summaryrefslogtreecommitdiffstats
path: root/server/confdb
Commit message (Collapse)AuthorAgeFilesLines
* Consolidate code for splitting strings by separatorJakub Hrozek2009-12-101-105/+1
| | | | | | | | There were two functions for parsing strings by a separator. This patch consolidates on the one previously used in confdb. This also allows stripping the tokens of whitespace. Fixes: #319
* Properly deny id_provider=filesStephen Gallagher2009-12-091-0/+7
|
* Make the password field configurable in NSSJakub Hrozek2009-11-181-0/+1
| | | | | | | | Per the discussion on sssd-devel list, nss_sss should not return a hardcoded value but this should rather be configurable to allow whatever the OS or distribution thinks is the best for the particular case. Fixes: #266
* Fix option name krb5_changepw_principalSumit Bose2009-11-131-1/+1
|
* Update midpoint refresh logic to be relative to cache timeoutStephen Gallagher2009-11-051-1/+1
|
* Move responsibility for entry expiration timeoutSimo Sorce2009-10-271-1/+1
| | | | | The providers are now responsible for determining how long a cached entry is considered valid. The default is the same as before (600s)
* Add support for offline auth cache timeoutStephen Gallagher2009-10-221-0/+1
| | | | | | | | | This adds a new option (offline_credentials_expiration) to the [PAM] section of the sssd.conf If the user does not perform an online authentication within the timeout (in days), they will be denied auth once the timeout passes.
* User home directories managementJakub Hrozek2009-10-221-0/+5
| | | | | | Create and populate user directories on useradd, delete them on userdel Fixes: #212
* Do not allow setting auth, access or chpass providers for LOCALStephen Gallagher2009-10-161-0/+33
| | | | | | | | The LOCAL provider does not have a mechanism to load alternate auth, access or chpass backends, nor does it make sense to do so. This will throw a configuration error if these values are specified (unless they are explicitly also set to 'local')
* Remove magicPrivateGroups optionSimo Sorce2009-10-092-13/+0
| | | | | | | | | In sssd only local is a native mpg domain, and it is forced. All other providers will have to unroll mpg users into a user/group pair of entries in the db. This allows the provider to automatically establish if the remote server provides mpg users w/o possibily conflicting manual configurations on the client trying to force an mpg behavior where none is provided.
* Remove unused btreemap codeStephen Gallagher2009-10-062-2/+0
| | | | | We have converted to using dhash in place of btreemap everywhere in the code.
* add utility call check_and_open_readonlySumit Bose2009-10-051-6/+25
| | | | | Use this new utility call to ensure that the config file is safe to read from.
* remove krb5_try_simple_upn option and make it a default fallbackSumit Bose2009-09-251-1/+0
|
* Send debug messages to logfileJakub Hrozek2009-09-251-0/+1
| | | | | | | | | | | | | Introduces a new option --debug-to-files which makes SSSD output its debug information to a file instead of stderr, which is still the default. Also introduces a new confdb option debug_to_files which does the same, but can be specified per-service in the config file. The logfiles are stored in /var/log/sssd by default. Changes the initscript to log to files by default.
* Upgrade confdb to version 2Stephen Gallagher2009-09-254-36/+131
| | | | | This converts a great many configuration options to the new standard format.
* Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher2009-09-232-35/+35
| | | | | | | | This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
* Several fixes and enhancements for config file processingStephen Gallagher2009-09-211-15/+78
| | | | | | | 1) Add get_entry_as_bool function 2) Make all parameters in confdb_get_domain_internal() use macro names for the attributes. This will make it easer to convert them to the version 2 config file.
* Use syslog for logging error conditions in SSSDJakub Hrozek2009-09-212-30/+30
| | | | | This is just a band-aid until ELAPI is fully functional and ready to use.
* Print error message when connection to the config db failsStephen Gallagher2009-09-111-0/+2
|
* Complete the removal of "legacy" option.Simo Sorce2009-09-112-6/+0
| | | | | | | | | The code was still dependent on it for the ldap driver. Changed the driver code to depend on the schema type. Fix defaults for user and groups trees. ATM if you use the rfc2307bis schema you have to put users and groups in 2 separate trees (what people does by default anyway. If this limitation will turn to be too hard, we will change this later.
* Remove unused event context argument from confdb_initStephen Gallagher2009-09-102-2/+0
| | | | | | Because the confdb always operates synchronously, it maintains its own private event context internally. The event context argument passed to it is never used, so we'll remove it to avoid confusion.
* Properly detect negative/invalid values for the minId and maxIdStephen Gallagher2009-09-101-6/+53
|
* Check for valid min and max IDs in confdb_get_domainsStephen Gallagher2009-09-101-1/+7
|
* Split database in multiple filesSimo Sorce2009-09-083-15/+41
| | | | | The special persistent local database retains the original name. All other backends now have their own cache-NAME.ldb file.
* stop processing a domain if no provider is givenSumit Bose2009-09-011-0/+1
|
* Turn enumeration into a boolean valueSimo Sorce2009-08-312-5/+18
|
* Fix accidentally forcing MPGs on for all domainsStephen Gallagher2009-08-211-1/+1
|
* Make the LOCAL provider always use MagicPrivateGroupsStephen Gallagher2009-08-201-1/+2
| | | | Also updates the manpage for sssd.conf to denote this
* fix return value of confdb_get_domainsSumit Bose2009-08-181-0/+1
| | | | | | If the last configured domain is broken confdb_get_domains returns the return value of confdb_get_domain even if there are valid domains available.
* Monitor resolv.conf for changesStephen Gallagher2009-07-201-2/+0
| | | | | | | | | | | | | | | | | | | This patch updates the monitor_config_file() functions so that they can monitor any number of files and invoke a specified callback whenever they are modified. When inotify is available, we will add an additional watch descriptor to the inotify file descriptor. When inotify is not available, the polling function will simply loop to check each file in the monitor list. When changes are discovered in resolv.conf, the monitor will send a "resInit" signal to all of its known children. They are only required to handle this function if they need updated DNS information. Services that do not implement resInit should return DBUS_ERROR_UNKNOWN_METHOD (rather than timing out) with no ill effects.
* Improvements to config file updatesStephen Gallagher2009-07-201-1/+2
| | | | | | | | | | | | | | | 1) Some text editors will create a new file and move it into place on top of the existing file. When this happens, the kernel issues an IN_IGNORE inotify event and automatically removes the watch descriptor for that file. We'll handle the event and create a new watch descriptor for the new file. We will attempt to rewatch the file six times at five-second intervals. 2) Some scripts may append new data to the config file in several steps (such as calling echo "foo" >> sssd.conf several times). In order to handle these scripts safely, we'll defer processing of inotify events for one second after the first is detected. This should be ample time for the remainder of the script to complete.
* Adding wrappers to free data in INI API.Dmitri Pal2009-07-021-3/+3
| | | | See ticket #37 in sssd track.
* Fix segfault in update_monitor_configStephen Gallagher2009-06-191-0/+4
| | | | | | | We were stealing the memory context of only the first value in the linked-list of domains (and also services). This patch adds a memory context to hold the lists so that can be stolen along with all of the entries.
* Treat a missing provider entry as a config errorStephen Gallagher2009-06-081-2/+7
|
* Suppress "rootdse" error messages from the confdbStephen Gallagher2009-06-011-3/+4
|
* Suppress "rootdse" error messages.Stephen Gallagher2009-05-281-0/+6
| | | | | | | We will trap all LDB debug messages and pipe them into our internal DEBUG() function. LDB FATAL messages will still be printed by default, WARNING and TRACE functions will be at debug level 3 and 9, respectively.
* Silence warningsSimo Sorce2009-05-261-2/+2
|
* Fix warnings in monitor.c and confdb.cStephen Gallagher2009-05-121-1/+1
|
* Separate confdb API from confdb setupStephen Gallagher2009-05-115-371/+453
| | | | | | | Refactoring the confdb so that the setup code can be linked separately from the access API. This is being done so that our plugins do not need to link against the collection and ini_config libraries.
* Fixes for porting SSSD to Debian-based platformsStephen Gallagher2009-05-042-1/+2
|
* Avoid unnecessary reloads of config.ldbSimo Sorce2009-04-161-4/+37
| | | | | | Add code to check if the file has changed since the last update was performed. Avoid dumping and reloading the config ldb if the modification time of the configuration file has not changed at all.
* Add common function to retrieve comma sep. listsSimo Sorce2009-04-142-45/+162
| | | | | | Also convert all places where we were using custom code to parse config arguments. And fix a copy&paste error in nss_get_config
* Make reconnection to the Data Provider a global settingStephen Gallagher2009-04-141-0/+2
| | | | | | | Previously, every DP client was allowed to set its own "retries" option. This option was ambiguous, and useless. All DP clients will now use a global option set in the services config called "reconnection_retries"
* Always pass full domain infoSimo Sorce2009-04-132-73/+115
| | | | | Change sysdb to always passwd sss_domain_info, not just the domain name. This way domain specific options can always be honored at the db level.
* Allow configuration of the SSSD through /etc/sssd/sssd.confStephen Gallagher2009-04-133-98/+270
| | | | | | | | | | | | | | | | | | | The SSSD now links with the ini_config and collection libraries in the common directory. The monitor will track changes to the /etc/sssd/sssd.conf file using inotify on platforms that support it, or polled every 5 seconds on platforms that do not. At startup or modification of the conf file, the monitor will purge the existing confdb and reread it completely from the conf file, to ensure that there are no lingering entries. It does this in a transaction, so there should be no race condition with the client services. A new option has been added to the startup options for the SSSD. It is now possible to specify an alternate config file with the -c <file> at the command line.
* Remove obsolete optionSimo Sorce2009-04-081-1/+0
|
* Fix missing entry from first-start configStephen Gallagher2009-04-081-0/+1
| | | | | | Since we switched to allowing domains to be configured but inactive, we need to include the default set (just LOCAL) into the first-start config.
* Change the way we retrieve domainsSimo Sorce2009-04-082-79/+75
| | | | | | | | | | | | | To be able to correctly filter out duplicate names when multiple non-fully qualified domains are in use we need to be able to specify the domains order. This is now accomplished by the configuration paramets 'domains' in the config/domains entry. 'domains' is a comma separated list of domain names. This paramter allows also to have disbaled domains in the configuration without requiring to completely delete them. The domains list is now kept in a linked list of sss_domain_info objects. The first domain is also the "default" domain.
* fixed two issues in the initial configurationSumit Bose2009-03-302-2/+1
| | | | | - value array is not terminated properly - infopipe service is added dynamically
* Simplify default configurationSimo Sorce2009-03-203-111/+92
| | | | | | | | | | Make confdb load a base ldif like sysdb to initialize the db, makes it simpler to understand at first sight what is the default configuration. Make the parameter "command" optional. Derive the default command from available information. Make the debug level a global by default so that enabling debug for all components is as easy as passing just -d X to the sssd binary.
generated by cgit (git 2.34.1) at 2024-05-02 15:28:24 +0000