summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Updating the translations for the 1.10 alpha releasesssd-1_9_91sssd-1_10_alpha1Jakub Hrozek2013-04-0239-14769/+39742
|
* Improve syslog message when configuration cannot be loadedAriel Barria2013-04-021-1/+3
| | | | | | https://fedorahosted.org/sssd/ticket/1414 Error code was added and strerror(errno) to show cause in sss_log
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-0219-137/+186
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-025-4/+16
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* refactor nested group processing: replace old codePavel Březina2013-04-023-1721/+22
| | | | https://fedorahosted.org/sssd/ticket/1784
* refactor nested group processing: add new codePavel Březina2013-04-021-0/+2229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1784 1. initialization (main-req), returns members of input group 2. evaluate group members (group) 3. perform individual search (no-deref) or dereference attribute (deref) 4a. no-deref 1. perform a lookup depending on the type of the member object 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups 4b. deref 1. perform a dereference lookup on member attribute 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups Tevent request flow: main-req | group |------------------------| no-deref deref | | |----|------|---------| | user group unknown recurse recurse / \ | | | ... | | | ... user group group group
* Provide libnl3 supportOndrej Kos2013-03-276-85/+207
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/812 Update the monitor code to be using the new libnl3 API. Changed configure option --with-libnl By default, it tries to build with libnl3, if not found, then with libnl1, if this isn't found either, build proceeds without libnl, just with warning. Specifing --with-libnl=<libnl3|libnl1|no> checks for the specific given version, if not found, configure ends with error.
* selinux: Remove unused parameterJakub Hrozek2013-03-271-1/+0
| | | | https://fedorahosted.org/sssd/ticket/1848
* LDAP: Fix value initializationOndrej Kos2013-03-271-1/+1
|
* filename in comment is correctedAbhishek Singh2013-03-271-1/+1
|
* Update README fileOndrej Kos2013-03-261-1/+7
|
* sssd-1.8.0: work around a bug in cov-build from CoverityKamil Dudka2013-03-261-0/+3
|
* Include config.h to build io.c on RHEL5Jakub Hrozek2013-03-251-0/+2
|
* Document what does access_provider=ad doJakub Hrozek2013-03-211-0/+14
| | | | https://fedorahosted.org/sssd/ticket/1841
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-215-4/+50
| | | | https://fedorahosted.org/sssd/ticket/1660
* Move signal.m4 from src/util to externalJakub Hrozek2013-03-212-1/+1
|
* Fixing duplicate constLukas Slebodnik2013-03-211-3/+3
| | | | const char const * --> const char *const
* Return error code from ipa_subdom_storeJakub Hrozek2013-03-201-5/+13
|
* coding style fixPavel Březina2013-03-201-1/+1
|
* change responder contexts hierarchyPavel Březina2013-03-206-65/+94
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1575 The hierarchy is now: main_ctx -> responder_ctx -> specific_ctx where specific_ctx is one of sudo, pam, etc.
* do not leak memory on failure in *_process_init()Pavel Březina2013-03-207-35/+62
|
* tests: Print warning if LDB_MODULES_PATH is not setMichal Zidek2013-03-204-0/+21
| | | | | | | Print warning if sysdb-tests or sysdb-ssh test are run individually and LDB_MODULES_PATH was not set. https://fedorahosted.org/sssd/ticket/1820
* correct order in error_to_str tablePavel Březina2013-03-201-1/+1
| | | | Also fixed typo.
* BUILD: Always run distcheck and RPM tests in /dev/shmStephen Gallagher2013-03-203-1/+10
| | | | | | | | Some of the tests (such as the sysdb tests) are highly I/O limited. By running them on a ramdisk, we can significantly speed up the test runs when doing a distcheck or RPM build. https://fedorahosted.org/sssd/ticket/1840
* Making the ldb check configurableLukas Slebodnik2013-03-202-2/+17
| | | | | | | | | It is possible to enable/disable checking in LDB memberof plugin whether it was built against the same version of LDB that is present on the system. This feature is turned off by default and enabled in Fedora/RHEL spec file. https://fedorahosted.org/sssd/ticket/1813
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-2014-11/+228
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Convert sdap_access to new error codesSimo Sorce2013-03-197-480/+214
| | | | Also simplify sdap_access_send to avoid completely fake _send() routines.
* Resolve GIDs in the simple access providerJakub Hrozek2013-03-195-227/+926
| | | | | | | | | | | | | | Changes the simple access provider's interface to be asynchronous. When the simple access provider encounters a group that has gid, but no meaningful name, it attempts to resolve the name using the be_file_account_request function. Some providers (like the AD provider) might perform initgroups without resolving the group names. In order for the simple access provider to work correctly, we need to resolve the groups before performing the access check. In AD provider, the situation is even more tricky b/c the groups HAVE name, but their name attribute is set to SID and they are set as non-POSIX
* Do not compile main() in DP if UNIT_TESTING is definedJakub Hrozek2013-03-191-0/+2
| | | | | | | | | | | The simple access provider unit tests now need to link against the Data Provider when they start using the be_file_account_request() function. But then we would start having conflicts as at least the main() functions would clash. If UNIT_TESTING is defined, then the data_provider_be.c module does not contain the main() function and can be linked against directly from another module that contains its own main() function
* Add unit tests for simple access test by groupsJakub Hrozek2013-03-191-31/+253
| | | | | | | I realized that the current unit tests for the simple access provider only tested the user directives. To have a baseline and be able to detect new bugs in the upcoming patch, I implemented unit tests for the group lists, too.
* Provide a be_get_account_info_send functionJakub Hrozek2013-03-192-19/+144
| | | | | | | | | | | | | | In order to resolve group names in the simple access provider we need to contact the Data Provider in a generic fashion from the access provider. We can't call any particular implementation (like sdap_generic_send()) because we have no idea what kind of provider is configured as the id_provider. This patch splits introduces the be_file_account_request() function into the data_provider_be module and makes it public. A future patch should make the be_get_account_info function use the be_get_account_info_send function.
* Make the SELinux refresh time configurable.Michal Zidek2013-03-196-2/+24
| | | | Option ipa_selinux_refresh is added to basic ipa options.
* Reuse cached SELinux mappings.Michal Zidek2013-03-192-3/+29
| | | | | | | | Reuse cached SELinux maps when they are requested within time interval (in this patch it is hardcoded to be 5 seconds). https://fedorahosted.org/sssd/ticket/1744
* Move SELinux processing to provider.Michal Zidek2013-03-196-452/+393
| | | | | | | | | | | | The SELinux processing was distributed between provider and pam responder which resulted in hard to maintain code. This patch moves the logic to provider. IT ALSO REQUIRES CHANGE IN THE SELINUX POLICY, because the provider also writes the content of selinux login file to disk (which was done by responder before). https://fedorahosted.org/sssd/ticket/1743
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-194-15/+2
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Use common error facility instead of sdap_resultSimo Sorce2013-03-1911-355/+238
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* Decrease krb5_auth_timeout defaultOndrej Kos2013-03-184-4/+4
| | | | https://fedorahosted.org/sssd/ticket/1738
* Remove duplicate remake from bashrc_sssdJakub Hrozek2013-03-181-6/+0
|
* Retry the correct service on krb5 child timeoutJakub Hrozek2013-03-181-1/+1
|
* Fix sss_client breakage.Lukas Slebodnik2013-03-186-5/+52
| | | | | | | | | | Adding missing dependencies for linker. Missing dependency was introduced by commit 22d381367c27910fe82f476a76b9f4ede555e35a in changed file src/sss_client/nss_mc_common.c All function declaration for io.c was moved from util.h to separate file io.h, https://fedorahosted.org/sssd/ticket/1838
* Fix coverity issue 13136Ondrej Kos2013-03-181-0/+1
| | | | https://fedorahosted.org/sssd/ticket/1811
* Fix initialization of multiple variablesOndrej Kos2013-03-137-9/+8
|
* Removing unused header file providers.hLukas Slebodnik2013-03-133-176/+0
| | | | | | | | | Header file "providers.h" is not included in any other file and function "dp_process_init" declared in this header file has no implementation. Header file protos.h is not also included in any other file and even hole content is commented out.
* More generalized function open_debug_file_ex()Lukas Slebodnik2013-03-134-15/+9
| | | | | | | | Function open_debug_file_ex() set flag FD_CLOEXEC to opened file according to the value of third parameter. Removed duplicity of unsetting FD_CLOEXEC after calling function open_debug_file_ex()
* Reuse sss_open_cloexec at other places in code.Lukas Slebodnik2013-03-135-85/+103
| | | | | | | | Functions open_cloexec and openat_cloexec were renamed with prefix "sss_" and moved to separete file. Replacing duplicated code of function sss_open_cloexec everywhere in the source code. https://fedorahosted.org/sssd/ticket/1794
* BUILD: Fix up whitespace in Makefile.amStephen Gallagher2013-03-131-11/+13
|
* krb5-utils-tests: remove invalid conditionPavel Březina2013-03-131-2/+0
| | | | | This condition is invalid because different_realm is not set, when EINVAL is returned. It can make the test fail sometimes.
* fix segfault in nss responder unit testPavel Březina2013-03-131-1/+1
| | | | | | https://fedorahosted.org/sssd/ticket/1833 state is expected to be a pointer
* build: require libcmocka on fedora 18+Pavel Březina2013-03-131-0/+3
|
* BUILD: Fix cmocka detectionStephen Gallagher2013-03-112-1/+3
| | | | | | | | | | We were not properly detecting that cmocka was unavailable. It was expecting an empty value and getting "no" instead. This patch corrects the expectation, so we will now skip building and running cmocka tests on platforms that do not have it available. Also, we were missing the cmocka header files in the distribution tarball, so 'make distcheck' was failing.
generated by cgit (git 2.34.1) at 2024-04-26 17:46:25 +0000