summaryrefslogtreecommitdiffstats
path: root/server/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* Check is ccache structure is initialized before calling krb5_cc_destroySumit Bose2009-11-061-8/+16
|
* Split async helpers in multiple filesSimo Sorce2009-11-065-3285/+3383
| | | | | | The size of sdap_async.c was unmanageable. This patch splits it into a generic file with common infrastructure calls, a file that handles connection calls and a file for id related calls.
* Reorganize ldap id provider filesSimo Sorce2009-11-064-547/+583
| | | | Split enum task in a separate file.
* Unify code to use the generic search interfaceSimo Sorce2009-11-061-593/+473
| | | | | | | This code removes redundancies in the code. both users and groups enumeration code use the same search generic search function now. Also the code to save users and groups have been unified across all callers.
* Fix and enhance initgroups callSimo Sorce2009-11-061-170/+637
| | | | | | | | This call was failing and was defective because it didn't properly handle the various different schemas we support. Now the function does 2 things: - Updates the user entry to make sure it is still valid - Retrieves every group the user is member of
* Unify parse routines, use maps in generic searchesSimo Sorce2009-11-064-130/+77
| | | | | This remove redundant code and also allows the generic search to be used to use maps to convert attributes.
* Store the original memberof attributes if anySimo Sorce2009-11-061-7/+30
| | | | | Also change the interface of sdap_save_user_send() so that it can be more easily reused like it was done for sdap_save_group_send().
* Make useful function more broadly available.Simo Sorce2009-11-063-30/+30
|
* add replacements for missing Kerberos callsSumit Bose2009-11-054-46/+17
|
* Rename sdap_id_map to sdap_attr_mapSimo Sorce2009-11-035-21/+70
| | | | | | Also start adding some infrastructure to use the USN counter when available. In particular add a place to add generic attrs mapping, ie attributes that are neither user nor group specific.
* Make debug message less irritating.Sumit Bose2009-11-021-2/+2
| | | | | | The 'Unable to load' debug message is now only shown when the backend target is given explicitly in the config file. I the other case we let the caller decided how to handle this error condition.
* set ipa_hostname if not given in config fileSumit Bose2009-11-021-0/+20
|
* Fix segfault when SASL is not used at allSimo Sorce2009-10-302-2/+4
|
* Add support to get rootDSE from the LDAP server.Simo Sorce2009-10-296-121/+398
| | | | | | | | | | | | Also fic sdap_get_generic_send() to be a bit more "generic" :-) Also figs bugs within it. This patch allow us 2 good things. A) we check that the server effectively supports GSSAPI auth before we try to use it. B) against IPA it substantially cuts delays when the server is offline because it uses a 5 second async timeout on the connection and doesn't try to do a slow synchronous kinit+sasl_bind if the server is not even available.
* Tidy up ipa optionsSimo Sorce2009-10-295-151/+198
| | | | | | | | | | | | | | Do not replicate every and each option we may want to set in ipa. Just read out ldap and krb provider options (added reference in the manual too, and removed mention of ipa specific timeout values, use ldap options for that) Avoid calling auth module initialization twice, just pass the auth context to the chpass module too. Add a new ldap option SDAP_SEARCH_BASE, so that a single searching base can be used for both users and groups. the user and group search bases can still be set separately if necessary but they are now optional and set to be identical to SDAP_SEARCH_BASE if not explicitly specified in the configuration.
* Kill the ldap connection when we go offlineSimo Sorce2009-10-281-5/+16
| | | | | | This patch uses a wrapper to kill the ldap connection when we are marked offline. This also makes sure we do not try to reuse a bad connection handler after a fatal error.
* Move responsibility for entry expiration timeoutSimo Sorce2009-10-276-18/+38
| | | | | The providers are now responsible for determining how long a cached entry is considered valid. The default is the same as before (600s)
* Add proper support for IPA/AD schemasSimo Sorce2009-10-274-202/+574
| | | | | | Nested groups weren't properly handled. Add 2 pass strategy to update groups memberships Stuff work as expected when enumeration is enabled now.
* store original DN with cached group objects if availableSumit Bose2009-10-271-0/+16
|
* Copy option overrides.Simo Sorce2009-10-261-0/+26
| | | | | We were not copying IPA named options to the ldap id options list. So the ldap_id provider was always using just the default settings.
* Add support for offline auth cache timeoutStephen Gallagher2009-10-221-0/+1
| | | | | | | | | This adds a new option (offline_credentials_expiration) to the [PAM] section of the sssd.conf If the user does not perform an online authentication within the timeout (in days), they will be denied auth once the timeout passes.
* Fix setting the schema in the ipa providerSimo Sorce2009-10-221-0/+3
|
* update ipa auth options to new option schemeSumit Bose2009-10-223-110/+133
|
* update krb5 option handling to new option schemeSumit Bose2009-10-227-125/+273
|
* Fix potential memory leaks in the data providerMartin Nagy2009-10-221-2/+4
|
* Better offline/enumeration behaviorSimo Sorce2009-10-221-10/+12
| | | | | | | | Go offline in case of hard errors too. It makes no sense to keep trying too often when you have bad credentials for example. Also delay starting the enumeration thread so that we finish initializations first (bind to ldap is still a blocking operation and this may interfere with clients/monitor registrations).
* added generic LDAP search sdap_get_generic_send/_recvSumit Bose2009-10-224-0/+304
|
* Start implementing ipa specific options.Simo Sorce2009-10-205-7/+593
| | | | | First step generate ldap options from ipa options. Add sssd-ipa man page too.
* Always list inputs before outputsSimo Sorce2009-10-161-8/+11
|
* Add first basic IPA providerSimo Sorce2009-10-161-0/+233
|
* Move all krb5 provider init functionsSimo Sorce2009-10-164-193/+261
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* Move all ldap provider init functionsSimo Sorce2009-10-165-145/+202
| | | | | Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
* Check for expired passwords in LDAP providerSumit Bose2009-10-154-23/+425
|
* enable debugging of krb5_childSumit Bose2009-10-153-4/+142
|
* more implicit provider target settingsSumit Bose2009-10-151-13/+48
| | | | | | | | | If auth_provider or access_provider is ont set explicitly id_provider is used if it can handle auth or access control requests respectively. If not auth defaults to 'none' and the access_provider is set to 'permit'. The option 'deny' is added for the access_provider to explicitly deny access.
* set chpass_provider implicit if not set explicitSumit Bose2009-10-152-20/+60
| | | | | | - if chpass_provider is not given in the configuration file but an auth_provider and the auth_provider can also handle change password requests it is used as chpass_provider.
* Return the dp error from the providersSimo Sorce2009-10-156-81/+179
|
* Move ldap provider configuration into its own fileSimo Sorce2009-10-146-189/+252
|
* Make options parser available to all providersSimo Sorce2009-10-148-294/+366
|
* send a message if a backend target is not configuredSumit Bose2009-10-141-12/+30
| | | | | | If a backend target is not configured the return code is changed from PAM_SYSTEM_ERR to PAM_MODULE_UNKNOWN and an error message is sent back to the client.
* make sdap_id_connect_* independent of sdap_id_ctxSumit Bose2009-10-143-180/+188
| | | | | | | | The sdap_id_connect_* request tries to bind to an LDAP server with the default credentials. Only the opts component of the sdap_id_ctx context is used. A new request sdap_cli_connect_* is created which expects only the opts pointer as parameter and not the whole context. This makes it reusable by other providers.
* add a replacement if ldap_control_create is missingSumit Bose2009-10-133-8/+7
|
* fix a wrong argument to unpack_bufferSumit Bose2009-10-121-18/+40
| | | | | | | | | - the patch to handle short read introduced a new variable len to store the amount of data read. Instead of using this variable unpack_buffer was called with the old variable ret. Thanks to mnagy@redhat.com for finding this. - this patch also fixes a potential error when the message size is equal to the buffer size.
* use the correct kerberos context for each targetSumit Bose2009-10-091-4/+33
| | | | | - when the kerberos provider was used as a chpass_provider but not as auth_provider the backend died
* Remove DP processSimo Sorce2009-10-097-1259/+241
| | | | | Turn the backend process into data provider servers Make Frontends (pam, nss) directly attach to the backends
* Differentiate between search and network timeoutsSimo Sorce2009-10-093-5/+7
| | | | | | Network timeouts are used in quick operations like bind. Search timeout is used for operations that can "legally" require more time. Change defaults to 6 and 60 seconds respectively.
* add support for server side LDAP password policiesSumit Bose2009-10-083-11/+125
| | | | | | | - password policy request controls are send during bind and change password extended operation - the response control is evaluated to see if the password is expired or will expire, soon
* Remove unused btreemap codeStephen Gallagher2009-10-062-2/+0
| | | | | We have converted to using dhash in place of btreemap everywhere in the code.
* remove redundant talloc_freeSumit Bose2009-10-051-3/+0
| | | | - this patch should fix bug #213, a double free in the sdap timeout handler
* handle expired password during authenticationSumit Bose2009-10-051-2/+25
|
generated by cgit (git 2.34.1) at 2024-06-10 19:46:08 +0000