summaryrefslogtreecommitdiffstats
path: root/server/providers/ldap/ldap_auth.c
Commit message (Collapse)AuthorAgeFilesLines
* Treat a zero-length password as a failuresssd-1_0_7Stephen Gallagher2010-08-241-0/+7
| | | | | Some LDAP servers allow binding with blank passwords. We should not allow a blank password to authenticate the SSSD.
* Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose2009-12-181-7/+19
| | | | | | If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
* Don't consider one address with different port numbers as the sameMartin Nagy2009-12-151-2/+4
| | | | | | | | | | | | | There were two problems with the code. We were using fo_set_server_status() instead of fo_set_port_status() when we failed to connect to a service. This is a problem because if two services use the same server, or we want to use one server with two different ports, marking the whole server as bad is incorrect. The other problem was that be_resolve_server_done() was comparing the hostent structures -- these are, however, equal across multiple server:port pairs with the same server addresses. Fixes: #321
* Add ldap_pwd_policy optionSumit Bose2009-11-231-44/+70
|
* Add initial failover support for ldap and ipaSimo Sorce2009-11-201-2/+36
| | | | | | | The retun values are still not directly used with ldap libraries that still do their own name resolution, but this patch introduces a very basic framework to have a multiple providers in one domain use and share a single failover service if they want to.
* Fix tevent_req error checking.Simo Sorce2009-11-091-8/+10
| | | | When possible using a macro that correctly deals with tstate
* Always list inputs before outputsSimo Sorce2009-10-161-8/+11
|
* Move all ldap provider init functionsSimo Sorce2009-10-161-69/+2
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* Check for expired passwords in LDAP providerSumit Bose2009-10-151-20/+351
|
* Return the dp error from the providersSimo Sorce2009-10-151-14/+25
|
* Move ldap provider configuration into its own fileSimo Sorce2009-10-141-1/+2
|
* Make options parser available to all providersSimo Sorce2009-10-141-7/+8
|
* add support for server side LDAP password policiesSumit Bose2009-10-081-0/+4
| | | | | | | - password policy request controls are send during bind and change password extended operation - the response control is evaluated to see if the password is expired or will expire, soon
* Initial implementation of sasl bind supportSimo Sorce2009-10-011-1/+2
| | | | | | Inits krb5 credentials, if sasl mech is GSSAPI. Tested with GSSAPI and host keytab as well as user credentials. Updates also manpages with the new options.
* add new config options ldap_tls_cacert and ldap_tls_cacertdirSumit Bose2009-09-251-33/+4
|
* Turn ldap driver options into multitypeSimo Sorce2009-09-141-19/+29
| | | | | | | | | | This patch makes basic options multiype, the init function assigns a type from the initialization array, and processes values fetched from confdb accordingly. 4 types are supported so far: string, number, blob and boolean Also convert defines into enums where appropriate. Add fetch functions that check the requested type.
* Make the offline status backend-globalSimo Sorce2009-09-141-7/+22
| | | | | Add helpers functions to query/set the offline status per backend. Now all providers share the same offline status.
* enable usage of defaultBindDnSumit Bose2009-08-191-1/+1
|
* added LDAP change password backend targetSumit Bose2009-07-211-2/+159
|
* add infrastructure to handle new backend targetsSumit Bose2009-07-201-4/+5
|
* Unify password caching ops in sysdbSimo Sorce2009-07-081-26/+22
|
* Use async helpers for ldap auth moduleSimo Sorce2009-07-081-722/+314
| | | | | | This changes the style quite a lot, but the tevent_req style is much more clear and much less error-prone than the giant loop we had previously.
* Rework transaction code to use tevent_reqSimo Sorce2009-07-031-21/+65
| | | | | | This is part of a set of patches to rewrite sysdb to a hopefully better API, that will also let use use tevent_req async style calls to manipulate our cache.
* Rename sysdb_req to sysdb_handle.Simo Sorce2009-07-031-5/+5
| | | | | | | | | This sysdb_req has always really been a transaction handle and not a request. This is part of a set of patches to rewrite transaction support in sysdb to a hopefully better API, that will also let use use tevent_req async style to manipulate our cache.
* Remove extra implementation of password_destructorStephen Gallagher2009-06-111-11/+0
|
* added tls_reqcert option for native LDAP backendSumit Bose2009-06-021-0/+32
| | | | | | | In order to allow to access LDAP servers which do not provide SSL/TLS encryption the option tls_reqcert is added to the native LDAP backend. It accepts the same arguments as the corresponding OpenLDAP option documented in ldap.conf(5) and should preform accordingly.
* Silence warningsSimo Sorce2009-05-261-2/+3
|
* call tevent_add_fd only onceSumit Bose2009-05-191-27/+11
|
* Move actual password caching into sysdbSimo Sorce2009-05-181-6/+117
| | | | Convert auth modules to do the caching themselves
* Split ldap backend into auth and identity filesSimo Sorce2009-05-181-19/+12
|
* Move ldap_be.c into ldap/ldap_auth.cSimo Sorce2009-05-181-0/+773
generated by cgit (git 2.34.1) at 2024-04-25 16:30:02 +0000