summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Updating translations for the 1.12.1 releasesssd-1_12_1Jakub Hrozek2014-09-0837-18680/+31450
|
* LDAP: Check return valueJakub Hrozek2014-09-081-0/+6
| | | | | | Reported by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: delete stale GPOsYassir Elley2014-09-083-0/+134
| | | | | | https://fedorahosted.org/sssd/ticket/2431 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Add sss_rpcidmapd.5.xml to the list of translatable man pagesJakub Hrozek2014-09-081-0/+1
|
* libwbclient: avoid collision with Samba versionSumit Bose2014-09-086-11/+15
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_sifp: bump version to 0:1:0Pavel Březina2014-09-081-1/+1
| | | | | | Interface did not change, only the code. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* dlopen test: only test libwbclient when it is buildSumit Bose2014-09-081-0/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add a unit test for dereference parsingJakub Hrozek2014-09-081-1/+169
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-082-4/+11
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IFP: Suppress 'git diff' noiseMichal Zidek2014-09-081-159/+159
| | | | | | | | | | | | This patch suppresses the 'git diff' noise after ifp_iface_generated.c is generated. It simply changes the file to the same form it is being automatically generated so that 'git diff' only shows changes in the code and not the differently generated ifp_iface_generated.c file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: process non-posix nested groups using tokenGroupsPavel Reichl2014-09-081-8/+1
| | | | | | | | | | When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-09-082-2/+2
| | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD-GPO: processing changes for gpo_map_* optionsYassir Elley2014-09-085-23/+460
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: config changes for gpo_map_* optionsYassir Elley2014-09-085-1/+362
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: man pageNoam Meltzer2014-09-084-1/+140
| | | | | | | | changes from previous patch: * fixed idmapd.conf example (sss plugin name) * squahsed the rpm spec into one commit Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add user lookup and session dependencies to systemd service file.Ian Lee2014-09-081-0/+3
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1088619 Before permitting user sessions sssd should be running. This also correctly orders shutdown of sssd after the user sessions. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pysss: test return value of realloc.Lukas Slebodnik2014-09-051-1/+5
| | | | | | | | | | It is not very likely that realloc will return NULL, but it's better to be defensive. src/python/pysss.c:774: var_assigned: Assigning: "groups" = null return value from "realloc". src/python/pysss.c:788: dereference: Dereferencing a null pointer "groups". Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-052-2/+3
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* refcount-tests: Do not force to run test in CK_FORK modeLukas Slebodnik2014-09-051-1/+0
| | | | | | | | | | | | | | | | | | There was an access to uninitialised data in old version of libcheck when tests were executed in fork mode. ==2842== Syscall param timer_create(evp) points to uninitialised byte(s) ==2842== at 0x977FE72: timer_create@@GLIBC_2.3.3 (timer_create.c:82) ==2842== by 0x4E3647B: srunner_run (in /usr/lib64/libcheck.so.0.0.0) ==2842== by 0x401616: main (refcount-tests.c:233) ==2842== Address 0xffefff460 is on thread 1's stack This bug is already fixed in check-0.9.14, but we want to execute tests with valgrind on older platforms. The refcount test had hardcoded CK_FORK in source code and therefore it could not be overwritten with environment variable, which we use in CI script. Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* LDAP: Don't reuse a single tevent callback for multiple requestsJakub Hrozek2014-09-051-27/+53
| | | | | | | | | | | | | | | | | | | | Several requests (deref, ASQ and SD) were using the same tevent callback. This worked fine for quite some time, because the callback only used the tevent_req variables. However, a recent patch changed the shared sdap_get_generic_done so that it also longer uses the 'state' variable. At that point, all requsts that re-used the sdap_get_generic_done request started failing becaus the type of the state variable was different. This patch makes sure the callbacks only manipulate their own data types. Moreover, sdap_get_generic_ext_done() was renamed because it's not really a tevent callback. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSS_CACHE: Allow sss_cache tool to flush SSH hosts cacheWilliam B2014-09-0511-18/+204
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2358 Signed-off-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: SSS_LDB_SEARCH - macro around ldb_searchPavel Reichl2014-09-054-80/+36
| | | | | | | | | | | | | This patch amends previous patch 5153e8b9793dea1e212ca08af0f77ea1d023cbb7. Macro SSS_LDB_SEARCH is used instead of using fuction sss_ldb_search as a wrapper around ldb_search which could lead to premature expansion of variadic parameters. Part of solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SPEC: Drop old OS conditions from spec file.Lukas Slebodnik2014-09-051-75/+4
| | | | | | | | | | | It can be possible to build current master without samba on rhel5, but the spec file would be very complicated. It is better to simplify spec file. Resolves: https://fedorahosted.org/sssd/ticket/1974 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Use netlink library version 3 for rhel7Lukas Slebodnik2014-09-051-1/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CI: Consider libcmocka-devel always presentNikolai Kondrashov2014-09-052-14/+4
| | | | | | | | | | | Add explicit dependency on libcmocka-devel when running on any Red Hat distros, as it turns out it exists everywhere, if only in EPEL distros, and even though the spec file doesn't require it. This makes the contrib/ci/run consider cmocka present on all the supported distros, so remove the corresponding condition as well. Reviewed-by: Michal Židek <mzidek@redhat.com>
* AUTOCONF: Update detection of libnfsidmapLukas Slebodnik2014-09-022-17/+20
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* AD: Ignore all errors if gpo is in permissive mode.Lukas Slebodnik2014-09-021-1/+18
| | | | | | | | | | | | | | | This patch prevents problems with user authentication if gpo is misconfigurated. [ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy target. [sdap_id_op_destroy] (0x4000): releasing operation connection [ad_gpo_access_done] (0x0040): GPO-based access control failed. [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No such file or directory) [Internal Error (System error)] [be_pam_handler_callback] (0x0100): Sending result [4][sssdad.com] [be_pam_handler_callback] (0x0100): Sent result [4][sssdad.com] Reviewed-by: Yassir Elley <yelley@redhat.com>
* CI: Add libnfsidmap-dev Debian dependencyNikolai Kondrashov2014-09-021-0/+1
| | | | | | | Add libnfsidmap-dev to CI Debian dependency list. This fixes CI builds on Debian. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-023-8/+20
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* libwbclient: make build optionalSumit Bose2014-09-023-8/+28
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Doxygen: replace <pre> with markdown tableSumit Bose2014-09-021-18/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: add to RPM specNoam Meltzer2014-09-021-0/+7
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NFSv4 client: add to build systemNoam Meltzer2014-09-024-0/+81
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NFSv4 client: (private) headers from libnfsidmapNoam Meltzer2014-09-021-0/+78
| | | | | | | | | | | | The private headers are needed in order to: nfsidmap_internal.h: * definition of struct trans_func * prototype for logger function cfg.h + queue.h: * prototype(s) for accessing rpc.idmpad configuration file Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NEW CLIENT: plugin for NFSv4 rpc.idmapdNoam Meltzer2014-09-021-0/+571
| | | | | | | | Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* LDAP: Set umask before calling mkstempJakub Hrozek2014-09-021-0/+3
| | | | | | | | | Even though we only call mkstemp to generate a random filename, it's a good practice to set and re-set umask before and after calling mkstemp. Silences a warning from Coverity static analyzer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Add basic support for CI test executionNikolai Kondrashov2014-09-0212-1/+1056
| | | | | | | | | | | | | | | Add basic support for executing continuous integration (CI) tests on RHEL6, RHEL7, Fedora 20, Fedora Rawhide and Debian Testing. This adds two front-end scripts which can be executed either locally by developers, or on a CI server: contrib/ci/run and contrib/ci/clean. The first one will run the tests and the second will wipe out the artifacts. See contrib/ci/README.md for further details. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Implement MIT Kerberos localauth pluginSumit Bose2014-09-022-2/+167
| | | | | | | | | | | | | | | | | The MIT Kerberos localauth pluing interface defines two different calls. The first checks if a given Kerberos principal relates to a given name of a local user (userok). The implementation lets SSSD resolve the principal and the user name and if the returned user entries both have the same UID success is returned. The second translates a given Kerberos principal to a local user name (a2l). Here SSSD is only called once to resolve the principal and the user name is returned. Resolves https://fedorahosted.org/sssd/ticket/1835 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add conditional build for MIT Kerberos localauth pluginSumit Bose2014-09-025-0/+78
| | | | | | | | This patch adds everything what is needed to build the MIT Kerberos localauth plugin if the used version of MIT Kerberos supports it. It does not implement the plugin. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add unit tests for the GPO interfaceJakub Hrozek2014-09-011-0/+100
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Replace space: add some checksSumit Bose2014-09-014-7/+33
| | | | | | | | | | | | | | | | | | | | | | | This patch adds some additional checks if the option for replacing spaces in user and group names is used. When replacing space with the replacement character it is checked if the name already contains the replacement character. If it does the unmodified name is returned because in this case a revers operation would not be possible. For the reverse operation is it checked if the input contains both a space and the replacement character. If this is true the unmodified name is returned as well, because we have to assume that it is the original name because otherwise it wouldn't contain both characters. Additionally a shortcut if the replacement characters is a space and tests for the new checks are added. The man page is updated accordingly. Related to https://fedorahosted.org/sssd/ticket/1854 and https://fedorahosted.org/sssd/ticket/2397 . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Fix a conversion of seconds to hoursLukas Slebodnik2014-09-011-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2423 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-014-23/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-013-10/+12
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
* PAM: remove ldb_result member from pam_auth_req contextSumit Bose2014-09-012-6/+6
| | | | | This member was used only in a single call where a local variable suits better.
* PAM: extract checks from parsing routinesSumit Bose2014-09-013-34/+20
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* LDAP: If extra_value is 'U' do a UPN searchSumit Bose2014-09-014-4/+25
| | | | | | | | | | | Besides the name the responders always send an extra string attribute to the backends which is so far mostly empty. Since the only difference in the processing of a request for a user name or a user principal name is a different search attribute in the LDAP provider this extra value can be used to indicate the type of the name. Providers which do not support UPN lookup can just ignore this attribute. Related to https://fedorahosted.org/sssd/ticket/1749
* sysdb_get_real_name: allow UPN as inputSumit Bose2014-09-011-5/+11
|
* LDAP: Enable tokenGroups with Windows Server 2003Jakub Hrozek2014-09-011-2/+2
| | | | | | | | | | | | According to Microsoft documentation, the tokenGroups attribute is available since Windows 2000: http://msdn.microsoft.com/en-us/library/cc220937.aspx We were not able to test against Windows 2000, though, as we don't have that OS around, so this patch only changes the compatibility level to 2003. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-25 05:24:53 +0000