summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* pysss_nss_idmap: Use wrapper for older pythonsssd-1-11Lukas Slebodnik2015-06-192-4/+5
| | | | PyUnicode_FromString -> sss_python_unicode_from_string
* ldap: use proper sysdb name in groups_by_user_done()Sumit Bose2015-06-191-4/+13
| | | | | | | | | | | | | | | | | | In a recent change set_initgroups_expire_attribute() was added to groups_by_user_done() to make sure that the initgroups timeout is only added to the user object until all groups added to the cache. This change (and the original code in groups_by_user_done() as well) didn't took sub-domain users into account where the name in sysdb might different form the original request and the domain is not the configured domain. This patch tries to ensure that the right name and domain are used. https://fedorahosted.org/sssd/ticket/2663 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> (cherry picked from commit d0b7e5fcfca7d0db9e3d19be7b51f34d03d3d720) (cherry picked from commit edc1538566e7034eea9b8d592206fbc236233dff)
* DP: Set extra_value to NULL for enum requestsJakub Hrozek2015-06-191-1/+2
| | | | | | | | | | | | | | Some providers, notably IPA, rely on extra_value to be either a useful value or NULL. In enumeration, however, extra_value was random. Set the extra_value pointer explicitly to NULL to make it clear that it's not used for enumeration and also use talloc_zero as future-proof. Resolves: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit d9296ba018228ac6a19f710b8bb9044c4ea9ab5b) (cherry picked from commit 2dfb4ed5a36a7be6bcde60e042811b81e83c4850)
* Download complete groups if ignore_group_members is set with tokengroupsJakub Hrozek2015-06-191-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2644 When tokenGroups are enabled, we save groups using their SID as the RDN attribute during initgroups() and later, if the groups is requested and saved again with the full name, remove the original and save the new group entry. Saving the new group entry would break if ignore_group_members is also set, because the new group entry would lack the "member" attribute, so the member/memberof links between the new group and the user entry wouldn't be established again. This patch changes the initgroups processing so that the full group object is fetched when initgroups is enabled but together with ignore_group_members. This solution imposes some performance impact, because instead of one search for tokenGroups we also need to resolve the groups. The more systematic solution would be to get rid of removing the group entry as described in https://fedorahosted.org/sssd/ticket/2656 To reproduce the bug, set: ignore_group_members = True with a backend that uses: id_provider = ad Then run: $ id aduser@ad_domain.com $ id aduser@ad_domain.com Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit ee44aac95e42c3cb634876286a2aa4960ac69a2b) (cherry picked from commit 44f35a0f32785bf460b5d05424f5e9a15f4f4028)
* SDAP: Set initgroups expire attribute at the endLukas Slebodnik2015-06-192-9/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initgrups consisted of two main steps: 1. store user to cache 2. store all user groups to cache. Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step. So in case of epmty cache and parallel initgroups request in responders there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were not cached. Therefore sometime responder could return zero supplementary groups. This patch moves the setting of initgroups expire attribute from 1st step to the end of 2nd step. In case of parallel initgroups requests in responder there are two other ways how we could get correct results even thought there was a bug. a) Time between two request was too small. User was not stored in cache yet and 2nd request waited for response from DP. b) Time between two request was big enough. All users groups were successfully stored in cache and 2nd request returned correct results. Resolves: https://fedorahosted.org/sssd/ticket/2634 Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit d0cc678d20d8bde829450eb50bec1b7397cea3e1) (cherry picked from commit 9ae6567a573c05ba59d1138cfda94b44732019e8)
* nss: Do not ignore default vaue of SYSDB_INITGR_EXPIRELukas Slebodnik2015-06-191-3/+2
| | | | | | | | | | When SYSDB_INITGR_EXPIRE had default value (0) then value of SYSDB_CACHE_EXPIRE was used as initgroups expire attribute. The right apoach is already used in responder_cache_req.c Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit fd60528321fd52720222ec35b895ade54cccb48d) (cherry picked from commit 521eb7ca65040c009bc4885ba8d6c8ad257bc0f1)
* autofs: fix 'Cannot allocate memory' with FQDNsAron Parsons2015-06-191-9/+0
| | | | | | | | https://fedorahosted.org/sssd/ticket/2643 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 4df706219e64527209f12ad0c7814ee1be979c07) (cherry picked from commit 8f57c6765b10de36582ef1dbee32d75452451a94)
* Option filter_users had no effect for retrieving sudo rulesAdam Tkac2015-06-193-0/+39
| | | | | | | | | Previously sssd_sudo always obtained sudo rules for user from LDAP even when user was enlisted in filter_users. Resolves https://fedorahosted.org/sssd/ticket/2625 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Do not set gid 0 twiceLukas Slebodnik2015-06-191-7/+0
| | | | | | | | | | | | | | | | | | | | | | | The gid o was added to sysdb attrs directly in sdap_save_group for 1st time and for second time in the function sdap_store_group_with_gid, which was called every time from function sdap_save_group [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists](20)[attribute 'gidNumber': value #1 on 'name=domainlocalgroup1_dom2-493341@sssdad_tree.com,cn=groups,cn=sssdad_tree.com,cn=sysdb' provided more than once] [sysdb_set_entry_attr] (0x0040): Error: 17 (File exists) [sysdb_store_group] (0x1000): sysdb_set_group_attr failed. [sysdb_store_group] (0x0400): Error: 17 (File exists) [sdap_store_group_with_gid] (0x0040): Could not store group domainlocalgroup1_dom2-493341@sssdad_tree.com [sdap_save_group] (0x0080): Could not store group with GID: [File exists] [sdap_save_group] (0x0080): Failed to save group [domainlocalgroup1_dom2-493341@sssdad_tree.com]: [File exists] [sdap_save_groups] (0x0040): Failed to store group 0. Ignoring. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 5d864e7a9d0e1e6fb7dd8158c5b8bfb71040b908) (cherry picked from commit cf7047634308c431f4cfbff1d88564668d2a33c7)
* LDAP: unlink ccname_file_dummy if there is an errorDaniel Hjorth2015-06-191-2/+12
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2592 If there is an error after ccname_file_dummy is created but before it is renamed then the file isn't removed. This can cause a lot of files to be created and take up inodes in a filesystem. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 2b20ff2e33ad3993a9cad910c4b4b828513613df) (cherry picked from commit 0b5036e4c652e6983a3352c045c8701d6573587b)
* KRB5: Go offline in case of clock skewJakub Hrozek2015-06-191-0/+1
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1096 In case the KDC has skewed time, we can retry with the next one and eventually go offline if no KDC has time in sync with the client. Previously, authentication with wrong time resulted in System Error. (cherry picked from commit 83011d97d17bd00e99ccf1e0302167a6bc0db84e)
* memberof: check for empty arrays to avoid segfaultsSumit Bose2015-06-191-2/+2
| | | | | | | | | | | The arrays with members to add or delete may be empty, i.e. have 0 entries. In this case further processing should be skipped to avoid segfaults later on. Fixes (hopefully) https://fedorahosted.org/sssd/ticket/2430 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit a1bd8bc666df7fa696523ec8ec1dfe3d79780588)
* UTIL: Do not change SSSD domains in get_domains_headStephen Gallagher2015-06-191-3/+0
| | | | | | | | | | | | When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain. (cherry picked from commit a2147c6c13c36c0ec056581b08a7ed7352ff9861)
* Accept krb5 1.13 for building the PAC pluginNalin Dahyabhai2015-06-191-1/+2
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 9e1f638683cc5c229e8c0ea040c46d2cec58bd7c)
* build: Don't install ad and ipa man pages unnecessarilyNikolai Kondrashov2015-06-191-1/+5
| | | | | | | | Don't install sssd-ipa and sssd-ad man pages if corresponding providers weren't built (i.e. --without-samba was specified to configure). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> (cherry picked from commit 4b9c236008b35d2155b94635a236ce7770db4728)
* TESTS: sysdb_search_return_ENOENT - check mem leaksPavel Reichl2015-06-191-0/+2
| | | | | Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> (cherry picked from commit af63cdbfe0c917e0dc921232f67295fdc48d1e32)
* SYSDB: sysdb_search_custom fix memory leakPavel Reichl2015-06-191-5/+17
| | | | | | | Add temporally talloc context to allocate basedn on. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> (cherry picked from commit a4caef931a245fb3c44b70ea65a58bd0c1ff8dc4)
* SYSDB: sysdb_search_entry fix memory leakPavel Reichl2015-06-192-11/+22
| | | | | | | | Allocate res on tmp_ctx instead of on mem_ctx. Also use '_' prefix convention for output parameters. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> (cherry picked from commit 09579ae252c181c7884defc0612c36108f6cf509)
* TEST: Test empty results from functions sysdb_search_*Lukas Slebodnik2015-06-191-0/+148
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 4b0c83e022c396e984d862ced5b6219e4ef04429)
* LDAP: return after tevent_req_errorJakub Hrozek2015-05-111-0/+1
| | | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> (cherry picked from commit f1f5854566c1ee44320a1111a33c12bcc409f00a) (cherry picked from commit fec528a3929792d4ec2981d6f3db30d6286197e7)
* enumeration: fix talloc contextPavel Březina2015-04-082-2/+2
| | | | | | | | | | | | | | | | If for some reason ptask fails (e.g. timeout), req is talloc freed but because subreq is attached to ectx which is permanent it is finished anyway. Then a crash occures when we are trying to access callback data. The same happens in sdap_dom_enum_ex_send. Resolves: https://fedorahosted.org/sssd/ticket/2611 Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit 725bb2a9901c4f673b107ed179f5d68ec443ca63) (cherry picked from commit 81bb9be1ae0b2a4ebe960f136a52576abcdfbbac)
* sudo: return after tevent_req_errorPavel Reichl2015-01-301-0/+1
| | | | | | | Don't call tevent_req_done after tevent_req_error (for the same request). Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 979f969abe7a75a2f41f6fddabec94674ca3c722)
* SDAP: return after tevent_req_errorPavel Reichl2015-01-301-1/+2
| | | | | | | Don't call tevent_req_done after tevent_req_error (for the same request). Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 0d47aef7577f8cf651255cf59df87b3847dbe1ad)
* PROXY: Fix use after freeLukas Slebodnik2015-01-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The dbus_req and associated talloc context are no longer valid after execution of the function sbus_request_return_and_finish even if error code was returned. ==32479== Invalid read of size 8 ==32479== at 0x131F275F: client_registration (proxy_init.c:474) ==32479== by 0x529709E: sbus_request_invoke_or_finish (sssd_dbus_request.c:69) ==32479== by 0x52949B3: sbus_handler_got_caller_id (sssd_dbus_connection.c:555) ==32479== by 0x89B27E3: tevent_common_loop_immediate (tevent_immediate.c:135) ==32479== by 0x89B70CD: epoll_event_loop_once (tevent_epoll.c:907) ==32479== by 0x89B57D6: std_event_loop_once (tevent_standard.c:114) ==32479== by 0x89B1FBC: _tevent_loop_once (tevent.c:530) ==32479== by 0x89B215A: tevent_common_loop_wait (tevent.c:634) ==32479== by 0x89B5776: std_event_loop_wait (tevent_standard.c:140) ==32479== by 0x529E255: server_loop (server.c:668) ==32479== by 0x40DBC5: main (data_provider_be.c:2915) ==32479== Address 0xb700858 is 104 bytes inside a block of size 136 free'd ==32479== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==32479== by 0x8BBE462: _talloc_free (in /usr/lib64/libtalloc.so.2.1.1) ==32479== by 0x52971A4: sbus_request_finish (sssd_dbus_request.c:95) ==32479== by 0x529731A: sbus_request_return_and_finish (sssd_dbus_request.c:119) ==32479== by 0x131F264D: client_registration (proxy_init.c:443) ==32479== by 0x529709E: sbus_request_invoke_or_finish (sssd_dbus_request.c:69) ==32479== by 0x52949B3: sbus_handler_got_caller_id (sssd_dbus_connection.c:555) ==32479== by 0x89B27E3: tevent_common_loop_immediate (tevent_immediate.c:135) ==32479== by 0x89B70CD: epoll_event_loop_once (tevent_epoll.c:907) ==32479== by 0x89B57D6: std_event_loop_once (tevent_standard.c:114) ==32479== by 0x89B1FBC: _tevent_loop_once (tevent.c:530) ==32479== by 0x89B215A: tevent_common_loop_wait (tevent.c:634) Resolves: https://fedorahosted.org/sssd/ticket/2573 Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 33889b2ad764beb6b129f5211b1fab9790da8884) (cherry picked from commit 31dd2a8c5042493b24ef4f9360139525c018bcb4)
* LDAP: retain external membersPavel Reichl2015-01-133-0/+195
| | | | | | | | | | | When processing group membership check sysdb for group members from extern domain and include them in newly processed group membership as extern members are curently found only when initgroups() is called. Resolves: https://fedorahosted.org/sssd/ticket/2492 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Signals: Remove unused functionsSimo Sorce2015-01-082-59/+0
| | | | | | | | Cleanup unused signal functions (cherry picked from commit d054a96e102b53a3aab6602f531a0e8d254080ab) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: krb5_pac_verify failures should not be fatalJakub Hrozek2014-12-101-1/+10
| | | | | | | | | | | As noted in the MIT KRB5 documentation, some servers send PAC with no checksum, therefire the PAC validation should not be fatal, instead, we should treat a failure from krb5_pac_verify as if there was no PAC at all. Reported on sssd-devel by Thomas Sondergaard (cherry picked from commit 6e51d44a65b15c2f0491b0a8b452caac0bc00584)
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-12-091-3/+4
| | | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit 6a3ec7ba6f99b027c4c15a360ef0116fe60a0705)
* sss_client: Fix race condition in memory cacheLukas Slebodnik2014-11-244-13/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Thread safe initialisation was fixed in ticket #2380, but there is still race condition in reinitialisation. If caches is invalidated with command sss_cache -U (-G or -E) then client code will need to reinitialize fast memory cache. Let say we have two threads. The 1st thread find out that memory cache should be reinitialized; therefore the fast memory cached is unmapped and context destroyed. In the same time, 2nd thread tried to check header of memory cache whether it is initialized and valid. As a result of previously unmapped memory the 2nd thread access out of bound memory (SEGFAULT). The destroying of fast memory cache cannot be done any time. We need to be sure that there isn't any other thread which uses mmaped memory. The new counter of active threads was added for this purpose. The state of fast memory cache was converted from boolean to three value state (UNINITIALIZED, INITIALIZED, RECYCLED) UNINITIALIZED - the fast memory cache need to be initialized. - if there is a problem with initialisation the state will not change - after successful initialisation, the state will change to INITIALIZED INITIALIZED - if the cahe was invalidated or there is any other problem was detected in memory cache header the state will change to RECYCLED and memory cache IS NOT destroyed. RECYCLED - nothing will be done is there are any active threads which may use the data from mmaped memory - if there aren't active threads the fast memory cahe is destroyed and state is changed to UNINITIALIZED. https://fedorahosted.org/sssd/ticket/2445 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 6a60e29468fc6b4043a4dc52d3aab73e8465db70)
* sss_client: Extract destroying of mmap cache to functionLukas Slebodnik2014-11-241-16/+14
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 19f6a6733b5c6cf7dd2f6f746cfa5c787706331c)
* MAN: page edit for ldap_use_tokengroupsDan Lavu2014-11-201-0/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2448 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Disable token groups by defaultLukas Slebodnik2014-11-122-2/+2
| | | | | | | | | | | | | | | | | We tried to speed up processing of initgroup lookups with tokenGroups even for the LDAP provider (if remote server is Active Directory), but it turns out that there are too many corner cases that we didn't catch during development that break. For instance, groups from other trusted domains might appear in TG and the LDAP provider isn't equipped to handle them. Overall, users who wish to use the added speed benefits of tokenGroups are advised to use the AD provider. Resolves: https://fedorahosted.org/sssd/ticket/2483 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 5febf5ed0cfb4ba7665d8c3e36ee6941988da773)
* Revert "LDAP: Change defaults for ldap_user/group_objectsid"Lukas Slebodnik2014-11-102-6/+6
| | | | | | | | | | | | This reverts commit 29e5b5d17d9700022958bf1f59bb861cdf68bb57. OpenLDAP server cannot dereference unknown attributes. The attribute objectSID isn't in any standard objectclass on OpenLDAP server. This is a reason why objectSID cannot be set by default in rfc2307 map and rfc2307bis map. It is the same problem as using non standard attribute "nsUniqueId" in ticket https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: use ipaUserGroup object class for groupsPavel Březina2014-11-051-1/+1
| | | | | | | | | | | | | | dfb34c6c82ed5014599bf70de6791e6d79106fc2 changed object class of IPA groups from posixGroups to more general groupOfNames. However, this object class is used also for roles, permissions and privileges which caused SSSD to consider those objects to be groups as well during initgroups. Resolves: https://fedorahosted.org/sssd/ticket/2471 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 3937736546e2a4b7cccc58fded3efdff9ae690fc)
* build: call AC_BUILD_AUX_DIR before anything elseJan Engelhardt2014-10-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sssd's configure.ac (abridged) contains these lines: AC_INIT([sssd], ...) m4_ifdef([AC_USE_SYSTEM_EXTENSIONS], [AC_USE_SYSTEM_EXTENSIONS], [AC_GNU_SOURCE]) AC_CONFIG_AUX_DIR([build]) When turned into configure, this will be emitted: ac_aux_dir= for ac_dir in build "$srcdir"/build; do if test -f "$ac_dir/install-sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break However, with automake commit v1.14.1-36-g7bc5927, this will be emitted instead: ac_aux_dir= for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do if test -f "$ac_dir/install-sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break As configure no longer looks into build/ for install-sh, running ./configure fails: configure: error: cannot find install-sh, install.sh, or shtool in "." "./.." "./../.." I think the error is that someone placed AC_BUILD_AUX_DIR too late. Move it upwards. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 703dc1eb5b050b24235a6640f271d34ea008cf98)
* LDAP: Change defaults for ldap_user/group_objectsidMichal Zidek2014-10-232-6/+6
| | | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2361 https://fedorahosted.org/sssd/ticket/2472 Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit f834f712548db811695ea0fd6d6b31d3bd03e2a3)
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit a20ce8cd43d72c89e2ea1d65aefe24ba270f040f)
* Updating the version for the 1.11.8 developmentJakub Hrozek2014-09-171-1/+1
|
* Updating the translations for the 1.11.7 releasesssd-1_11_7Jakub Hrozek2014-09-1737-16334/+17587
|
* Use the alternative objectclass in group maps.Michal Zidek2014-09-157-29/+117
| | | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 7ba70236daccb48432350147d0560b3302518cee)
* Add alternative objectClass to group attribute mapsMichal Zidek2014-09-154-1/+7
| | | | | | | | | | | | | | In IPA we sometimes need to use posixGroup and sometimes groupOfNames objectclass to query the groups. This patch adds the possibility to specify alternative objectclass in group maps. By default it is only set for IPA. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 6f91c61426c8cfbfec52d5e77ae4650007694e69)
* Ignore referrals in deref and ASQ, tooJakub Hrozek2014-09-111-2/+18
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-082-4/+11
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 2284e50c801a53541016eb9a5af00d1250d36afb)
* AD: process non-posix nested groups using tokenGroupsPavel Reichl2014-09-081-8/+1
| | | | | | | | | | | When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 4932db6258ccfb612a3a28eb6a618c2f042b9d58)
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit 981bf55532fbec91a106f82d7daf32094c76dfe0)
* IPA: process non-posix nested groupsPavel Reichl2014-09-082-2/+2
| | | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com> (cherry picked from commit bc8c93ffe881271043492c938c626a9be948000e)
* Add user lookup and session dependencies to systemd service file.Ian Lee2014-09-081-0/+3
| | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1088619 Before permitting user sessions sssd should be running. This also correctly orders shutdown of sssd after the user sessions. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit ea0a71921ea396f5cc0e9e20d9a2aafc681b3eb9)
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-023-1/+14
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit a2ea3f5d9ef9f17efbb61e942c2bc6cff7d1ebf2)
* Replace space: add some checksSumit Bose2014-09-014-7/+33
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds some additional checks if the option for replacing spaces in user and group names is used. When replacing space with the replacement character it is checked if the name already contains the replacement character. If it does the unmodified name is returned because in this case a revers operation would not be possible. For the reverse operation is it checked if the input contains both a space and the replacement character. If this is true the unmodified name is returned as well, because we have to assume that it is the original name because otherwise it wouldn't contain both characters. Additionally a shortcut if the replacement characters is a space and tests for the new checks are added. The man page is updated accordingly. Related to https://fedorahosted.org/sssd/ticket/1854 and https://fedorahosted.org/sssd/ticket/2397 . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 92d19f76449817dfb125da9510d478a30eed37bc)
* LDAP: Enable tokenGroups with Windows Server 2003Jakub Hrozek2014-09-011-2/+2
| | | | | | | | | | | | | According to Microsoft documentation, the tokenGroups attribute is available since Windows 2000: http://msdn.microsoft.com/en-us/library/cc220937.aspx We were not able to test against Windows 2000, though, as we don't have that OS around, so this patch only changes the compatibility level to 2003. Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9)
generated by cgit (git 2.34.1) at 2024-04-25 13:01:12 +0000