summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* IPA: Mark globals in ipa_opts.h as externPavel Březina2015-12-143-297/+357
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Mark globals in ad_opts.h as externPavel Březina2015-12-143-242/+293
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Mark globals in ldap_opts.h as externPavel Březina2015-12-143-330/+393
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Add missing include to sysdb_services.hPavel Březina2015-12-141-0/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DEBUG: Add missing new linesLukas Slebodnik2015-12-147-14/+14
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* MAN: Clarify when should TGs be disabled for group nesting restrictionJakub Hrozek2015-12-111-2/+4
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2796 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Striker Leggette <striker@redhat.com>
* IPA_PROVIDER: Explicit no handle of servicesPetr Cech2015-12-111-1/+29
| | | | | | | | | | | Function get_object_from_cache() does not handle services. This patch adds quick shortcut to avoid sending an LDAP query to cache. Resolves: https://fedorahosted.org/sssd/ticket/2747 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: sssd.conf should mention SSS_NSS_USE_MEMCACHEMichal Židek2015-12-101-1/+7
| | | | | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2787 We already mention SSS_NSS_USE_MEMCACHE in sssd(8) but it makes sense to note it in sssd.conf(5) together with the memcache_timeout. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: check early for missing SID in mapping checkSumit Bose2015-12-101-0/+6
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2830 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Reduce code duplication in Data Provider handlersJakub Hrozek2015-12-101-167/+102
| | | | | | | | | | | | | Instead of setting the three same variables over again, add a structure be_sbus_reply_data with a default initializer BE_SBUS_REPLY_DATA_INIT. The handlers can then set the structure to BE_SBUS_REPLY_DATA_INIT on declaration or set a particular value with be_sbus_reply_data_set. The handler can also reply to the message (typically on failure state) with be_sbus_req_reply_data() Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Reduce code duplication in the callback handlersJakub Hrozek2015-12-104-232/+137
| | | | | | | Instead of calling sbus_request_return_and_finish() directly with the same checks copied over, add a be_sbus_reply() helper instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Clarify that subdomains always use service discoveryDan Lavu2015-12-101-3/+11
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Use search timeout, not enum timeout for searching overridesJakub Hrozek2015-12-091-1/+1
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2866 If the LDAP connection is still established when the client moves offline, we rely on the search timeout to find out the client is offline. The override search used the enum timeout defaults to 60 seconds. That caused too long delays in going offline. Reviewed-by: Sumit Bose <sbose@redhat.com>
* FO: Use tevent_req_defer_callback() when notifying callersJakub Hrozek2015-12-072-5/+59
| | | | | | | | | | | | | | If a fo_resolve_service callback would modify the server->common member in any way, for example by dereferencing the server and lowering the refcount to 0, which would free the common structure, then the next iteration of fo_resolve_service_done would access memory that was already gone. Please see https://tevent.samba.org/group__tevent__request.html#ga09373077d0b39e321a196a86bfebf280 for more details. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Handle KRB5_REALM_UNKNOWN as ERR_NETWORK_IOJakub Hrozek2015-12-071-0/+1
| | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2866 This would help users who authenticate to AD trust servers while offline and see error messages such as: [get_and_save_tgt] (0x0020): 996: [-1765328230][Cannot find KDC for realm "AD.EXAMPLE.COM"] in the krb5_child.log Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Handle preauth request timeout more gracefullyJakub Hrozek2015-12-071-0/+5
| | | | | | | | The error itself doesn't matter that much, because pam_sss.so handles all preauth errors gracefully already, but the issue triggered a loud and confusing debug message in the logs. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* URL in BUILD.txt is incorrectDan Lavu2015-11-301-1/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Clarify that subdomain_inherit only works for IPA and ADDan Lavu2015-11-301-0/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2683 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* man sssd-ad: fix typoPavel Březina2015-11-271-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* initgr: only search for primary group if it is not already cachedSumit Bose2015-11-271-21/+36
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2868 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ldap: skip sdap_save_grpmem() if ignore_group_members is setSumit Bose2015-11-271-0/+8
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2868 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Add autofs providerJakub Hrozek2015-11-269-4/+150
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1632 Adds the possibility to configure: autofs_provider = ad The AD autofs provider uses the rfc2307 (nis*) attribute maps. This is different (at the moment) from using autofs_provider=ldap with ldap_schema=ad. Reviewed-by: Ondrej Valousek <ondrejv2@fedoraproject.org> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Changes to allow SSSD to be used for access control with a machine account ↵Mathieu Deaudelin-Lemay2015-11-261-1/+6
| | | | | | | | | belonging to a domain controller. Resolves: https://fedorahosted.org/sssd/ticket/2870 Reviewed-by: Sumit Bose <sbose@redhat.com>
* p11: enable ocsp checksSumit Bose2015-11-2618-22/+210
| | | | | | | | | | | This patch enables the Online Certificate Status Protocol in NSS and adds an option to disable it if needed. To make further tuning of certificate verification more easy it is not an option on its own but an option to the new certificate_verification configuration option. Resolves https://fedorahosted.org/sssd/ticket/2812 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: check if cert is valid before selecting itSumit Bose2015-11-261-10/+12
| | | | | | | | | | Currently the first certificate was selected and if it was not valid p11_child just returned an error. With this patch the validity is checked first and the first valid certificate is selected. Resolves https://fedorahosted.org/sssd/ticket/2801 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Only install polkit rules if the directory is availableJakub Hrozek2015-11-264-1/+30
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONTRIB: Add a gdb pretty-printer for ldb and sysdb_attrsJakub Hrozek2015-11-231-0/+196
| | | | | | | | | | | | | | | | Printing ldb structures and sysdb_attrs can be a pain. This patch adds a gdb pretty-printer to help SSSD and LDB debugging plugins Activate them by putting: source /path/to/this/file.py to your .gdbinit file To bypass the pretty printer and print the raw values, use the "/r" option: print /r foobar Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb-tests: Fix warning - incompatible pointer typePavel Reichl2015-11-211-2/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* CI: Update suppression file for 32bit el6Lukas Slebodnik2015-11-201-0/+2
| | | | | | | | | Some extra functions were in stack trace on 32 bit architecture. It might be caused by different optimisation on different platforms. As a result of this mismatch, the suppression did not match on 32 bit architecture and it was reported as new memory related error. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: allow p11_child to run completely unprivilegedSumit Bose2015-11-205-26/+38
| | | | | | | | | | | | | | | | To only operation of p11_child which requires special privileges is the communication to pcscd which handles the Smartcard access. pcscd uses policy-kit for access control so access can easily be configured by dropping config snippets into the right directory. If SSSD is configured to run as un-privileged user this patch creates the needed config snippet for policy-kit and installs it in a suitable directory. As a result p11_child does not have to be installed with SETUID or SETGID bits set. Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: fix override with the same nameSumit Bose2015-11-204-10/+103
| | | | | | | | | | | | | If the user name of a AD user is overridden with the name itself in an IPA override object SSSD adds this name twice to the alias list causing an ldb error when trying to write the user object to the cache. As a result the user is not available. This patch makes sure that there are no duplicated alias names. Resolves https://fedorahosted.org/sssd/ticket/2874 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Do not confuse static analysers with dead codeJakub Hrozek2015-11-201-1/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus_codegen_tests: Use portable definition of large constantsLukas Slebodnik2015-11-201-12/+13
| | | | | | | | | | | | There were warnings on 32 bit architecture related to 64bit integer constants. /home/build/sssd/src/tests/sbus_codegen_tests.c:257: warning: integer constant is too large for ‘long’ type /home/build/sssd/src/tests/sbus_codegen_tests.c:259: warning: integer constant is too large for ‘long’ type INT${N}_C(value) are defined in the standard c99 Reviewed-by: Michal Židek <mzidek@redhat.com>
* ldap_local_override_test: Fix failure with python2.6Lukas Slebodnik2015-11-191-5/+24
| | | | | | | In python 2.6, the module subprocess does not have the function check_output. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_local_override_test: Remove sss_cache from teardownMichal Židek2015-11-191-1/+0
| | | | | | | | | The local override tests were added after we alredy removed the sss_cache call from teardowns in other tests. See commit: 782d39e3916d16b8dbba6ae97aca1db2f3c35d76 Revert "intg: Invalidate memory cache before removing files" Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* intg: Add test for user and group local overridesPavel Reichl2015-11-142-0/+936
| | | | | | | | | | | Introduce a new integration test for local view overrides. Regression tests for: #2790, #2757 and #2802. Resolves: https://fedorahosted.org/sssd/ticket/2732 Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* intg: Add more LDAP testsNikolai Kondrashov2015-11-141-0/+361
| | | | | | | | | | | | | | Add a bunch of LDAP tests. * Adding/removing a user/group/membership with rfc2307(bis) schema. * The effect of override_homedir option. * The effect of fallback_homedir option. * The effect of override_shell option. * The effect of shell_fallback option. * The effect of default_shell option. * The effect of vetoed_shells option. Reviewed-by: Michal Židek <mzidek@redhat.com>
* sbus: Check string arguments for valid UTF-8 stringsJakub Hrozek2015-11-143-1/+103
| | | | | | | | libdbus abort()s when a string argument is not valid UTF-8. Since the arguments sometimes come from untrusted sources, it's better to check the string validity explicitly. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Check callback messages for valid UTF-8Jakub Hrozek2015-11-141-16/+30
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2861 Messages passed from Data Provider to responder must be valid UTF-8 strings. Because providers might not be completely under our control, we need to check if the messages we receive are valid UTF-8 and if they are not, use a fallback. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Drop dp_pam_err_to_stringJakub Hrozek2015-11-141-52/+23
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2861 All back end requests were using pam_strerror() to print additional info about why request failed. Since pam_strerror() returns localized message and we don't know the locale beforehand, this message failed to be transferred through D-Bus, resulting in a crash. Reviewed-by: Sumit Bose <sbose@redhat.com>
* test_sysdb_subdomains: Do not use assignment in assertionsLukas Slebodnik2015-11-141-9/+9
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_groups_by_recent_filter_validPetr Cech2015-11-141-0/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test groups_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). groups_by_filter_valid() --> group_by_recent_filter_valid() grous_by_recent_filter_valid() The first of new tests, group_by_recent_filter_valid(), counts with two groups. One is stored before filter request creation and the second group is stored after filter request creation. So filter returns only one group. The second of new tests, groups_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two groups are stored after filter request creation. So filter returns two groups. This patch adds groups_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-6/+17
| | | | | | | | | | | We need little more in backroung of responder_cache_req tests. There will be tests which will use three test groups. This patch add support for it. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_group_by_recent_filter_validPetr Cech2015-11-141-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test groups_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). groups_by_filter_valid() --> group_by_recent_filter_valid() grous_by_recent_filter_valid() The first of new tests, group_by_recent_filter_valid(), counts with two groups. One is stored before filter request creation and the second group is stored after filter request creation. So filter returns only one group. The second of new tests, groups_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two groups are stored after filter request creation. So filter returns two groups. This patch adds group_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_users_by_recent_filter_validPetr Cech2015-11-141-1/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test users_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). users_by_filter_valid() --> user_by_recent_filter_valid() users_by_recent_filter_valid() The first of new tests, user_by_recent_filter_valid(), counts with two users. One is stored before filter request creation and the second user is stored after filter request creation. So filter returns only one user. The second of new tests, users_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two users are stored after filter request creation. So filter returns two users. This patch adds users_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add common function are_values_in_array()Petr Cech2015-11-142-0/+29
| | | | | | | | | | | This patch adds function are_values_in_array() to common test code. And there is tc_are_values_in_array macro defined which is usefull for talloc allocated values and arrays. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-15/+46
| | | | | | | | | | | We need little more in background of responder_cache_req tests. There will be tests which will use three test users. This patch add support for it. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-2/+4
| | | | | | | | | | This patch only defines constant TEST_USER_PREFIX. So code will be more redeable. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_user_by_recent_filter_validPetr Cech2015-11-141-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | Test users_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). users_by_filter_valid() --> user_by_recent_filter_valid() users_by_recent_filter_valid() The first of new tests, user_by_recent_filter_valid(), counts with two users. One is stored before filter request creation and the second user is stored after filter request creation. So filter returns only one user. The second of new tests, users_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two users are stored after filter request creation. So filter returns two users. This patch adds user_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSD: Add a new option diag_cmdJakub Hrozek2015-11-135-22/+198
| | | | | | | | | | | | | | | | | | | | This option is an optional one that is run when a sbus ping times out and before a SIGKILL signal is sent. It is undocumented by default. diag_cmd (string): A command that should be run for diagnostic purpose when an sbus timeout fails. The option value may contain %p which would be expanded for the process ID of the process that timed out Example: pstack %p This setting would print the stackstrace of the service whose ping timed out. Default: not set. Reviewed-by: Petr Cech <pcech@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 10:00:21 +0000