| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
|
| |
In several places, we were creating a new timer and assigning it
to the tev variable, but then we were checking for NULL from the
te variable (which, incidentally, is guaranteed never to be NULL
in this situation)
https://fedorahosted.org/sssd/ticket/523
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/514
|
|
|
|
|
|
|
| |
Failing to return after the tevent_req_post() here can result in a
null-pointer dereference (along with other hard-to-track bugs)
https://fedorahosted.org/sssd/ticket/507
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/506
|
|
|
|
| |
Addressing ticket #504
|
|
|
|
|
|
|
| |
Addressing coverity issue. Ticket #513.
The memory was really leaked when
the configuration value was empty.
Added unit test that confirmed the bug.
|
| |
|
|
|
|
|
|
|
| |
We need to guarantee at all times that reads and writes complete
successfully. This means that they must be checked for returning
EINTR and EAGAIN, and all writes must be wrapped in a loop to
ensure that they do not truncate their output.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
Switch statement missing a break causes unintended implicit setting of
'm' options in sss_useradd.
Fixes: #512
|
| |
|
| |
|
|
|
|
|
| |
Also update manpage for min_id/max_id to be more clear about how
it relates to primary GID.
|
|
|
|
|
|
|
|
| |
Under certain circumstances, the openldap libraries will continue
internally trying to reconnect to a connection lost (as during a
cable-pull test). We need to drop the reconnection callbacks when
marking the backend offline in order to guarantee that they are
not called with an invalid sdap_handle.
|
|
|
|
| |
Fixes: #518
|
|
|
|
| |
Fixes: #505
|
|
|
|
| |
Fixes: #510
|
|
|
|
| |
Fixes: #508
|
|
|
|
| |
We weren't properly linking libsss_krb5.so against libkeyutils
|
|
|
|
| |
Fixes: #488
|
|
|
|
|
|
| |
OpenLDAP < 2.4 used LDAP_OPT_ERROR_STRING. It was changed to
LDAP_OPT_DIAGNOSTIC_MESSAGE in 2.4. This patch will allow the TLS
error messages to be displayed on either version.
|
| |
|
|
|
|
| |
Fixes: #496
|
|
|
|
| |
Caused the kerberos provider to not use the kernel keyring
|
|
|
|
|
|
|
|
| |
sysdb_attrs_get_el() creates an empty element in the sysdb_attrs
structure if the requested element does not exist. Recent versions of
libldb do not accept empty elements when writing new objects to disk.
sysdb_attrs_get_string_array() does not create an empty element but
returns ENOENT.
|
| |
|
| |
|
|
|
|
|
|
|
| |
The ccache file was removed too early if system is offline but the
backend was not already marked offline. Now we remove the ccache file
only if the successfully got a new one and it is not the same as the old
one.
|
| |
|
| |
|
| |
|
|
|
|
|
| |
We were not passing the old authtok to the pam_chauthtok()
function, causing it to return PAM_AUTH_ERR.
|
|
|
|
|
|
|
| |
We weren't zeroing out the proxy_auth_ctx when we created it, so
the 'running' element was sometimes being filled with garbage data
that exceeded the maximum number of child processes. This meant
that no requests were ever sent to the child processes.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds a new tevent_req to the proxy provider, which will
spawn short-lived child processes to handle PAM requests. These
processes then call the proxied PAM stack and return the results
via SBUS method reply. Once it is returned, the parent process
kills the child.
There is a maximum of ten child processes running simultaneously,
after which requests will be queued for sending once a child slot
frees up. The maximum processes will be made configurable at a
later date (as this would violate string freeze).
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
Updated EntryCache*Timeout to the correct values.
Fixed one missed EntryCacheTimeout
Added notes about perf hit of using enumeration.
|
| |
|
|
|
|
|
|
|
|
| |
Instead of just using references to the pam data inside of the DBus
message the data is copied. New the DBus message can be freed at any
time and the pam data is part of the memory hierarchy. Additionally it
is possible to overwrite the authentication tokens in the DBus message,
because it is not used elsewhere.
|