summaryrefslogtreecommitdiffstats
path: root/server/providers/krb5/krb5_auth.c
Commit message (Collapse)AuthorAgeFilesLines
* Use macros to hide memcpy callsJakub Hrozek2010-02-181-43/+16
| | | | | The memcpy calls introduced in the memalign patches are ugly. This patch hides them behind a set of macros.
* Supress warnings with -O2Jakub Hrozek2010-02-181-4/+3
|
* Fix other memory alignment issuesJakub Hrozek2010-02-101-14/+18
| | | | | | | Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390
* Avoid 'PAM' at the beginning of define and enum namesSumit Bose2010-02-011-4/+4
|
* Fix return value when offline and TGT is validSumit Bose2010-01-111-1/+1
| | | | Fixes CVE-2010-0014
* Return an error for an unknown PAM requestSumit Bose2010-01-051-6/+18
|
* Do not blindly accept zero-length passwordsStephen Gallagher2009-12-181-1/+4
|
* Fix ldap child memory hierarchy and other issuesSimo Sorce2009-12-181-23/+54
| | | | | | | | | | | | | | | | | The timeout handler was not a child of the request so it could fire even though the request was already freed. The code wouldn't use async writes to the children so it could incur in a short write with no way to detect or recover from it. Also fixed style of some helper functions to pass explicit paramters instead of a general structure. Add common code to do async writes to pipes. Fixed async write issue for the krb5_child as well. Fix also sdap_kinit_done(), a return statement was missing and we were mixing SDAP_AUTH and errno return codes in state->result Remove usless helper function that just replicates talloc_strndup()
* Fix for #344Sumit Bose2009-12-181-13/+11
| | | | | Do not handle a missing ccache file as inactive by default, check if there are still active processes of the user.
* Do not overwrite valid TGTs when offlineSumit Bose2009-12-181-42/+87
|
* Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose2009-12-181-2/+12
| | | | | | If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
* Don't consider one address with different port numbers as the sameMartin Nagy2009-12-151-1/+3
| | | | | | | | | | | | | There were two problems with the code. We were using fo_set_server_status() instead of fo_set_port_status() when we failed to connect to a service. This is a problem because if two services use the same server, or we want to use one server with two different ports, marking the whole server as bad is incorrect. The other problem was that be_resolve_server_done() was comparing the hostent structures -- these are, however, equal across multiple server:port pairs with the same server addresses. Fixes: #321
* Reduce code duplication between LDAP child and Kerberos childJakub Hrozek2009-12-091-116/+7
| | | | Fixes: #294
* Immediately return a krb5 change password request when offlineSumit Bose2009-12-011-0/+7
|
* Remove unneeded debugging codeSumit Bose2009-11-251-9/+0
|
* Fix an internal error when cache_credentials=FALSESumit Bose2009-11-251-1/+4
|
* Split helpers for child processesJakub Hrozek2009-11-251-143/+1
| | | | | Moves several functions out of providers/krb5 hierarchy into a separate module so it can be shared by the ldap child.
* Read KDC info from file instead from environmentSumit Bose2009-11-231-10/+51
| | | | | | Then name or IP adress of the KDC is written into the pubconf directory into a file named kdcinfo.REALM. The locator plugin will then read this file and pass the data to the kerberos libraries.
* Improve handling of ccache filesSumit Bose2009-11-201-104/+442
| | | | | | | - save current ccache file to sysdb - use the saved ccache file if the user has running processes - create an empty ccache if offline - return enviroment variables if offline
* Validate Kerberos credentials with local keytabSumit Bose2009-11-201-37/+37
|
* Simplify krb5 child handlerSumit Bose2009-11-101-17/+18
| | | | | | | | Currently the Kerberos child handler evaluates the siginfo_t structure to wait for a specific child. This scheme is prone to error, especially when there are more than one child process active, and can produce missleading debug message. This patch simplifies the scheme as it waits for any child.
* Fix tevent_req error checking.Simo Sorce2009-11-091-23/+20
| | | | When possible using a macro that correctly deals with tstate
* update krb5 option handling to new option schemeSumit Bose2009-10-221-23/+39
|
* Move all krb5 provider init functionsSimo Sorce2009-10-161-180/+24
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* enable debugging of krb5_childSumit Bose2009-10-151-2/+99
|
* Return the dp error from the providersSimo Sorce2009-10-151-16/+30
|
* use the correct kerberos context for each targetSumit Bose2009-10-091-4/+33
| | | | | - when the kerberos provider was used as a chpass_provider but not as auth_provider the backend died
* remove krb5_try_simple_upn option and make it a default fallbackSumit Bose2009-09-251-8/+1
|
* fix possible short reads in kerberos providerSumit Bose2009-09-251-5/+18
|
* Upgrade confdb to version 2Stephen Gallagher2009-09-251-7/+10
| | | | | This converts a great many configuration options to the new standard format.
* added support for older MIT kerberos versionssbose2009-09-241-2/+1
| | | | | | | | | - make the build of the locator plugin optional - added a man page for the locator plugin - use krb5.h if krb5/krb5.h cannot be found - added alternatives for missing functions - set -DDBUS_API_SUBJECT_TO_CHANGE if libdbus version is lesser than 1.0.0
* Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher2009-09-231-2/+2
| | | | | | | | This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
* Use syslog for logging error conditions in SSSDJakub Hrozek2009-09-211-2/+2
| | | | | This is just a band-aid until ELAPI is fully functional and ready to use.
* added child timeout handlerSumit Bose2009-09-141-6/+87
|
* add krb5ccache_dir and krb5ccname_template optionSumit Bose2009-09-141-24/+66
| | | | | | | | The configuration options krb5ccache_dir and krb5ccname_template are added to the Kerberos provider to create the user's credential caches the same way as pam_krb5 does. Due to the design of the sssd and the supported ccache types of MIT Kerberos only files are allowed.
* Make the offline status backend-globalSimo Sorce2009-09-141-4/+13
| | | | | Add helpers functions to query/set the offline status per backend. Now all providers share the same offline status.
* use fork+exec for kerberos helperSumit Bose2009-09-111-106/+209
|
* add change password target to krb5 backendSumit Bose2009-09-111-24/+81
|
* send SSSD_REALM and SSSD_KDCIP environment to the clientSumit Bose2009-08-281-2/+31
| | | | | | Currently the kerberos locator plugin needs these two variables to be set to find a KDC which is configured in sssd but not in /etc/krb5.conf.
* some UPN handling fixesSumit Bose2009-08-241-23/+11
| | | | | | - making the realm part upper case is now optional and done in the LDAP backend - using a username@realm UPN is now optional
* use stored upn if availableSumit Bose2009-08-211-20/+101
| | | | | | If a user principle name (upn) can be found in sysdb the krb5 backend will use this otherwise is build as username@realm. It is checked that the realm is upper case only.
* Make socket paths a compile-time optionStephen Gallagher2009-08-111-1/+0
| | | | | | Previously, we had hardcoded the paths for the NSS, PAM and private PAM sockets to /var/lib/sss/pipes. With this patch, we will specify the sockets with --with-pipe-path.
* Consolidate tevent helpersJakub Hrozek2009-08-051-16/+0
|
* add infrastructure to handle new backend targetsSumit Bose2009-07-201-4/+5
|
* let krb5 backend safe valid credentials for offline authenticationSumit Bose2009-07-101-0/+43
|
* Cleanup warnings in client and server codeSimo Sorce2009-07-031-3/+0
|
* added kerberos backend with tevent_req event handlingSumit Bose2009-07-021-0/+567
generated by cgit (git 2.34.1) at 2024-05-26 08:48:27 +0000