summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* MAN: Update ppolicy descriptionPavel Reichl2015-03-271-4/+7
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2612 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> (cherry picked from commit 1426ee8756a1df4ec0651417dce92e1dcc8a246d)
* sdap: properly handle binary objectGuid attributeSumit Bose2015-03-2713-34/+324
| | | | | | | | | | | | | | | Although in the initial processing SSSD treats the binary value right at some point it mainly assumes that it is a string. Depending on the value this might end up with the correct binary value stored in the cache but in most cases there will be only a broken entry in the cache. This patch converts the binary value into a string representation which is described in [MS-DTYP] and stores the result in the cache. Resolves https://fedorahosted.org/sssd/ticket/2588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 4619742836ec22edf8f9d274d928bc896c5b0883)
* LDAP: fix a typo in debug messagePavel Reichl2015-03-261-1/+1
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 871f340834f25ca92a481718939164e708a70e29)
* Resolv: re-read SRV query every time if its TTL is 0Jakub Hrozek2015-03-262-6/+27
| | | | | | | | We should make sure the client re-checks the SRV query each request if the SRV query is 0. Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 9797aa5907191cef5db8279e20ec75fd0abbe980)
* build: Only run cmocka tests if cmocka 1.0 or newer is availableJakub Hrozek2015-03-261-2/+2
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> (cherry picked from commit cecee447d41c3ca22e94880a7d0cbd910f230fe5)
* tests: convert all unit tests to cmocka 1.0 or laterJakub Hrozek2015-03-2633-638/+741
| | | | | | | All tests now use the cmocka-1.0-compatible API. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: remove unused codePavel Reichl2015-03-261-5/+1
| | | | | | | Also fix debug message. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit ef9ca5848ea08aafa0827f5d2922d49130ba324d)
* GPO: error out instead of leaving array element uninitializedSumit Bose2015-03-261-1/+4
| | | | | | | | | | | | In general every object created by the AD provider should have a SID attribute. Since SIDs and GPOs are used for access control a missing SID should be treated as error for now until it is known if there is a valid reason why the SID is missing. Resolves https://fedorahosted.org/sssd/ticket/2608 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 4cfab2330323834574c179f774a0c6b1fff4936e)
* IPA: set EINVAL if dn can't be linearizedPavel Reichl2015-03-201-0/+1
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 131da4d9f40e0e407d7bcae18ff16507976bc6c7) (cherry picked from commit e8f5e135b4d389a1ae224da174c15dfe66b30810)
* IPA: make sure output variable is setSumit Bose2015-03-201-1/+3
| | | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit abb093b4ae10f2a5748bf9f194bf76794002eba0) (cherry picked from commit ee3cd052a2aca57040a9b435def5442922f8af76)
* LDAP/AD: do not resolve group members during tokenGroups requestSumit Bose2015-03-209-18/+64
| | | | | | | | | | | | | | | | | | | | | | | | During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1) (cherry picked from commit b8d9eca0d9469c1209161b31a0109d8e4ea2868c)
* selinux: Handle setup with empty default and no configured rulesJakub Hrozek2015-03-172-4/+10
| | | | | | | | | | | SSSD also needs to handle the setup where no rules match the machine and the default has no MLS component. Related to: https://fedorahosted.org/sssd/ticket/2587 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 3e6dac8e14f8a3da6d359ee013453dbd8a38dd99)
* IPA idviews: check if view name is setSumit Bose2015-03-171-1/+4
| | | | | | | | | | | When working with older FreeIPA releases the view name might not always been set. This patch add checks to might sure it is only dereferenced when set. Resolves https://fedorahosted.org/sssd/ticket/2604 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 8be0cf3eea892e13410c13abb030322599ca1b4f)
* ipa_selinux: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | src/providers/ipa/ipa_selinux.c: In function 'ipa_selinux_handler_done': src/providers/ipa/ipa_selinux.c:927:16: error: 'sci' may be used uninitialized in this function [-Werror=maybe-uninitialized] state->sci = sci; ^ src/providers/ipa/ipa_selinux.c:333:33: note: 'sci' was declared here struct selinux_child_input *sci; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: make sure extdom expo data is availableSumit Bose2015-03-131-0/+5
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 7ee9ac32485483beece872d6fcb3096fa77a004b)
* ipa: do not treat missing sub-domain users as errorSumit Bose2015-03-131-3/+7
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2444 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 3e9712c2fdbba8f9cd25886943331e76e0b2cedd)
* pam_initgr_check_timeout: add debug outputSumit Bose2015-03-131-0/+4
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 10da5ea89b2b963e5e0bb0e0113d118e3bdea892)
* PAM: use the logon_name as the key for the PAM initgr cacheSumit Bose2015-03-131-13/+3
| | | | | | | | | | | | | | Currently the name member of the pam_data struct is used as a key but it can change during a request. Especially for sub-domain users the name is changed from the short to the fully-qualified version before the cache entry is created. As a result the cache searches are always done with the short name while the entry was written with the fully-qualified name. The logon_name member of the pam_data struct contains the name which was send by the PAM client and is never changed during the request. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 7bbf9d1d054f0571fa90ff5dd400a6f4a5a7f6c8)
* test: Check ERR_LASTMichal Zidek2015-03-133-1/+12
| | | | | | Check if number of error codes and messages is the same. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Add missing strings for error messagesMichal Zidek2015-03-132-1/+4
| | | | | | | | We had more error codes than corresponding messages. Also order of two messages was wrong. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: libkrb5 and SSSD use different expansionsPavel Reichl2015-03-131-0/+9
| | | | | | | | | | | Users often wrongly use SSSD expansions in libkrb5 expansion template for principals. State explicitly it won't work. Resolves: https://fedorahosted.org/sssd/ticket/2528 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 33b8bf140b1d82d2626eeeaaea29af49dcdb3c99)
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-131-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ldap_child: fix coverity warningPavel Reichl2015-03-131-2/+12
| | | | | | | | In ldap_child_get_tgt_sync() variable 'ret' got overriden in done section without ever before being read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> (cherry picked from commit 6ccda8691123bb27f5f2a88a0c80174af3e0fd0a)
* Log reason in debug message why ldb_modify failedLukas Slebodnik2015-03-138-10/+68
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 04d138472cc086fb7961f0d378852b09961b1a33)
* be_refresh: support groupsPavel Březina2015-03-085-0/+63
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 61c8d13e55ebafc28da1b0b5ad9ae578d687e288)
* be_refresh: support usersPavel Březina2015-03-085-0/+62
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit e77d6366ff9e49dbbb607f1709f1ae4190b99489)
* be_refresh: add sdap_refresh_initPavel Březina2015-03-085-30/+33
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 17531a398cc9084036cb08d69fe876a8f12707bb)
* be_refresh: refactor netgroups refreshPavel Březina2015-03-081-32/+77
| | | | | | | | This is a preparation to support other object types without introducing duplicated code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit ab0eda3622b828df2bfb7850c96d1395f614eb13)
* sdap_handle_acct_req_send: remove be_reqPavel Březina2015-03-084-17/+13
| | | | | | | | | | | | be_req was used only as a talloc context for subreq. This memory context was replace by state of the parent request which is more suitable for tevent coding style. This change will allow us to use this function in be_refresh where none be_req is available. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit a849d848d53f305a90613a74c1767a42b250deda)
* be_refresh: refresh all domains in backendPavel Březina2015-03-084-37/+66
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit b0d3164ca2bd842e176268c26935c5ce54f7f76e)
* SDAP: fix minor neglect in is_account_locked()Pavel Reichl2015-03-061-0/+2
| | | | | | | | | | It would be better to return explicit error code, although access is still denied and error message printed. Relates: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Lock out ssh keys when account naturally expiresPavel Reichl2015-03-065-94/+254
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: convert GeneralizedTime to unix timePavel Reichl2015-03-066-3/+121
| | | | | | | New utility function *sss_utc_to_time_t* to convert GeneralizedTime to unix time. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: initialized ccname_file_dummySumit Bose2015-03-061-1/+1
| | | | | | | | | | | ccname_file_dummy is used in the done-block which is called before ccname_file_dummy is set to a value. This patch initializes ccname_file_dummy to NULL. Related to https://fedorahosted.org/sssd/ticket/2592 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit cc0f9a541c5ecdad750a86b2de9baa1f07403e9e)
* selinux: Delete existing user mapping on empty defaultJakub Hrozek2015-03-042-7/+17
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2587 The case of SELinux default user mapping being an empty string is valid, it should translate into "pick the default context on the target machine". In case the context is empty, we need to delete the per-user mapping from the SELinux database to make sure the default is used. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit 01f78f755fde63997ccfded71fb8395569b11430) (cherry picked from commit 90efb3c2a48146d7b6cc81fe8422e9024144402a)
* LDAP: unlink ccname_file_dummy if there is an errorDaniel Hjorth2015-03-041-1/+11
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2592 If there is an error after ccname_file_dummy is created but before it is renamed then the file isn't removed. This can cause a lot of files to be created and take up inodes in a filesystem. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 2b20ff2e33ad3993a9cad910c4b4b828513613df) (cherry picked from commit 0b5036e4c652e6983a3352c045c8701d6573587b)
* SDAP: enable change phase of pw expire policy checkPavel Reichl2015-03-047-1/+119
| | | | | | | | | | | | | | | Implement new option which does checking password expiration policy in accounting phase. This allows SSSD to issue shadow expiration warning even if alternate authentication method is used. Resolves: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit c9b0071bfcb8eb8c71e40248de46d23aceecc0f3) (cherry picked from commit d3f82e944dc5dab3812700a245deec4aa3245b21)
* SDAP: refactor pwexpire policyPavel Reichl2015-03-043-32/+91
| | | | | | | | | | | Move part of pwexpire policy code to a separate function. Relates to: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit cdaa29d2c5724a4c72bfa0f42284ccfac3d5a464) (cherry picked from commit 8b353dd2b90b7ab222acdea726ab7e8681752237)
* FO: Use SRV TTL in fail over codeJakub Hrozek2015-03-0311-9/+666
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1884 Removes the hardcoded SRV TTL timeout and uses TTL from the DNS instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 8df69bbc58c2f4d3f0b34be9756d9ddf24b1db6d)
* resolv: Use the same default timeout for SRV queries as previouslyJakub Hrozek2015-03-032-1/+7
| | | | | | | | | | | | When we changed the resolver code to use the TTL values from the DNS queries instead of harcoded ones, we changed the default value by accident. Add a separate SRV TTL that is backwards-compatible with the old harcoded value. Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit eafbc66c2ff6365478e62a8df3fd005bf80e5c7b)
* PAM: check return value of confdb_get_stringPavel Reichl2015-03-031-0/+6
| | | | | | | Coverity found this neglect. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit c5290f2175845f2c5e3f35ce279b6f52b1d51275)
* PAM: warn all services about account expirationPavel Reichl2015-03-031-2/+17
| | | | | | | | | | | if pam_verbose is above one then output warning about account expiration for all services. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit f3c2dc1f9ccdf456fd78ed96197b9bf404cc29fc)
* PAM: new option pam_account_expired_messagePavel Reichl2015-03-036-5/+35
| | | | | | | | | | | This option sets string to be printed when authenticating using SSH keys and account is expired. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit e039f1aefecc65a7b3c2d4a13a612bff1dd367c8)
* PAM: do not reject abruptlyPavel Reichl2015-03-033-5/+130
| | | | | | | | | | If account has expired then pass message. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit a61d6d01a4e89ec14175af135e84f1cac55af748)
* Updating translations for the 1.12.4 releasesssd-1_12_4Jakub Hrozek2015-02-1838-10708/+11273
|
* RESPONDERS: Warn to syslog about colliding objectsLukas Slebodnik2015-02-183-0/+22
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2203 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Handle ENOENT better in the cleanup taskJakub Hrozek2015-02-181-9/+8
| | | | | | | | | The cleanup task handled both count=0 and ret=ENOENT separately which makes no sense, the count=0 handler was dead code previously. Set count=0 on ENOENT instead to just bubble through the DEBUG message gracefully as well. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Add better DEBUG messages to the cleanup taskJakub Hrozek2015-02-181-0/+11
| | | | | | | | Some failures would shortcut to the done handler without telling us anything about why it failed. This commit decorates the cleanup task with more DEBUG statements. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Better debugging for gpo_child's mkdirJakub Hrozek2015-02-181-1/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIGURE: Do not use macro AC_PROG_MKDIR_P twiceLukas Slebodnik2015-02-181-2/+1
| | | | | | | Macro AC_PROG_MKDIR_P need to be used just conditionally This patch also fixes fallback of macro MKDIR_P Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-04 03:30:52 +0000