summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* NSS: Don't ignore backslash in usernames with ldap providerrhel-7.2Lukas Slebodnik2015-09-014-5/+17
| | | | | | | | | | The regression was caused by changing default domain regex for ldap provider in ticket #2717 Resolves: https://fedorahosted.org/sssd/ticket/2772 Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_override: document --debug optionsPavel Březina2015-09-012-4/+37
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2758 Reviewed-by: Petr Cech <pcech@redhat.com>
* NSS: Fix use after freeLukas Slebodnik2015-08-202-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It can happed if there are two domains and user is not found in the first one. ==29279== Invalid read of size 1 ==29279== at 0x4C2CBA2: strlen (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==29279== by 0x89A7AC4: talloc_strdup (in /usr/lib64/libtalloc.so.2.1.2) ==29279== by 0x11668A: nss_cmd_initgroups_search (nsssrv_cmd.c:4191) ==29279== by 0x118B27: nss_cmd_getby_dp_callback (nsssrv_cmd.c:1208) ==29279== by 0x10F2B4: nsssrv_dp_send_acct_req_done (nsssrv_cmd.c:759) ==29279== by 0x126AFB: sss_dp_internal_get_done (responder_dp.c:802) ==29279== by 0x56EA861: ??? (in /usr/lib64/libdbus-1.so.3.7.4) ==29279== by 0x56EDB50: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.7.4) ==29279== by 0x50721E1: sbus_dispatch (sssd_dbus_connection.c:96) ==29279== by 0x879B22E: tevent_common_loop_timer_delay (tevent_timed.c:341) ==29279== by 0x879C239: epoll_event_loop_once (tevent_epoll.c:911) ==29279== by 0x879A936: std_event_loop_once (tevent_standard.c:114) ==29279== Address 0xbbad240 is 96 bytes inside a block of size 106 free'd ==29279== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==29279== by 0x89A46E3: _talloc_free (in /usr/lib64/libtalloc.so.2.1.2) ==29279== by 0x116679: nss_cmd_initgroups_search (nsssrv_cmd.c:4190) ==29279== by 0x118B27: nss_cmd_getby_dp_callback (nsssrv_cmd.c:1208) ==29279== by 0x10F2B4: nsssrv_dp_send_acct_req_done (nsssrv_cmd.c:759) ==29279== by 0x126AFB: sss_dp_internal_get_done (responder_dp.c:802) ==29279== by 0x56EA861: ??? (in /usr/lib64/libdbus-1.so.3.7.4) ==29279== by 0x56EDB50: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.7.4) ==29279== by 0x50721E1: sbus_dispatch (sssd_dbus_connection.c:96) ==29279== by 0x879B22E: tevent_common_loop_timer_delay (tevent_timed.c:341) ==29279== by 0x879C239: epoll_event_loop_once (tevent_epoll.c:911) ==29279== by 0x879A936: std_event_loop_once (tevent_standard.c:114) Resolves: https://fedorahosted.org/sssd/ticket/2749 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: support import and exportPavel Březina2015-08-203-3/+675
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2737 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: decompose code betterPavel Březina2015-08-201-109/+181
| | | | | | | Preparation for: https://fedorahosted.org/sssd/ticket/2737 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: add sss_colondb APIPavel Březina2015-08-202-0/+378
| | | | | | To simplify import/export users and groups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: support domains that require fqnamePavel Březina2015-08-201-2/+57
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2757 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: print input name if unable to parse itPavel Březina2015-08-201-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Index the objectSIDString attributeJakub Hrozek2015-08-203-1/+61
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* pam: Incerease p11 child timeoutMichal Židek2015-08-172-2/+8
| | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2746 It was timeouting often in CI machines. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* p11child: set restrictive umask and clear environmentJakub Hrozek2015-08-171-0/+3
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2754 Before doing any calls, set a very restrictive umask and clear environment variables to harden p11child execution. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Always re-fetch the keytab from the IPA serverJakub Hrozek2015-08-174-34/+221
| | | | | | | | | | Even if a keytab for one-way trust exists, re-fetch the keytab again and try to use it. Fall back to the previous one if it exists. This is in order to allow the admin to re-establish the trust keytabs with a simple sssd restart. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Provide a common interface to safely create temporary filesJakub Hrozek2015-08-173-0/+323
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Change the default of ldap_user_certificate to userCertificate;binaryJakub Hrozek2015-08-172-2/+2
| | | | | | | | | | This is safe from ldb point of view, because ldb gurantees the data is NULL-terminated. We must be careful before we save the data, though. Resolves: https://fedorahosted.org/sssd/ticket/2742 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: use ldb_binary_encode when printing attribute valuesJakub Hrozek2015-08-171-1/+10
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sudo: use "higher value wins" when ordering rulesPavel Březina2015-08-176-10/+60
| | | | | | | | | | | | This commit changes the default ordering logic (lower value wins) to a correct one that is used by native ldap support. It also adds a new option sudo_inverse_order to switch to the original SSSD (incorrect) behaviour if needed. Resolves: https://fedorahosted.org/sssd/ticket/2682 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: use default limit if provided is 0Pavel Březina2015-08-171-1/+3
| | | | | | | Returning zero values doesn't make any sense, so we may use it as "use sssd configuration instead". Reviewed-by: Petr Cech <pcech@redhat.com>
* sss_cache: Wait a while for invalidation of mc by nss responderLukas Slebodnik2015-08-171-0/+34
| | | | | | | | | | | | | | | | The sss_cache cannot invalidate memory cache directly because the nss responder owns file locks to memory caches. Therefore sss_cache just "tell" nss responder to invalidate memory cache. However there might be short interval between calling the utility sss_cache and stopping sssd. So nss responder needn't be so fast and therefore memory cache needn't be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2748 Reviewed-by: Michal Židek <mzidek@redhat.com>
* krb5: assume online state if KDC proxy is configuredSumit Bose2015-08-171-0/+6
| | | | | | | | | | | If a KDC proxy is configured a request in the KRB5 provider will assume online state even if the backend is offline without changing the state of the backend. Resolves https://fedorahosted.org/sssd/ticket/2700 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not create kdcinfo file if proxy configuration existsSumit Bose2015-08-171-0/+7
| | | | | | | Resolves https://fedorahosted.org/sssd/ticket/2652 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5 utils: add sss_krb5_realm_has_proxy()Sumit Bose2015-08-175-0/+85
| | | | | Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_memory_cache: Test invalidation with sss_cacheLukas Slebodnik2015-08-051-0/+176
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* test_memory_cache: Test mmap cache after initgroupsLukas Slebodnik2015-08-051-0/+89
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* test_memory_cache: Add test for initgroups mc with fq namesLukas Slebodnik2015-08-051-2/+138
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit cb8c24707275c5bda7310d67e7f46c75d3ac36ea)
* NSS: Initgr memory cache should work with fq namesLukas Slebodnik2015-08-055-19/+53
| | | | | | | | | | | | | | | | | | | | | | We need to stored two versions of name to the initgroups memory cache. Otherwise it could be stored many times if sssd is configured with case_sensitive = false. It would be impossible to invalidate all version of names after user login. As a result of this wrong user groups could be returned from initgroups memory cache. Therefore we store raw name provided by glibc function and internal sanitized fully qualified name, which is unique for particular user. This patch also increase average space for initgroups because there are also stored two quite long names in case of fq names. Resolves: https://fedorahosted.org/sssd/ticket/2712 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit dda0258705de7255e6ec54b7f9adbde83a220996)
* intg_test: Add integration test for memory cacheLukas Slebodnik2015-08-052-0/+348
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit a2c10cf31d14bac598f5cd008973375c3f9575a6)
* intg_test: Add module for simulation of utility idLukas Slebodnik2015-08-052-0/+120
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 38b07019861240cf5107f5d51fc0027519e21619)
* sss_client: Update integrity check of records in mmap cacheLukas Slebodnik2015-08-053-32/+33
| | | | | | | | | | | | | | | | | | | | | The function sss_nss_mc_get_record return copy of record from memory cache in last argument. Because we should not access data directly to avoid problems with consistency of record. The function sss_nss_mc_get_record also check whether length of record is within data area (with macro MC_CHECK_RECORD_LENGTH) However we also tried to do the same check in functions sss_nss_mc_get{gr, pw}* Pointer to end of strings in record was compared to pointer to the end of data table. But these two pointers are not within the same allocated area and does not make sense to compare them. Sometimes record can be allocated before mmaped area and sometime after. Sometimes it will return cached data and other time will fall back to responder. Resolves: https://fedorahosted.org/sssd/ticket/2743 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit ba847347cade817ee927397d82c952b51b0dcb2b)
* mmap: Invalidate initgroups memory cache after any changeLukas Slebodnik2015-08-051-8/+9
| | | | | | | | | | | Initgroups memory cache was invalidated only in case on removed user. it should be invalidated also after changes in group membership. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit ea7839cec593b4a7c678fab52ab864518db6699b)
* mmap_cache: "Override" functions for initgr mmap cacheLukas Slebodnik2015-08-053-9/+28
| | | | | | | | | | | | | | | | | | | Functions sss_mc_get_strs_offset and sss_mc_get_strs_len provides data about strings for individual memory caches (passwd, ...) Their are used in generic responder mmap cache code to find a record in mmap cache (sss_mc_find_record). Data provided from functions sss_mc_get_* are used for checking the validity of record. So in case of corrupted record the whole mmap cache can be invalidated. Functions sss_mc_get_strs_offset and sss_mc_get_strs_len did not provide data for initgroups mmap cache and therefore particular record could not be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 225dc6914cdc8920b02a129b98ece1ed97b99c03)
* mmap_cache: Rename variablesLukas Slebodnik2015-08-054-16/+16
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 39b31427e2d11ca318df11fd48db33a7cc610aa7)
* IPA: Remove MPG groups if getgrgid was called before getpw()Jakub Hrozek2015-08-041-2/+39
| | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2724 This bug only affects IPA clients that are connected to IPA servers with AD trust and ID mapping in effect. If an IPA client calls getgrgid() for an ID that matches a user, the user's private group would be returned and stored as a group entry. Subsequent queries for that user would fail, because MPG domains impose uniqueness restriction for both the ID and name space across groups and users. To work around that, we remove the UPG groups in MPG domains during a group lookup. Reviewed-by: Sumit Bose <sbose@redhat.com>
* ssh: generate public keys from certificateSumit Bose2015-08-0412-13/+364
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2711 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: add sc supportSumit Bose2015-08-042-1/+96
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add certificate support to PAM (pre-)auth requestsSumit Bose2015-08-0413-39/+1378
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authok: add support for Smart Card related authtokensSumit Bose2015-08-044-0/+187
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pack_message_v3: allow empty nameSumit Bose2015-08-041-3/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add NSS version of p11_childSumit Bose2015-08-043-1/+661
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add NSS version of cert utilsSumit Bose2015-08-045-6/+244
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not send SSS_OTP if two factors were usedSumit Bose2015-08-041-1/+6
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2729 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Invalidate memory cache before removing filesLukas Slebodnik2015-08-041-0/+1
| | | | | | | Workaround for: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: fix compiler warningsPavel Reichl2015-07-282-3/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Handle sssd-owned keytabs when running as rootJakub Hrozek2015-07-282-8/+41
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2718 This patch handles the case where the keytab is created with sssd:sssd ownership (perhaps by the IPA oddjob script) but SSSD runs as root, which is the default in many distributions. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* UTIL: Lower debug level in perform_checks()Jakub Hrozek2015-07-281-4/+4
| | | | | | | Failures in perform_checks() don't have to be fatal, therefore the debug messages shouldn't be either. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* IPA: Better debuggingJakub Hrozek2015-07-281-0/+3
| | | | Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* TOOLS: add sss_override for local overridessssd-1.13.0-7.el7Pavel Březina2015-07-276-1/+845
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: add common command frameworkPavel Březina2015-07-273-1/+501
| | | | | | | | | | Add general framework to simplify creating "cmd COMMAND [OPTIONS...]" style tools. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: prepare for LOCAL viewPavel Březina2015-07-274-2/+88
| | | | | | | | | | | | Objects doesn't have to have overrideDN specified when using LOCAL view. Since the view is not stored on the server we do not want to contact LDAP therefore we special case LOCAL view saying that it is OK that this attribute is missing. Preparation for: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* VIEWS TEST: add null-checkPavel Březina2015-07-271-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DYNDNS: support for dualstackPavel Reichl2015-07-244-39/+302
| | | | | | | | | | | | When dyndns_iface option was not used, address of connection to LDAP was used. This patch proposes following change: * Interface containing address of connection is found. * All A and AAAA addresses of this interface are collected. * Collected addresses are sent during DDNS update. * Function sss_iface_addr_add() is removed. Resolves: https://fedorahosted.org/sssd/ticket/2558
generated by cgit (git 2.34.1) at 2024-04-24 23:07:18 +0000