summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* KRB5: Handle preauth request timeout more gracefullyJakub Hrozek2015-12-071-0/+5
| | | | | | | | The error itself doesn't matter that much, because pam_sss.so handles all preauth errors gracefully already, but the issue triggered a loud and confusing debug message in the logs. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* URL in BUILD.txt is incorrectDan Lavu2015-11-301-1/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Clarify that subdomain_inherit only works for IPA and ADDan Lavu2015-11-301-0/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2683 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* man sssd-ad: fix typoPavel Březina2015-11-271-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* initgr: only search for primary group if it is not already cachedSumit Bose2015-11-271-21/+36
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2868 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ldap: skip sdap_save_grpmem() if ignore_group_members is setSumit Bose2015-11-271-0/+8
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2868 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Add autofs providerJakub Hrozek2015-11-269-4/+150
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1632 Adds the possibility to configure: autofs_provider = ad The AD autofs provider uses the rfc2307 (nis*) attribute maps. This is different (at the moment) from using autofs_provider=ldap with ldap_schema=ad. Reviewed-by: Ondrej Valousek <ondrejv2@fedoraproject.org> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Changes to allow SSSD to be used for access control with a machine account ↵Mathieu Deaudelin-Lemay2015-11-261-1/+6
| | | | | | | | | belonging to a domain controller. Resolves: https://fedorahosted.org/sssd/ticket/2870 Reviewed-by: Sumit Bose <sbose@redhat.com>
* p11: enable ocsp checksSumit Bose2015-11-2618-22/+210
| | | | | | | | | | | This patch enables the Online Certificate Status Protocol in NSS and adds an option to disable it if needed. To make further tuning of certificate verification more easy it is not an option on its own but an option to the new certificate_verification configuration option. Resolves https://fedorahosted.org/sssd/ticket/2812 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: check if cert is valid before selecting itSumit Bose2015-11-261-10/+12
| | | | | | | | | | Currently the first certificate was selected and if it was not valid p11_child just returned an error. With this patch the validity is checked first and the first valid certificate is selected. Resolves https://fedorahosted.org/sssd/ticket/2801 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Only install polkit rules if the directory is availableJakub Hrozek2015-11-264-1/+30
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONTRIB: Add a gdb pretty-printer for ldb and sysdb_attrsJakub Hrozek2015-11-231-0/+196
| | | | | | | | | | | | | | | | Printing ldb structures and sysdb_attrs can be a pain. This patch adds a gdb pretty-printer to help SSSD and LDB debugging plugins Activate them by putting: source /path/to/this/file.py to your .gdbinit file To bypass the pretty printer and print the raw values, use the "/r" option: print /r foobar Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb-tests: Fix warning - incompatible pointer typePavel Reichl2015-11-211-2/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* CI: Update suppression file for 32bit el6Lukas Slebodnik2015-11-201-0/+2
| | | | | | | | | Some extra functions were in stack trace on 32 bit architecture. It might be caused by different optimisation on different platforms. As a result of this mismatch, the suppression did not match on 32 bit architecture and it was reported as new memory related error. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: allow p11_child to run completely unprivilegedSumit Bose2015-11-205-26/+38
| | | | | | | | | | | | | | | | To only operation of p11_child which requires special privileges is the communication to pcscd which handles the Smartcard access. pcscd uses policy-kit for access control so access can easily be configured by dropping config snippets into the right directory. If SSSD is configured to run as un-privileged user this patch creates the needed config snippet for policy-kit and installs it in a suitable directory. As a result p11_child does not have to be installed with SETUID or SETGID bits set. Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: fix override with the same nameSumit Bose2015-11-204-10/+103
| | | | | | | | | | | | | If the user name of a AD user is overridden with the name itself in an IPA override object SSSD adds this name twice to the alias list causing an ldb error when trying to write the user object to the cache. As a result the user is not available. This patch makes sure that there are no duplicated alias names. Resolves https://fedorahosted.org/sssd/ticket/2874 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP: Do not confuse static analysers with dead codeJakub Hrozek2015-11-201-1/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus_codegen_tests: Use portable definition of large constantsLukas Slebodnik2015-11-201-12/+13
| | | | | | | | | | | | There were warnings on 32 bit architecture related to 64bit integer constants. /home/build/sssd/src/tests/sbus_codegen_tests.c:257: warning: integer constant is too large for ‘long’ type /home/build/sssd/src/tests/sbus_codegen_tests.c:259: warning: integer constant is too large for ‘long’ type INT${N}_C(value) are defined in the standard c99 Reviewed-by: Michal Židek <mzidek@redhat.com>
* ldap_local_override_test: Fix failure with python2.6Lukas Slebodnik2015-11-191-5/+24
| | | | | | | In python 2.6, the module subprocess does not have the function check_output. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_local_override_test: Remove sss_cache from teardownMichal Židek2015-11-191-1/+0
| | | | | | | | | The local override tests were added after we alredy removed the sss_cache call from teardowns in other tests. See commit: 782d39e3916d16b8dbba6ae97aca1db2f3c35d76 Revert "intg: Invalidate memory cache before removing files" Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* intg: Add test for user and group local overridesPavel Reichl2015-11-142-0/+936
| | | | | | | | | | | Introduce a new integration test for local view overrides. Regression tests for: #2790, #2757 and #2802. Resolves: https://fedorahosted.org/sssd/ticket/2732 Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* intg: Add more LDAP testsNikolai Kondrashov2015-11-141-0/+361
| | | | | | | | | | | | | | Add a bunch of LDAP tests. * Adding/removing a user/group/membership with rfc2307(bis) schema. * The effect of override_homedir option. * The effect of fallback_homedir option. * The effect of override_shell option. * The effect of shell_fallback option. * The effect of default_shell option. * The effect of vetoed_shells option. Reviewed-by: Michal Židek <mzidek@redhat.com>
* sbus: Check string arguments for valid UTF-8 stringsJakub Hrozek2015-11-143-1/+103
| | | | | | | | libdbus abort()s when a string argument is not valid UTF-8. Since the arguments sometimes come from untrusted sources, it's better to check the string validity explicitly. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Check callback messages for valid UTF-8Jakub Hrozek2015-11-141-16/+30
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2861 Messages passed from Data Provider to responder must be valid UTF-8 strings. Because providers might not be completely under our control, we need to check if the messages we receive are valid UTF-8 and if they are not, use a fallback. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Drop dp_pam_err_to_stringJakub Hrozek2015-11-141-52/+23
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2861 All back end requests were using pam_strerror() to print additional info about why request failed. Since pam_strerror() returns localized message and we don't know the locale beforehand, this message failed to be transferred through D-Bus, resulting in a crash. Reviewed-by: Sumit Bose <sbose@redhat.com>
* test_sysdb_subdomains: Do not use assignment in assertionsLukas Slebodnik2015-11-141-9/+9
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_groups_by_recent_filter_validPetr Cech2015-11-141-0/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test groups_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). groups_by_filter_valid() --> group_by_recent_filter_valid() grous_by_recent_filter_valid() The first of new tests, group_by_recent_filter_valid(), counts with two groups. One is stored before filter request creation and the second group is stored after filter request creation. So filter returns only one group. The second of new tests, groups_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two groups are stored after filter request creation. So filter returns two groups. This patch adds groups_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-6/+17
| | | | | | | | | | | We need little more in backroung of responder_cache_req tests. There will be tests which will use three test groups. This patch add support for it. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_group_by_recent_filter_validPetr Cech2015-11-141-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test groups_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). groups_by_filter_valid() --> group_by_recent_filter_valid() grous_by_recent_filter_valid() The first of new tests, group_by_recent_filter_valid(), counts with two groups. One is stored before filter request creation and the second group is stored after filter request creation. So filter returns only one group. The second of new tests, groups_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two groups are stored after filter request creation. So filter returns two groups. This patch adds group_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_users_by_recent_filter_validPetr Cech2015-11-141-1/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test users_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). users_by_filter_valid() --> user_by_recent_filter_valid() users_by_recent_filter_valid() The first of new tests, user_by_recent_filter_valid(), counts with two users. One is stored before filter request creation and the second user is stored after filter request creation. So filter returns only one user. The second of new tests, users_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two users are stored after filter request creation. So filter returns two users. This patch adds users_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add common function are_values_in_array()Petr Cech2015-11-142-0/+29
| | | | | | | | | | | This patch adds function are_values_in_array() to common test code. And there is tc_are_values_in_array macro defined which is usefull for talloc allocated values and arrays. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-15/+46
| | | | | | | | | | | We need little more in background of responder_cache_req tests. There will be tests which will use three test users. This patch add support for it. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Refactor of test_responder_cache_req.cPetr Cech2015-11-141-2/+4
| | | | | | | | | | This patch only defines constant TEST_USER_PREFIX. So code will be more redeable. Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Add test_user_by_recent_filter_validPetr Cech2015-11-141-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | Test users_by_filter_valid() was removed in past. We will add two new tests instead of it. Logic of those tests is connected to RECENT filter. It returns only records which have been wrote or updated after filter was created (or another given time). users_by_filter_valid() --> user_by_recent_filter_valid() users_by_recent_filter_valid() The first of new tests, user_by_recent_filter_valid(), counts with two users. One is stored before filter request creation and the second user is stored after filter request creation. So filter returns only one user. The second of new tests, users_by_recent_filter_valid(), counts with three users. One is stored before filter request creation and two users are stored after filter request creation. So filter returns two users. This patch adds user_by_recent_filter_valid(). Resolves: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSD: Add a new option diag_cmdJakub Hrozek2015-11-135-22/+198
| | | | | | | | | | | | | | | | | | | | This option is an optional one that is run when a sbus ping times out and before a SIGKILL signal is sent. It is undocumented by default. diag_cmd (string): A command that should be run for diagnostic purpose when an sbus timeout fails. The option value may contain %p which would be expanded for the process ID of the process that timed out Example: pstack %p This setting would print the stackstrace of the service whose ping timed out. Default: not set. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: remove annoying debug messagePavel Březina2015-11-121-4/+0
| | | | | | | This debug message is mostly a left over from development and doesn't give us any useful information. It is just annoying in the logs. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIGURE: Bump AM_GNU_GETTEXT_VERSIONLukas Slebodnik2015-11-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The function gettext was not detected properly with strict cflags even thought it was part of glibc. sh$ CFLAGS="-Werror" ./configure sh$ grep gt_cv_func_gnugettext config.log gt_cv_func_gnugettext1_libc=no gt_cv_func_gnugettext1_libintl=no sh$ objdump -T /lib64/libc.so.6 | grep gettext 000000000002fc60 w DF .text 0000000000000010 GLIBC_2.2.5 dcngettext 000000000002dc70 w DF .text 000000000000000f GLIBC_2.2.5 dcgettext 000000000002fc80 w DF .text 0000000000000016 GLIBC_2.2.5 ngettext 000000000002dc90 w DF .text 000000000000000f GLIBC_2.2.5 gettext 000000000002dc70 g DF .text 000000000000000f GLIBC_2.2.5 __dcgettext 000000000002dc80 w DF .text 000000000000000a GLIBC_2.2.5 dgettext 000000000002dc80 g DF .text 000000000000000a GLIBC_2.2.5 __dgettext 000000000002fc70 w DF .text 000000000000000b GLIBC_2.2.5 dngettext Reviewed-by: Petr Cech <pcech@redhat.com>
* pam-srv-tests: Add UT for cached 'online' auth.Pavel Reichl2015-11-123-1/+194
| | | | | | | | | Extend PAM responder unit test to check 'online' cached authentication. Resolves: https://fedorahosted.org/sssd/ticket/2697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam-srv-tests: split pam_test_setup() so it can be reusedPavel Reichl2015-11-121-15/+19
| | | | | | | | | | Split pam_test_setup() so domain and pam parameters can be easily set distinctly for each test. Resolves: https://fedorahosted.org/sssd/ticket/2697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: check all domains for lookups by certificateSumit Bose2015-11-111-3/+4
| | | | | | | Like lookup by ID or by UPN the match for lookups by certificate can be found in any domain and all sub-domains must be included in the search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Revert "intg: Invalidate memory cache before removing files"Lukas Slebodnik2015-11-113-3/+0
| | | | | | | | | It is not necessary to invalidate memory cache before removing them. The sssd_client can handle it without any problem. This reverts commit eabc1732ef91548616a699b7e9f8d30e5e7b8dd3. Reviewed-by: Michal Židek <mzidek@redhat.com>
* test_memory_cache: Test removing mc without invalidationLukas Slebodnik2015-11-112-4/+38
| | | | | | | | | | | | Long living clients should be able to reinitialize memory cache which was removed but it not initialized. This patch also remove workaround in test_local_domain.py Test for: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sssd_client: Do not use removed memory cacheLukas Slebodnik2015-11-111-0/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Fix underflow of active_threadsLukas Slebodnik2015-11-111-0/+5
| | | | | | | | | | | | | | | | | | | | If the memory cache was not initialized and there was a failure in initialisation of memory cache context (e.g. memory cache file does not exist) then mc_context had to be destroyed to release resources. However the count of active threads in sss_cli_mc_ctx is already higher than zero because current thread is working wih the mc_context. But this counter was zero-ed with memset in sss_nss_mc_destroy_ctx due to issue with initialisation of memory cache. Then we have to decrease counter of active thread in function sss_nss_mc_get_ctx because initialisation of mc failed. And the result of this decrement is underflow of counter. Related to: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: Add warning for unused result of leak check functionsLukas Slebodnik2015-11-112-3/+30
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* TESTS: Make check_leaks static functionLukas Slebodnik2015-11-112-9/+4
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* TESTS: Check return value of check_leaks_popLukas Slebodnik2015-11-115-10/+16
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* TESTS: Initialize leak checkLukas Slebodnik2015-11-112-0/+6
| | | | | | | If leak_check_setup is not called then global_talloc_context was not initialized and check_leaks_pop(global_talloc_context) will fail. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Fix memory leak in switch_credsLukas Slebodnik2015-11-111-0/+1
| | | | | | | | If we are already requested used then we needn't to call setreeuid(), setresgid(). But we forgot to relase local struct sss_creds *ssc, which is used for returnig saved credentials. Reviewed-by: Petr Cech <pcech@redhat.com>
* IFP: Skip non-POSIX groups properlyJakub Hrozek2015-11-111-2/+4
| | | | | | | | | | | When ifp_users_user_get_groups is called, for example via GetAll and the list of groups contains a non-POSIX group, we skip an array member, resulting in random memory being passed to the caller. Resolves: https://fedorahosted.org/sssd/ticket/2863 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-01 14:40:34 +0000