summaryrefslogtreecommitdiffstats
path: root/server/providers
Commit message (Collapse)AuthorAgeFilesLines
* Rename server/ directory to src/Stephen Gallagher2010-02-1848-24031/+0
| | | | Also update BUILD.txt
* Eliminate separate build tree for sss_clientStephen Gallagher2010-02-181-1/+1
|
* Use macros to hide memcpy callsJakub Hrozek2010-02-184-149/+49
| | | | | The memcpy calls introduced in the memalign patches are ugly. This patch hides them behind a set of macros.
* Supress warnings with -O2Jakub Hrozek2010-02-181-4/+3
|
* Add test for number of options in IPA and LDAP backendsJakub Hrozek2010-02-162-5/+5
|
* Synchronize IPA and LDAP optionsJakub Hrozek2010-02-161-2/+4
|
* Make PAM responses more compatible with D-BUS specStephen Gallagher2010-02-152-34/+108
| | | | | | | | | | Previously, the PAM responses could contain an arbitrary number of arguments. This is not acceptable by the D-BUS protocol, as there is no way to introspect it. This patch converts the response objects to be an array of D-BUS structs. It also fixes two potential memory leaks by not unref'ing the reply object if we get an error.
* Make attr_type an integerStephen Gallagher2010-02-151-17/+11
| | | | | | Previously it was a string being passed and converted into an integer. It will be more efficient this way (and simpler for other implementers)
* Make change password errors more transparentSumit Bose2010-02-124-23/+96
|
* Don't pass a variable as format to talloc_asprintf()Martin Nagy2010-02-122-2/+2
| | | | This practice is not recommended and can also be dangerous.
* Fix other memory alignment issuesJakub Hrozek2010-02-104-42/+55
| | | | | | | Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390
* Make return values more specific during password changeSumit Bose2010-02-102-3/+6
| | | | | | | - return PAM_AUTHTOK_ERR instead of PAM_SYSTEM_ERR if the password change operation fails - send a message to the user if the system is offline and the password cannot be changed
* Document when LDAP referral chasing is availableSumit Bose2010-02-051-0/+12
|
* Reactivate old fd handling conditionallySumit Bose2010-02-054-1/+78
| | | | | | | Older versions of openLDAP do not provide a connection callback. This patch adds a configure check to see if the callback is available and activates the old way of handling the file description of the LDAP connection. This also means that it is not possible to follow referrals.
* Internationalize the command-line help messageStephen Gallagher2010-02-053-7/+7
|
* Enable debug_timestamps by defaultStephen Gallagher2010-02-053-5/+5
| | | | | It can be overridden in the sssd.conf or on the commandline with --debug-timestamps=0
* Add new option ldap_referralsSumit Bose2010-02-023-1/+14
|
* Use ldap connection callbacks to get file descriptorsSumit Bose2010-02-024-43/+121
|
* Force offline operation with SIGUSR1Stephen Gallagher2010-02-011-0/+32
| | | | | | If the monitor receives SIGUSR1, it will instruct all providers to enter offline operation. If any individual provider receives SIGUSR1, it alone will enter offline operation.
* Avoid 'PAM' at the beginning of define and enum namesSumit Bose2010-02-013-8/+9
|
* Rename PAM_USER_INFO to PAM_SYSTEM_INFOSumit Bose2010-02-012-3/+3
|
* Handle IPv6 addresses with the async resolverStephen Gallagher2010-01-221-2/+1
|
* Explicitly set async DNS timeoutStephen Gallagher2010-01-141-1/+1
| | | | We will allow 5s per DNS server, no retries.
* Re-create c-ares channels if /etc/resolv.conf is modifiedMartin Nagy2010-01-121-1/+11
| | | | Fixes: #378
* Fix return value when offline and TGT is validSumit Bose2010-01-111-1/+1
| | | | Fixes CVE-2010-0014
* Return an error for an unknown PAM requestSumit Bose2010-01-054-12/+41
|
* Do not blindly accept zero-length passwordsStephen Gallagher2009-12-182-8/+17
|
* Fix ldap child memory hierarchy and other issuesSimo Sorce2009-12-188-306/+482
| | | | | | | | | | | | | | | | | The timeout handler was not a child of the request so it could fire even though the request was already freed. The code wouldn't use async writes to the children so it could incur in a short write with no way to detect or recover from it. Also fixed style of some helper functions to pass explicit paramters instead of a general structure. Add common code to do async writes to pipes. Fixed async write issue for the krb5_child as well. Fix also sdap_kinit_done(), a return statement was missing and we were mixing SDAP_AUTH and errno return codes in state->result Remove usless helper function that just replicates talloc_strndup()
* Fix for #344Sumit Bose2009-12-181-13/+11
| | | | | Do not handle a missing ccache file as inactive by default, check if there are still active processes of the user.
* Do not overwrite valid TGTs when offlineSumit Bose2009-12-182-42/+88
|
* Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose2009-12-185-21/+69
| | | | | | If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
* disable password migration codeSumit Bose2009-12-171-2/+2
|
* Raise DEBUG level of sdap_get_generic_done()Stephen Gallagher2009-12-171-1/+1
| | | | | | | The DEBUG level of the result should not be lower than the DEBUG level of the request. It generates too much noise when enumerate is enabled or initgroups deals with groups with large numbers of users.
* fail over: Change the first server pick logicMartin Nagy2009-12-151-5/+26
| | | | | | | | | | The logic of selecting the server to fail over to was changed so that we start from the server next to the one that didn't work the last time. This is because the status of a server that failed last time might get reset before we try another one. This can cause that we try to use the nonworking server repeatedly, not giving a chance to other servers. Fixes: #321
* Don't consider one address with different port numbers as the sameMartin Nagy2009-12-156-21/+38
| | | | | | | | | | | | | There were two problems with the code. We were using fo_set_server_status() instead of fo_set_port_status() when we failed to connect to a service. This is a problem because if two services use the same server, or we want to use one server with two different ports, marking the whole server as bad is incorrect. The other problem was that be_resolve_server_done() was comparing the hostent structures -- these are, however, equal across multiple server:port pairs with the same server addresses. Fixes: #321
* Consolidate code for splitting strings by separatorJakub Hrozek2009-12-103-11/+7
| | | | | | | | There were two functions for parsing strings by a separator. This patch consolidates on the one previously used in confdb. This also allows stripping the tokens of whitespace. Fixes: #319
* Correctly restart server status after the timeoutMartin Nagy2009-12-091-1/+1
| | | | | | | The macro STATUS_DIFF() was wrong causing the result to always be lower than 0, therefore the timeout was never reached. Fixes: #302
* Add some debugging statements to fail_over and resolverMartin Nagy2009-12-091-2/+60
| | | | | These were very useful for debugging and hopefully still will be in the future.
* Reduce code duplication between LDAP child and Kerberos childJakub Hrozek2009-12-094-234/+160
| | | | Fixes: #294
* Add dummy credentials to an empty ccache fileSumit Bose2009-12-081-2/+54
| | | | | | | | | Application like krb5-auth-dialog might get confused if there is a credential cache file without any credentials in it. This patch adds an expired credential where only the client and the server principal are set. The client principal is the user's principal and the server principal corresponds to a TGT principal of the realm the user belongs to.
* Fix bug #311, properly set callback attributeSimo Sorce2009-12-071-0/+1
|
* Allow nesting to fix #310Simo Sorce2009-12-071-0/+1
|
* Add offline support for ipa_accessSumit Bose2009-12-072-17/+134
|
* Try to renew Kerberos credentialsSumit Bose2009-12-075-2/+189
| | | | | | | | When using GSSAPI we need a valid service ticket to talk to the LDAP server. If the ticket is expired the LDAP client returns with 'Can't contact LDAP server'. Currently we set the backend offline if this error occurs although the server is still available. This patch checks if the TGT is expired and tries to renew the credentials before going offline.
* Fix nested group membershipsSimo Sorce2009-12-072-154/+189
| | | | | | | | | Search the local db to find the local DN using the original DN as search key. This way we do not have to rely on weak and faulty heuristicts based on DN names. Add a few helper functions in the process and change the way we pass members to sysdb_store_group_send(), instead of passing users and groups list, just add member DNs to the other sysdb attrs.
* Resolve nested groups also when rfc2307bis is usedSimo Sorce2009-12-071-68/+2
|
* Check LDAP structure before calling ldap_unbind_ext()Sumit Bose2009-12-031-1/+3
|
* Setup ldap child logging from IPA backendJakub Hrozek2009-12-034-45/+54
| | | | Fixes: #296
* Immediately return a krb5 change password request when offlineSumit Bose2009-12-011-0/+7
|
* Remove unneeded debugging codeSumit Bose2009-11-251-9/+0
|
generated by cgit (git 2.34.1) at 2024-05-11 11:58:05 +0000