summaryrefslogtreecommitdiffstats
path: root/server/providers/krb5
Commit message (Collapse)AuthorAgeFilesLines
* Rename server/ directory to src/Stephen Gallagher2010-02-189-3139/+0
| | | | Also update BUILD.txt
* Use macros to hide memcpy callsJakub Hrozek2010-02-182-96/+30
| | | | | The memcpy calls introduced in the memalign patches are ugly. This patch hides them behind a set of macros.
* Supress warnings with -O2Jakub Hrozek2010-02-181-4/+3
|
* Make change password errors more transparentSumit Bose2010-02-121-18/+60
|
* Don't pass a variable as format to talloc_asprintf()Martin Nagy2010-02-121-1/+1
| | | | This practice is not recommended and can also be dangerous.
* Fix other memory alignment issuesJakub Hrozek2010-02-102-28/+35
| | | | | | | Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390
* Make return values more specific during password changeSumit Bose2010-02-101-0/+1
| | | | | | | - return PAM_AUTHTOK_ERR instead of PAM_SYSTEM_ERR if the password change operation fails - send a message to the user if the system is offline and the password cannot be changed
* Internationalize the command-line help messageStephen Gallagher2010-02-051-3/+3
|
* Enable debug_timestamps by defaultStephen Gallagher2010-02-051-1/+1
| | | | | It can be overridden in the sssd.conf or on the commandline with --debug-timestamps=0
* Avoid 'PAM' at the beginning of define and enum namesSumit Bose2010-02-012-7/+8
|
* Rename PAM_USER_INFO to PAM_SYSTEM_INFOSumit Bose2010-02-011-2/+2
|
* Fix return value when offline and TGT is validSumit Bose2010-01-111-1/+1
| | | | Fixes CVE-2010-0014
* Return an error for an unknown PAM requestSumit Bose2010-01-051-6/+18
|
* Do not blindly accept zero-length passwordsStephen Gallagher2009-12-182-8/+17
|
* Fix ldap child memory hierarchy and other issuesSimo Sorce2009-12-182-63/+97
| | | | | | | | | | | | | | | | | The timeout handler was not a child of the request so it could fire even though the request was already freed. The code wouldn't use async writes to the children so it could incur in a short write with no way to detect or recover from it. Also fixed style of some helper functions to pass explicit paramters instead of a general structure. Add common code to do async writes to pipes. Fixed async write issue for the krb5_child as well. Fix also sdap_kinit_done(), a return statement was missing and we were mixing SDAP_AUTH and errno return codes in state->result Remove usless helper function that just replicates talloc_strndup()
* Fix for #344Sumit Bose2009-12-181-13/+11
| | | | | Do not handle a missing ccache file as inactive by default, check if there are still active processes of the user.
* Do not overwrite valid TGTs when offlineSumit Bose2009-12-182-42/+88
|
* Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose2009-12-182-13/+37
| | | | | | If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
* Don't consider one address with different port numbers as the sameMartin Nagy2009-12-151-1/+3
| | | | | | | | | | | | | There were two problems with the code. We were using fo_set_server_status() instead of fo_set_port_status() when we failed to connect to a service. This is a problem because if two services use the same server, or we want to use one server with two different ports, marking the whole server as bad is incorrect. The other problem was that be_resolve_server_done() was comparing the hostent structures -- these are, however, equal across multiple server:port pairs with the same server addresses. Fixes: #321
* Consolidate code for splitting strings by separatorJakub Hrozek2009-12-101-5/+3
| | | | | | | | There were two functions for parsing strings by a separator. This patch consolidates on the one previously used in confdb. This also allows stripping the tokens of whitespace. Fixes: #319
* Reduce code duplication between LDAP child and Kerberos childJakub Hrozek2009-12-091-116/+7
| | | | Fixes: #294
* Add dummy credentials to an empty ccache fileSumit Bose2009-12-081-2/+54
| | | | | | | | | Application like krb5-auth-dialog might get confused if there is a credential cache file without any credentials in it. This patch adds an expired credential where only the client and the server principal are set. The client principal is the user's principal and the server principal corresponds to a TGT principal of the realm the user belongs to.
* Immediately return a krb5 change password request when offlineSumit Bose2009-12-011-0/+7
|
* Remove unneeded debugging codeSumit Bose2009-11-251-9/+0
|
* Fix an internal error when cache_credentials=FALSESumit Bose2009-11-251-1/+4
|
* Split helpers for child processesJakub Hrozek2009-11-254-173/+4
| | | | | Moves several functions out of providers/krb5 hierarchy into a separate module so it can be shared by the ldap child.
* Read KDC info from file instead from environmentSumit Bose2009-11-235-30/+323
| | | | | | Then name or IP adress of the KDC is written into the pubconf directory into a file named kdcinfo.REALM. The locator plugin will then read this file and pass the data to the kerberos libraries.
* Add initial failover support for ldap and ipaSimo Sorce2009-11-203-2/+9
| | | | | | | The retun values are still not directly used with ldap libraries that still do their own name resolution, but this patch introduces a very basic framework to have a multiple providers in one domain use and share a single failover service if they want to.
* Add ipa_authSumit Bose2009-11-201-0/+3
| | | | | | | | To support IPA DS to Kerberos password migration a seperate authentication target is added. It calls the Kerberos authentication target and in the case of a 'Preauthentication Error' the LDAP authentication target. On success the Kerberos target is called again to request the TGT.
* Improve handling of ccache filesSumit Bose2009-11-203-202/+597
| | | | | | | - save current ccache file to sysdb - use the saved ccache file if the user has running processes - create an empty ccache if offline - return enviroment variables if offline
* Validate Kerberos credentials with local keytabSumit Bose2009-11-206-39/+250
|
* Fix option name krb5_changepw_principalSumit Bose2009-11-131-1/+1
|
* Fix inconsistent use of krb5_ccname_templateSumit Bose2009-11-121-1/+1
|
* Simplify krb5 child handlerSumit Bose2009-11-101-17/+18
| | | | | | | | Currently the Kerberos child handler evaluates the siginfo_t structure to wait for a specific child. This scheme is prone to error, especially when there are more than one child process active, and can produce missleading debug message. This patch simplifies the scheme as it waits for any child.
* Fix tevent_req error checking.Simo Sorce2009-11-091-23/+20
| | | | When possible using a macro that correctly deals with tstate
* Check is ccache structure is initialized before calling krb5_cc_destroySumit Bose2009-11-061-8/+16
|
* add replacements for missing Kerberos callsSumit Bose2009-11-053-38/+9
|
* update krb5 option handling to new option schemeSumit Bose2009-10-227-125/+273
|
* Move all krb5 provider init functionsSimo Sorce2009-10-164-193/+261
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* enable debugging of krb5_childSumit Bose2009-10-153-4/+142
|
* Return the dp error from the providersSimo Sorce2009-10-151-16/+30
|
* fix a wrong argument to unpack_bufferSumit Bose2009-10-121-18/+40
| | | | | | | | | - the patch to handle short read introduced a new variable len to store the amount of data read. Instead of using this variable unpack_buffer was called with the old variable ret. Thanks to mnagy@redhat.com for finding this. - this patch also fixes a potential error when the message size is equal to the buffer size.
* use the correct kerberos context for each targetSumit Bose2009-10-091-4/+33
| | | | | - when the kerberos provider was used as a chpass_provider but not as auth_provider the backend died
* handle expired password during authenticationSumit Bose2009-10-051-2/+25
|
* remove krb5_try_simple_upn option and make it a default fallbackSumit Bose2009-09-252-9/+1
|
* fix possible short reads in kerberos providerSumit Bose2009-09-252-15/+46
|
* Upgrade confdb to version 2Stephen Gallagher2009-09-251-7/+10
| | | | | This converts a great many configuration options to the new standard format.
* added support for older MIT kerberos versionssbose2009-09-243-7/+37
| | | | | | | | | - make the build of the locator plugin optional - added a man page for the locator plugin - use krb5.h if krb5/krb5.h cannot be found - added alternatives for missing functions - set -DDBUS_API_SUBJECT_TO_CHANGE if libdbus version is lesser than 1.0.0
* Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher2009-09-231-2/+2
| | | | | | | | This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
* Use syslog for logging error conditions in SSSDJakub Hrozek2009-09-211-2/+2
| | | | | This is just a band-aid until ELAPI is fully functional and ready to use.
generated by cgit (git 2.34.1) at 2024-05-27 17:11:18 +0000