summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa/ipa_access.c
Commit message (Collapse)AuthorAgeFilesLines
* Do not save HBAC rules in subdomain subtreeSumit Bose2012-11-191-10/+0
| | | | | | | | | | | | | | Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the configured domain apply to all users it is sufficient to save them once in the subtree of the configured domain. Since most of the sysdb operations during a HBAC request are related to the HBAC rules and related data this patch does not change the default sysdb context but only create a special context to look up subdomain users.
* SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2012-09-241-1/+0
| | | | | The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
* Unify usage of sysdb transactionsMichal Zidek2012-08-231-1/+2
| | | | | | Removing bad examples of usage of sysdb_transaction_start/commit/end functions and making it more consistent (all files except of src/db/sysdb_*.c).
* Modify hbac_get_cached_rules() so it can be used outside of HBAC codeJan Zeleny2012-07-311-14/+17
|
* IPA: Don't hang onto memory longer than necessaryStephen Gallagher2012-07-021-0/+1
| | | | | This request and attached memory would be freed at the end of access-check processing, but it's a waste to keep it around.
* Detect subdomain request in IPA access providerJan Zeleny2012-04-241-0/+10
|
* Accept be_req instead if be_ctx in LDAP access providerJan Zeleny2012-04-241-1/+1
|
* IPA: Initialize hbac_ctx to NULLStephen Gallagher2012-03-121-1/+1
|
* IPA: Check nsAccountLock during PAM_ACCT_MGMTStephen Gallagher2012-03-091-0/+56
| | | | https://fedorahosted.org/sssd/ticket/1227
* IPA hosts refactoringJan Zeleny2012-02-241-18/+6
|
* IPA: Add host info handlerJan Cholasta2012-02-071-1/+1
|
* Separate the host-retrieval code from IPA HBAC to common IPA codeJan Zeleny2012-02-061-16/+40
|
* Implemented support for multiple search bases in HBAC rules and servicesJan Zeleny2012-02-061-29/+5
|
* Support multiple search bases in HBACJan Zeleny2012-01-141-1/+1
|
* Export the function to convert ldb_result to sysdb_attrsJakub Hrozek2011-12-161-1/+1
| | | | It will be reused later in the sudo responder
* Add ipa_hbac_support_srchost option to IPA providerJan Zeleny2011-11-291-0/+4
| | | | | don't fetch all host groups if this option is false https://fedorahosted.org/sssd/ticket/1078
* Cleanup: Remove unused parametersJakub Hrozek2011-11-221-4/+0
|
* IPA access: hostname comparison should be case-insensitiveJakub Hrozek2011-09-281-1/+1
|
* sysdb refactoring: memory context deletedJan Zeleny2011-08-151-1/+1
| | | | | | This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.
* sysdb refactoring: deleted domain variables in sysdb APIJan Zeleny2011-08-151-2/+1
| | | | | The patch also updates code using modified functions. Tests have also been adjusted.
* Fix memory leak in ipa_hbac_evaluate_rulesStephen Gallagher2011-07-291-0/+1
| | | | https://fedorahosted.org/sssd/ticket/933
* Add ipa_hbac_treat_deny_as optionStephen Gallagher2011-07-081-1/+10
| | | | | | By default, we will treat the presence of any DENY rule as denying all users. This option will allow the admin to explicitly ignore DENY rules during a transitional period.
* Add ipa_hbac_refresh optionStephen Gallagher2011-07-081-0/+16
| | | | | This option describes the time between refreshes of the HBAC rules on the IPA server.
* Add new HBAC lookup and evaluation routinesStephen Gallagher2011-07-081-124/+380
|
* Remove old HBAC implementationStephen Gallagher2011-07-081-1585/+0
|
* Use realm for basedn instead of IPA domainJakub Hrozek2011-02-281-1/+1
| | | | https://fedorahosted.org/sssd/ticket/807
* Add ipa_hbac_search_base config optionSumit Bose2011-01-191-52/+39
|
* Add ldap_search_enumeration_timeout config optionSumit Bose2011-01-171-3/+3
|
* Add timeout parameter to sdap_get_generic_send()Sumit Bose2011-01-171-22/+31
|
* Fix uninitialized value error in set_local_and_remote_host_infoStephen Gallagher2010-12-171-1/+1
| | | | https://fedorahosted.org/sssd/ticket/725
* Fix unsafe return condition in ipa_access_handlerStephen Gallagher2010-12-171-1/+6
| | | | https://fedorahosted.org/sssd/ticket/718
* Remove IPA_ACCESS_TIME defineStephen Gallagher2010-12-081-13/+11
|
* Remove check_access_time() from IPA access providerSumit Bose2010-12-081-63/+0
| | | | | | It is planned to release IPA 2.0 without time range specifications in the access control rules. To avoid confusion the evaluation is removed from sssd, too.
* Use a more efficient host search filterSumit Bose2010-11-191-5/+6
|
* Sanitize sysdb search filters in the IPA providerStephen Gallagher2010-11-151-2/+17
|
* Download only enabled IPA HBAC rulesSumit Bose2010-10-221-1/+3
|
* Save all data to sysdb in one transactionSumit Bose2010-09-231-222/+131
|
* Handle host objects like other objectsSumit Bose2010-09-231-128/+181
|
* Cleaned some dead assignmentsJan Zeleny2010-09-071-14/+12
| | | | | | Two needless assignments were deleted, two were complemented with code checking function results. Ticket: #582
* Fix IPA access backend handling of obsolete and missing HBAC entries:eindenbom2010-07-231-9/+68
| | | | | - Ticket #567: Fix removal of obsolete HBAC host, rules and service records from sysdb. - Ticket #565: When no HBAC host record is found return PAM_PERM_DENIED instead of PAM_SYSTEM_ERROR.
* Do not treat missing HBAC rules as an errorSumit Bose2010-07-231-0/+5
|
* Use new LDAP connection framework in IPA access backend.eindenbom2010-07-091-304/+264
|
* Unify sdap and sysdb data handlingSumit Bose2010-06-021-85/+104
|
* Compare full service nameSumit Bose2010-06-021-1/+2
|
* Remove service groupsSumit Bose2010-06-021-191/+7
| | | | | Because the memberOf attribute is now set for the service objects we do not need to fetch the service groups separately anymore.
* Use new schema for HBAC service checksSumit Bose2010-06-021-21/+637
|
* Use sysdb_attrs_get_string_array() instead of sysdb_attrs_get_el()Sumit Bose2010-06-021-23/+12
| | | | | | | | sysdb_attrs_get_el() creates an empty element in the sysdb_attrs structure if the requested element does not exist. Recent versions of libldb do not accept empty elements when writing new objects to disk. sysdb_attrs_get_string_array() does not create an empty element but returns ENOENT.
* Check ipaEnabledFlagSumit Bose2010-05-271-5/+23
|
* Don't report a fatal error for an HBAC denialStephen Gallagher2010-05-161-1/+1
|
* Compare the full service nameSumit Bose2010-05-071-1/+2
|
generated by cgit (git 2.34.1) at 2024-06-07 20:31:42 +0000