as not offline if server for the service is available. Prior to this patch we marked backend as not offline if the offline_timeout was reached without checking for the server availability and when the next request failed again we switched back to the offline mode. This caused significant slowdowns in some edge cases. Fixes: https://fedorahosted.org/sssd/ticket/2355 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Add backoff feature to the ptask api.Michal Zidek2014-07-315-3/+37
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Allow adding random_offset to scheduled execution timeMichal Zidek2014-07-315-5/+22
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AD-GPO: only download policy files if gpo version changesYassir Elley2014-07-302-197/+560
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: add sysdb_gpo support for caching gpo versionYassir Elley2014-07-303-0/+291
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Move libini_config 1.1.0 check to libini_config.m4Nikolai Kondrashov2014-07-292-2/+16
| | | | | | | | | Move the check for libini_config >= 1.1.0 from samba.m4 to libini_config.m4 to have them all in one place, simplifying maintenance. Set boolean variables for every detected version and use one of them in samba.m4 instead. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Reverse order of libini_config checksNikolai Kondrashov2014-07-292-26/+24
| | | | | | | | | | | | Check for lowest versions of libini_config first, instead of the highest ones in libini_config.m4. Define HAVE_LIBINI_CONFIG_V* for lower versions when higher versions are present. Simplify preprocessor branching in sss_ini.c accordingly. This prepares libini_config.m4 for addition of a check for one more version of libini_config. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Distinguish libnl version checksNikolai Kondrashov2014-07-291-2/+7
| | | | | | | | | | Use separate shell variable name prefixes for checks of separate libnl versions, as repeated invocations of PKG_CHECK_MODULES with the same prefix are not generally supposed to have an effect. This prevents bugs similar to https://fedorahosted.org/sssd/ticket/2388 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Distinguish libini_config version checksNikolai Kondrashov2014-07-292-3/+7
| | | | | | | | | | | | | | | | | | Use separate shell variable name prefixes for checks of separate libini_config versions, as repeated invocations of PKG_CHECK_MODULES with the same prefix are not generally supposed to have an effect. Otherwise only the checks before and including the first one defining both *_CFLAGS and *_LIBS variables will be done and all that follow will assume success. This happens on RHEL6.5, where both "pkg-config --cflags" and "pkg-config --libs" for ini_config produce non-empty output and successful check for v0.6.1 results in incorrectly successful check for v1.1.0. Resolves: https://fedorahosted.org/sssd/ticket/2388 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Mention required libini_config versionNikolai Kondrashov2014-07-291-6/+6
| | | | | | | Specify minimum required libini_config version in a message in samba.m4 explaining the need for the library. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Remove substitution of *_OBJ variablesNikolai Kondrashov2014-07-2912-15/+0
| | | | | | | Remove substitution of *_OBJ variables (e.g. POPT_OBJ or PCRE_OBJ) from configure scripts as they don't seem to be set or used by anything. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: replace asterisk with escape sequence in host filterPavel Březina2014-07-291-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2377 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove unused function confdb_set_boolMichal Zidek2014-07-292-80/+0
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* MAN: case_sensitivity man page updateMichal Zidek2014-07-291-3/+30
| | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* case_sensitivity = preservingMichal Zidek2014-07-295-12/+52
| | | | | | | | | | | If case_sensitivity is set to 'preserving', getXXnam returns name attribute in the same format as stored in LDAP. Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Add function confdb_set_string.Michal Zidek2014-07-292-0/+93
| | | | | | | Part of fix for: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Increment som_index when advancing to the next GPOJakub Hrozek2014-07-291-0/+2
| | | | | | | When the GPO processing tried to advance to the next GPO on encountering an error, the som_index was not incremented, causing an infinite loop. Reviewed-by: Yassir Elley <yelley@redhat.com>
* AD: Check return value of ad_gpo_evaluate_daclJakub Hrozek2014-07-291-2/+7
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Replace spaces with specified string in names.Lukas Slebodnik2014-07-287-1/+87
| | | | | | | | | | | | This patch add possibility to replace whitespace in user and group names with a specified string. With string "-", sssd will return the same result as winbind enabled option "winbind normalize names" Resolves: https://fedorahosted.org/sssd/ticket/1854 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Add functions for replacing whitespaces.Lukas Slebodnik2014-07-286-3/+320
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* test_utils: Use common header file for libsss_util tests.Lukas Slebodnik2014-07-284-2/+34
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Remove unused option ldap_user_uuidLukas Slebodnik2014-07-2510-25/+0
| | | | | | | | | | | | | | | | | | | | | | There is problem with OpenLDAP server and dereferencing of attributes that is not in the schema of the server? sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b 'dc=example,dc=com' \ -E 'deref=member:uid,dummy_attr' cn=ref_grp Protocol error (2) Additional information: Dereference control: attribute decoding error sh-4.2$ echo $? 2 The attribute nsUniqueID is a 389-only, non-standard attribute. It is an operational attribute that is not in the rfc2307bis nor inetOrgPerson nor posixAccount schema. It was a default value of option ldap_user_uuid, but it was not use anywhere. Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_group_uuidLukas Slebodnik2014-07-2510-25/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_netgroup_uuidLukas Slebodnik2014-07-257-25/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: use dbus array for rules refreshPavel Březina2014-07-242-9/+29
| | | | | | | | | | D-Bus only supports 255 signatures which caused a segmentation fault when sudo responder tried to refresh more rules at once. Resolves: https://fedorahosted.org/sssd/ticket/2387 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: fix use after free in async_initgroupsPavel Reichl2014-07-241-1/+0
| | | | | | | | Request is freed if creation of subrequest fails and ENOMEM is returned. This would lead to use after free as returned value is checked on caller's side and (already freed) request would be marked as erroneous. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Only check GID if ID-mappingJakub Hrozek2014-07-233-4/+36
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* No point in searching for gid if we already know the group should be filteredJakub Hrozek2014-07-231-3/+5
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: Fix memory leak in nss_mc_{group,passwd}Lukas Slebodnik2014-07-232-0/+16
| | | | | | | | | | | | | | | | | | | | | | | Memory leak can happen with long living clients where there are records with colliding hashes; usually LDAP servers with many users or groups. Function sss_nss_mc_get_record allocates memory that is stored into "rec", with next iteration variable rec is overriden with new record and old one is lost and cannot be freed. Example code flow: src/sss_client/nss_mc_group.c:133: alloc_arg: "sss_nss_mc_get_record" allocates memory that is stored into "rec". src/sss_client/nss_mc_common.c:216:13: alloc_fn: Storage is returned from allocation function "malloc". src/sss_client/nss_mc_common.c:216:13: var_assign: Assigning: "copy_rec" = "malloc(rec_len)". src/sss_client/nss_mc_common.c:225:9: noescape: Resource "copy_rec" is not freed or pointed-to in function "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.] src/sss_client/nss_mc_common.c:239:5: var_assign: Assigning: "*_rec" = "copy_rec". src/sss_client/nss_mc_group.c:163: noescape: Resource "rec" is not freed or pointed-to in "sss_nss_mc_next_slot_with_hash". src/sss_client/nss_mc_common.c:294:60: noescape: "sss_nss_mc_next_slot_with_hash(struct sss_mc_rec *, uint32_t)" does not free or save its pointer parameter "rec". src/sss_client/nss_mc_group.c:133: overwrite_var: Overwriting "rec" in call to "sss_nss_mc_get_record" leaks the storage that "rec" points to. src/sss_client/nss_mc_common.c:239:5: write_notnull_to_parm: Assigning: "*_rec" = "copy_rec". Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: thread safe initialisation of sss_cli_mc_ctxLukas Slebodnik2014-07-231-7/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In multi threaded application, it may happen that more threads will call function getpwuid(or similar) and sss client will not have initialized structure for fast memory cache. This structure is initialized just once. There isn't any problem with multi threaded application after successful initialisation. The race condition will happen if more threads try to initialise structure sss_cli_mc_ctx in function sss_nss_mc_get_ctx (ctx->initialized is false) It takes some time to initialise mmap cache: open file, get file size, mmap file, initialize structure sss_cli_mc_ctx. One of problems is that file with memory cache can be opened more times (file descriptor leak), but the race condition is with initialising structure sss_cli_mc_ctx. One tread will start to initialise this structure; another thread will think that structure is already initialised and will check consistency of this structure. It will fail because 1st thread did not finish initialisation. Therefore 2nd thread will return EINVAL and will do clean up in done section: munmap, close file and reset structure data. The 1st thread will finish an try to use memory cache, but structure was zero initialised by 2nd thread and it will cause dereference of NULL pointer in 1st thread (SIGSEGV) or dividing by zero in murmurhash function(SIGFPE) Function sss_nss_mc_get_ctx was split into two parts for simplification of locking and unlocking. The locking is used only in new static function sss_nss_mc_init_ctx. This function will not be called very often therefore the same mutex is used as in other nss functions. Resolves: https://fedorahosted.org/sssd/ticket/2380 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: reduce code duplicity-rfc2307bis nested groupsPavel Reichl2014-07-231-41/+29
| | | | | | | Move copy&pasted code for iteration of nested groups into separate function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* ad: update membership after SIDs are resolvedPavel Březina2014-07-221-25/+62
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2385 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad: comment ENOENT when id mapping is disabledPavel Březina2014-07-221-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: remove duplicated codePavel Reichl2014-07-221-44/+3
| | | | | | | | | | | Body of functions sdap_x_deref_search_done(), sdap_asq_search_done(), sdap_sd_search_done and sdap_get_generic_done() are the same. Remove code duplication by calling sdap_get_generic_done() from sdap_x_deref_search_done(), sdap_sd_search_done and from sdap_asq_search_done() instead of having two more duplicate implementations. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: rename find_subdomain_by_object_namePavel Reichl2014-07-223-13/+13
| | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-2216-54/+54
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_sidPavel Reichl2014-07-227-23/+23
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_sid/find_domain_by_sid/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad_handle_acct_info_step: fix typoPavel Březina2014-07-211-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Continue resolving SID even if some failPavel Reichl2014-07-211-1/+6
| | | | | | | | | | | | Resolving groups obtained via Token-Groups in case of disabled ID mapping may lead to failure as non-posix groups are not resolved. This patch amends sdap_ad_resolve_sids_done() not to abruptly finish request if ENOENT is returned. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: tokengroups do not work with id_provider=ldapPavel Reichl2014-07-214-13/+93
| | | | | | | | | | | | | | | | | | With plain LDAP provider we already have a sdap_handle, so it should be possible that in the case where sdom->pvt == NULL sdap_id_op_connect_send() can be skipped and sdap_get_ad_tokengroups_send() can be already send with the sdap_handle passed to sdap_ad_tokengroups_initgr_mapping_send(). So we should only fail if sdom->pvt == NULL and sh == NULL. if find_subdomain_by_sid() failed we can check if there is only one domain in the domain list (state->domain) and in this case continue with this domain since the LDAP provider does not know about sub-domains and hence can only have one configured domain. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: Store policy settings in local filesYassir Elley2014-07-206-350/+426
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: add missing debug-to-stderr option to gpo_childSumit Bose2014-07-201-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: add missing debug-to-stderr option to krb5_childSumit Bose2014-07-201-0/+3
| | | | | | Without this option krb5_child cannot be run in interactive mode. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_sifp: set output parameters if attribute is NULLPavel Březina2014-07-162-43/+415
| | | | | | | | | | | | | | | | | | | | | | | | | | There are two cases that may happen when a user calls Get or GetAll: 1) the attribute is missing 2) the attribute is empty sss_sifp has two error code to distinguish between those two cases: 1) SSS_SIFP_ATTR_MISSING 2) SSS_SIFP_ATTR_NULL Usually the caller is not interested on situations when the attribute is empty and it can be considered as error. Having it as a separate error code instead of setting the output value to NULL is necesarry since attribute does not have to be a pointer. This patch however sets pointer type attributes to NULL since it may simplify the code path when the caller is actually interested in this information (e. g. empty server list on domain objects). It is not possible to send a NULL string over a D-Bus nor it is possible to have hash table NULL with current code so these two scenarios are not tested. However, it is handled in sss_sifp_attr code for completeness. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_sifp test: fix object path array testPavel Březina2014-07-161-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: augmented logging when adding new groupPavel Reichl2014-07-152-16/+81
| | | | | | | | | | | This patch adds some more log messages to functionality of storing groups into sysdb. As these functions are low level and failures are often handled on higher levels the commonly chosen level is SSSDBG_TRACE_LIBS. Resolves: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-157-0/+7
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document that each provider type uses its own set of optionsJakub Hrozek2014-07-141-1/+4
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2281 Many users were configuring the combination of id_provider=ad access_provider=ldap expecting that the access_provider would use the same serves the id_provider does. That's not the case, each provider type must be configured separately. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-15 18:24:13 +0000