summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Updating translations for the 1.10.1 releasesssd-1_10_1Jakub Hrozek2013-07-1834-149/+200
|
* KRB: Replace multiple calls with variableOndrej Kos2013-07-181-6/+9
| | | | | Instead of multiple calls of sss_authtok_get_type, perform the call just once and store into variable.
* KRB: Handle empty password gracefullyOndrej Kos2013-07-181-0/+11
| | | | | | https://fedorahosted.org/sssd/ticket/1814 Return authentication error when empty password is passed.
* Do not try to set password when authtok_length is zeroOndrej Kos2013-07-181-2/+6
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1814 When the authtok_length is zero, it shouldn't call sss_authtok_set_password, because it tries to determine lenght of passed string by itself and would read parts of DBus message behind boundaries of authtok.
* SIGCHLD handler: do not call callback when pvt data where freedPavel Březina2013-07-175-5/+37
| | | | https://fedorahosted.org/sssd/ticket/1992
* dyndns timeout test: catch SIGCHLD handler eventsPavel Březina2013-07-171-0/+12
| | | | | | https://fedorahosted.org/sssd/ticket/1992 dyndns test will crash with this patch
* RPM: Require libsss_idmap from sssd-commonJakub Hrozek2013-07-171-3/+1
| | | | | The NSS responder recently started using libsss_idmap in the getbysid functions. The bug itself was spotted by one of our automated QA tools.
* Every time use permissive control in function memberof_mod.Lukas Slebodnik2013-07-171-0/+7
| | | | | | | | | | | Storing cyclic groups into sysdb can cause adding ghost members, which has already been stored. Function ldb_modify will fail with error [Attribute or value exists]. With permisive control, duplicated attributes will be skipped as if it was never added. https://fedorahosted.org/sssd/ticket/1846
* print hint about password complexity when new password is rejectedPavel Březina2013-07-172-1/+15
| | | | https://fedorahosted.org/sssd/ticket/1827
* Return right directory name for dircacheLukas Slebodnik2013-07-111-6/+10
| | | | | | | Dircache can be either file or directory. Wrong value was used when dircache was itself directory. https://fedorahosted.org/sssd/ticket/2002
* Always set port status to neutral when resetting service.Michal Zidek2013-07-111-1/+2
| | | | | | | | We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
* KRB5_CHILD: Fix handling of get_password return codeOndrej Kos2013-07-101-4/+10
| | | | The switch statement was dead code due to missing case/default.
* Do not copy special files when creating homedirOndrej Kos2013-07-102-73/+6
|
* DB: sysdb_search_user_by_name: search by both name and aliasJakub Hrozek2013-07-092-6/+36
|
* Move sssd_pac binary to the IPA and AD providersStephen Gallagher2013-07-021-5/+8
| | | | | This will ensure that we aren't pulling in extra samba4 dependencies for the Kerberos provider.
* RPM: Move sssd_pac to the krb5-common subpackageJakub Hrozek2013-07-021-4/+4
| | | | The PAC responder is now used by both IPA and AD providers.
* Remove sysv->systemd upgrade routinesStephen Gallagher2013-07-021-12/+0
| | | | | There are no longer any Fedora platforms running SSSD with SYSV init scripts. We don't need the upgrade logic any more.
* Move pre and post scripts to sssd-commonStephen Gallagher2013-07-021-5/+5
|
* ldap: only update shadowLastChange when password change is successfulJim Collins2013-07-011-1/+2
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
* Updating the version for the 1.10.1 releaseJakub Hrozek2013-06-271-1/+1
|
* Update the version for the 1.10.0 releasesssd-1_10_0Jakub Hrozek2013-06-271-1/+1
|
* Update the translations for the 1.10.0 releaseJakub Hrozek2013-06-2737-996/+768
|
* Do not call sss_cmd_done in function check_cache.Lukas Slebodnik2013-06-271-6/+0
| | | | | | | | Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done was called. Inside of function sss_cmd_done memory was freed, but this freed memory was used in caller functions, therefore sssd crashed. https://fedorahosted.org/sssd/ticket/1980
* Handle too many results from getnetgr.Lukas Slebodnik2013-06-271-1/+13
|
* SSH: Update known_hosts file after unsuccessful requests as well.Jan Cholasta2013-06-271-20/+36
| | | | https://fedorahosted.org/sssd/ticket/1949
* SSH: When host is removed from LDAP, remove it from the cache as wellJan Cholasta2013-06-271-1/+8
| | | | https://fedorahosted.org/sssd/ticket/1949
* Add missing argument to DEBUG messageLukas Slebodnik2013-06-271-1/+1
|
* Fix compilation warningJakub Hrozek2013-06-271-1/+1
|
* AD: Write out domain-realm mappingsJakub Hrozek2013-06-277-189/+197
| | | | | This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
* KRB5: guess UPN for subdomain usersJakub Hrozek2013-06-277-18/+43
|
* sudo responder: use different callback for oob refreshPavel Březina2013-06-271-6/+8
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1693 Since we don't care about returned values from out of band refresh, we do not need to set callback data. However, this caused talloc to abort as it considers it as type mismatch when called from tevent_req_callback_data().
* AD: kinit with the local DC even when talking to a GCJakub Hrozek2013-06-262-4/+21
| | | | | | | | We tried to use the GC address even for kinit which gave us errors like: "Realm not local to KDC while getting initial credentials". This patch adds a new AD_GC service that is only used for ID lookups, any sort of Kerberos operations are done against the local servers.
* Use forest for GC SRV lookupsSumit Bose2013-06-261-12/+40
| | | | https://fedorahosted.org/sssd/ticket/1973
* Do not switch to credentials everytime.Lukas Slebodnik2013-06-261-4/+69
| | | | | | | | | If user decide to kinit as another user we do not want to switch back to user ccache at another login. We will switch to new ccache if and only if default principal name is the same as current principal name, or there is not any default ccache. https://fedorahosted.org/sssd/ticket/1936
* Every time return directory for krb5 cache collection.Lukas Slebodnik2013-06-262-4/+64
| | | | | | | | Function krb5_cc_get_full_name is called only as a way to validate that, we have the right cache. Instead of returned name, location will be returned from function cc_dir_cache_for_princ. https://fedorahosted.org/sssd/ticket/1936
* Fix wrong detection of krb5 ccnameLukas Slebodnik2013-06-261-1/+4
| | | | | DIR:/run/user/1000/krb5cc is valid ccname, but function sss_krb5_cc_file_path returned NULL in this case.
* Revert "Implicitly activate the PAC responder for AD provider"Sumit Bose2013-06-261-2/+1
| | | | This reverts commit 7527ec8ab2b79ec576ace2da9e2c158b849adfa6.
* fix dead code in fail_over_srv.cPavel Březina2013-06-251-11/+12
| | | | | | | | https://fedorahosted.org/sssd/ticket/1969 The dead code is in fo_discover_servers_primary_done(). By fixing it I have also added a debug message on ret != EOK. This change is done also in fo_discover_servers_backup_done().
* init script: source /etc/sysconfig/sssdPavel Březina2013-06-254-0/+19
| | | | https://fedorahosted.org/sssd/ticket/1959
* krb5: do not use enterprise principals for renewalsSumit Bose2013-06-251-1/+6
| | | | | | When renewing a ticket we already know the canonical principal hence it is not needed to expand it to an enterprise principal but we can contact the KDC of the corresponding realm directly.
* krb5: do not send pac for IPA users from the local domainSumit Bose2013-06-255-10/+20
| | | | | | | | | | | | | So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
* Revert "Always send the PAC to the PAC responder"Sumit Bose2013-06-251-18/+20
| | | | This reverts commit d153941864fe481399665be8fe583c9317194a99.
* Fix typo in pack_authtok()Sumit Bose2013-06-241-1/+1
|
* KRB5: use the right authtok type for renewalsSumit Bose2013-06-241-3/+20
|
* IPA: Do not download or store the member attribute of host groupsJakub Hrozek2013-06-242-2/+0
| | | | | | | | https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
* PAC: do not delete originalDN or cached password if presentSumit Bose2013-06-241-1/+26
| | | | | | | | | | | If the PAC responder recognizes some attribute changes between the cached user entry and the PAC data it quite crudely just removes the cached entry and recreates it. While in most cases all needed data can be recovered from the PAC data there is a case where it is not possible. E.g the IPA HBAC code use the OriginalDN attribute to improve performance when evaluating access rules. This patch makes sure this attribute is not lost when the PAC responder updates the object.
* LDAP: Retry SID search based on result of LDAP search, not the return codeJakub Hrozek2013-06-241-2/+13
|
* failover: if expanded server is marked as neutral, invoke srv collapsePavel Březina2013-06-211-0/+7
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1947 Otherwise we will do the SRV expansion once again: 1. leaving the old servers in server list 2. meta server is not inserted back in the list, the newly found servers are inserted behind meta server, meta server is orphaned and the new servers are forgotten
* collapse_srv_lookup may free the server, make it clear from the APIPavel Březina2013-06-211-6/+9
| | | | https://fedorahosted.org/sssd/ticket/1947
* failover: return error when SRV lookup returned only duplicatesPavel Březina2013-06-213-2/+23
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1947 Otherwise we risk that the meta server is removed from the server list, but without a chance to return, because there may be no fo_server with srv_data = meta. Also if state->meta->next is NULL (it is still orphaned because we try to errornously expand it without invoking collapse first), state->out will be NULL and SSSD will crash. New error code: ERR_SRV_DUPLICATES