summaryrefslogtreecommitdiffstats
path: root/src/config/etc/sssd.api.d/sssd-ldap.conf
Commit message (Collapse)AuthorAgeFilesLines
* Revert "LDAP: Remove unused option ldap_group_uuid"Sumit Bose2014-11-061-0/+1
| | | | | | This reverts commit b5242c146cc0ca96e2b898a74fb060efda15bc77. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Revert "LDAP: Remove unused option ldap_user_uuid"Sumit Bose2014-11-061-0/+1
| | | | | | This reverts commit dfb2960ab251f609466fa660449703835c97f99a. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: new option - DN to ppolicy on LDAPPavel Reichl2014-08-271-0/+1
| | | | | | | | | | To check value of pwdLockout attribute on LDAP server, DN of ppolicy must be set. Resolves: https://fedorahosted.org/sssd/ticket/2364 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Remove unused option ldap_user_uuidLukas Slebodnik2014-07-251-1/+0
| | | | | | | | | | | | | | | | | | | | | | There is problem with OpenLDAP server and dereferencing of attributes that is not in the schema of the server? sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b 'dc=example,dc=com' \ -E 'deref=member:uid,dummy_attr' cn=ref_grp Protocol error (2) Additional information: Dereference control: attribute decoding error sh-4.2$ echo $? 2 The attribute nsUniqueID is a 389-only, non-standard attribute. It is an operational attribute that is not in the rfc2307bis nor inetOrgPerson nor posixAccount schema. It was a default value of option ldap_user_uuid, but it was not use anywhere. Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_group_uuidLukas Slebodnik2014-07-251-1/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_netgroup_uuidLukas Slebodnik2014-07-251-1/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-151-0/+1
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Add option to disable use of Token-GroupsPavel Reichl2014-06-021-0/+1
| | | | | | | | | | | Disabling use of Token-Groups is mandatory if expansion of nested groups is not desired (ldap_group_nesting_level = 0) for AD provider. Resolves: https://fedorahosted.org/sssd/ticket/2294 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-021-0/+1
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add new option ldap_group_typeSumit Bose2013-12-191-0/+1
|
* Add ldap_autofs_map_master_name optionCove Schneider2013-11-121-0/+1
|
* Add now options ldap_min_id and ldap_max_idSumit Bose2013-06-281-0/+2
| | | | | | | Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
* A new option krb5_use_kdcinfoJakub Hrozek2013-06-101-0/+1
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1883 The patch introduces a new Kerberos provider option called krb5_use_kdcinfo. The option is true by default in all providers. When set to false, the SSSD will not create krb5 info files that the locator plugin consumes and the user would have to set up the Kerberos options manually in krb5.conf
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-231-0/+1
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-201-0/+1
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Document ldap_chpass_update_last_changeJakub Hrozek2012-10-011-0/+1
| | | | | | Add the option to the manual page and the configAPI https://fedorahosted.org/sssd/ticket/1494
* Add autofs-related options to configAPIJakub Hrozek2012-08-131-1/+6
| | | | https://fedorahosted.org/sssd/ticket/1478
* Primary server support: new option in ldap providerJan Zeleny2012-08-011-0/+2
| | | | | | This patch adds support for new config option ldap_backup_uri. The description of this option's functionality is included in man page in previous patch.
* sudo: add host info optionsPavel Březina2012-06-291-0/+5
| | | | | | | | | | Adds some option that allows to manually configure a host filter. ldap_sudo_use_host_filter - if false, we will download all rules regardless their sudoHost attribute ldap_sudo_hostnames - list hostnames and/or fqdn that should be downloaded, separated with spaces ldap_sudo_ip - list of IPv4/6 address and/or network that should be downloaded, separated with spaces ldap_sudo_include_netgroups - include rules that contains netgroup in sudoHost ldap_sudo_include_regexp - include rules that contains regular expression in sudoHost
* sudo provider: add ldap_sudo_smart_refresh_intervalPavel Březina2012-06-291-0/+1
|
* sudo provider: remove old timerPavel Březina2012-06-291-2/+0
|
* sudo provider: add ldap_sudo_full_refresh_intervalPavel Březina2012-06-291-0/+1
|
* LDAP: Add ldap_*_use_matching_rule_in_chain optionsStephen Gallagher2012-06-131-0/+2
|
* LDAP: Map the user's primaryGroupIDStephen Gallagher2012-05-031-0/+1
|
* LDAP: Allow setting a default domain for id-mapping slice 0Stephen Gallagher2012-05-031-0/+2
|
* LDAP: Add autorid compatibility modeStephen Gallagher2012-05-031-0/+1
|
* LDAP: Add ID mapping range settingsStephen Gallagher2012-05-031-0/+3
|
* LDAP: Add id-mapping optionStephen Gallagher2012-05-031-0/+1
|
* LDAP: Add objectSID config optionStephen Gallagher2012-05-031-0/+2
|
* AUTOFS: IPA providerJakub Hrozek2012-02-071-0/+3
|
* LDAP: Add support for SSH user public keysJan Cholasta2012-02-071-0/+1
|
* LDAP: Add new options for service mapsStephen Gallagher2012-01-311-1/+6
| | | | | Adds the new service map options to the SSSDConfig API and the manpages.
* LDAP: Add option to disable paging controlStephen Gallagher2012-01-181-0/+1
| | | | Fixes https://fedorahosted.org/sssd/ticket/967
* SUDO Integration - periodical update of rules in data providerPavel Březina2012-01-171-0/+2
| | | | | | | | https://fedorahosted.org/sssd/ticket/1110 Adds new configuration options: - ldap_sudo_refresh_enabled - enable/disable periodical updates - ldap_sudo_refresh_timeout - rules timeout (refresh period)
* SUDO Integration review issuesPavel Březina2012-01-171-0/+14
|
* Add sdap_connection_expire_timeout optionStephen Gallagher2011-12-121-0/+1
| | | | https://fedorahosted.org/sssd/ticket/1036
* Add ldap_sasl_minssf optionJan Zeleny2011-12-081-0/+1
| | | | https://fedorahosted.org/sssd/ticket/1075
* Support to request canonicalization in LDAP/IPA providerJan Zeleny2011-11-021-0/+1
| | | | https://fedorahosted.org/sssd/ticket/957
* Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANONJakub Hrozek2011-08-261-0/+1
| | | | https://fedorahosted.org/sssd/ticket/978
* Add LDAP access control based on NDS attributesSumit Bose2011-07-081-0/+3
|
* Use dereference when processing RFC2307bis nested groupsJakub Hrozek2011-05-201-0/+1
| | | | | | | | Instead of issuing N LDAP requests when processing a group with N users, utilize the dereference functionality to pull down all the members in a single LDAP request. https://fedorahosted.org/sssd/ticket/799
* Add ldap_page_size configuration optionStephen Gallagher2011-04-271-0/+1
|
* Configuration parsing updatesJan Zeleny2011-04-251-2/+2
| | | | | | | | | | | | These changes are all related to following ticket: https://fedorahosted.org/sssd/ticket/763 Changes in SSSDConfig.py merge old and new domain record instead of just deleting the old and inserting the new one. The old approach let to loss of some information like comments and blank lines in the config file. Changes in API config were performed so our Python scripts (like sss_obfuscate) don't add extra config options to the config file.
* Add host access control supportPierre Ossman2011-03-241-0/+1
| | | | https://fedorahosted.org/sssd/ticket/746
* Add ldap_tls_{cert,key,cipher_suite} config optionsTyson Whitehead2011-01-201-0/+3
| | | | Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
* Add LDAP expire policy base RHDS/IPA attributeSumit Bose2011-01-191-0/+1
| | | | | The attribute nsAccountLock is used by RHDS, IPA and other directory servers to indicate that the account is locked.
* Add LDAP expire policy based on AD attributesSumit Bose2011-01-191-0/+2
| | | | | | The second bit of userAccountControl is used to determine if the account is enabled or disabled. accountExpires is checked to see if the account is expired.
* Add ldap_search_enumeration_timeout config optionSumit Bose2011-01-171-0/+1
|
* Add authorizedService supportStephen Gallagher2010-12-211-0/+1
| | | | https://fedorahosted.org/sssd/ticket/670
* Update config API filesSumit Bose2010-12-211-1/+1
| | | | | | Over the time a couple of new config options didn't made it into the config API files. This patch updates the files and removes some duplications.
generated by cgit (git 2.34.1) at 2024-05-17 14:30:37 +0000