summaryrefslogtreecommitdiffstats
path: root/server/providers/ldap/ldap_id.c
Commit message (Collapse)AuthorAgeFilesLines
* Try to renew Kerberos credentialsSumit Bose2009-12-071-0/+15
| | | | | | | | When using GSSAPI we need a valid service ticket to talk to the LDAP server. If the ticket is expired the LDAP client returns with 'Can't contact LDAP server'. Currently we set the backend offline if this error occurs although the server is still available. This patch checks if the TGT is expired and tries to renew the credentials before going offline.
* Make backend request type a bitfieldStephen Gallagher2009-11-231-1/+1
|
* Add initial failover support for ldap and ipaSimo Sorce2009-11-201-3/+9
| | | | | | | The retun values are still not directly used with ldap libraries that still do their own name resolution, but this patch introduces a very basic framework to have a multiple providers in one domain use and share a single failover service if they want to.
* Try to fix offline loginsSimo Sorce2009-11-121-12/+6
|
* Add cleanup taskSimo Sorce2009-11-101-115/+280
|
* Fix tevent_req error checking.Simo Sorce2009-11-091-3/+3
| | | | When possible using a macro that correctly deals with tstate
* Reorganize ldap id provider filesSimo Sorce2009-11-061-547/+6
| | | | Split enum task in a separate file.
* Make useful function more broadly available.Simo Sorce2009-11-061-30/+0
|
* Rename sdap_id_map to sdap_attr_mapSimo Sorce2009-11-031-1/+1
| | | | | | Also start adding some infrastructure to use the USN counter when available. In particular add a place to add generic attrs mapping, ie attributes that are neither user nor group specific.
* Add support to get rootDSE from the LDAP server.Simo Sorce2009-10-291-10/+30
| | | | | | | | | | | | Also fic sdap_get_generic_send() to be a bit more "generic" :-) Also figs bugs within it. This patch allow us 2 good things. A) we check that the server effectively supports GSSAPI auth before we try to use it. B) against IPA it substantially cuts delays when the server is offline because it uses a 5 second async timeout on the connection and doesn't try to do a slow synchronous kinit+sasl_bind if the server is not even available.
* Kill the ldap connection when we go offlineSimo Sorce2009-10-281-5/+16
| | | | | | This patch uses a wrapper to kill the ldap connection when we are marked offline. This also makes sure we do not try to reuse a bad connection handler after a fatal error.
* Add proper support for IPA/AD schemasSimo Sorce2009-10-271-1/+2
| | | | | | Nested groups weren't properly handled. Add 2 pass strategy to update groups memberships Stuff work as expected when enumeration is enabled now.
* Better offline/enumeration behaviorSimo Sorce2009-10-221-10/+12
| | | | | | | | Go offline in case of hard errors too. It makes no sense to keep trying too often when you have bad credentials for example. Also delay starting the enumeration thread so that we finish initializations first (bind to ldap is still a blocking operation and this may interfere with clients/monitor registrations).
* Move all ldap provider init functionsSimo Sorce2009-10-161-76/+15
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* Return the dp error from the providersSimo Sorce2009-10-151-12/+22
|
* Move ldap provider configuration into its own fileSimo Sorce2009-10-141-1/+2
|
* Make options parser available to all providersSimo Sorce2009-10-141-3/+3
|
* make sdap_id_connect_* independent of sdap_id_ctxSumit Bose2009-10-141-180/+10
| | | | | | | | The sdap_id_connect_* request tries to bind to an LDAP server with the default credentials. Only the opts component of the sdap_id_ctx context is used. A new request sdap_cli_connect_* is created which expects only the opts pointer as parameter and not the whole context. This makes it reusable by other providers.
* Initial implementation of sasl bind supportSimo Sorce2009-10-011-52/+80
| | | | | | Inits krb5 credentials, if sasl mech is GSSAPI. Tested with GSSAPI and host keytab as well as user credentials. Updates also manpages with the new options.
* add new config options ldap_tls_cacert and ldap_tls_cacertdirSumit Bose2009-09-251-33/+5
|
* Fix copy&paste of wrong structureSimo Sorce2009-09-231-2/+2
|
* Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher2009-09-231-2/+2
| | | | | | | | This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
* Use syslog for logging error conditions in SSSDJakub Hrozek2009-09-211-2/+2
| | | | | This is just a band-aid until ELAPI is fully functional and ready to use.
* Turn ldap driver options into multitypeSimo Sorce2009-09-141-30/+50
| | | | | | | | | | This patch makes basic options multiype, the init function assigns a type from the initialization array, and processes values fetched from confdb accordingly. 4 types are supported so far: string, number, blob and boolean Also convert defines into enums where appropriate. Add fetch functions that check the requested type.
* Make the offline status backend-globalSimo Sorce2009-09-141-48/+7
| | | | | Add helpers functions to query/set the offline status per backend. Now all providers share the same offline status.
* Fix ldap enumeration async taskSimo Sorce2009-09-111-12/+16
| | | | | | | | | The request was being freed, instead of marking it done and let the callback free it when done. This was causing us to access freed memory, when trying to set the next run. Let the callback add new runs and free the request instead as normally we would do with any other tevent_req async call. Courtesy of valgrind again.
* Fix Ldap id backend offline codeSimo Sorce2009-09-101-6/+64
| | | | | | | After the recent changes we lost the capability to actually go offline. Put back code that would mark the backend as offline when timeouts happen. Make sure the enumeration code also obbeys the offline timeout, and contributes in determining if we are offline or not.
* Honor enumerate option in ldap_idSimo Sorce2009-09-021-6/+9
| | | | | If enumerations are disabled for this domain, then do not start the enumeration task.
* Make enumeration an independent taskSimo Sorce2009-08-271-42/+533
| | | | | | Always immediately return to DP, and update users/groups in the background. Also implements an optimization to retrieve only changed/new users/groups by filtering using the modifyTimestamp after the first query.
* Use the correct structure.Simo Sorce2009-08-271-2/+2
|
* enable usage of defaultBindDnSumit Bose2009-08-191-8/+27
|
* Rework the engine that deals with openldap librariesSimo Sorce2009-07-201-14/+13
| | | | | | | The way openldap libraries work, require to have a single engine per connection as all replies are read at the same time. So we need to always read anything that comes in from the wire and then loop to dispatch results to the requests that are waiting.
* add infrastructure to handle new backend targetsSumit Bose2009-07-201-5/+5
|
* Implement the ldap identity module.Simo Sorce2009-07-081-646/+679
| | | | This uses and exapands the async helpers.
* Split ldap backend into auth and identity filesSimo Sorce2009-05-181-0/+786
generated by cgit (git 2.34.1) at 2024-05-25 20:21:11 +0000