summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa/ipa_init.c
Commit message (Collapse)AuthorAgeFilesLines
* IPA: add view support and get view nameSumit Bose2014-10-161-18/+47
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-47/+47
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* IPA: Do not enable IPA sites in server modeJakub Hrozek2013-10-221-17/+20
| | | | | When running in IPA server mode, the IPA sites should be ignored and the SSSD should only connect to the local server.
* IPA: Ignore dns_discovery_domain in server modeJakub Hrozek2013-09-261-0/+36
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2079 If the dns_discovery_domain is set in the server mode, then the current failover code will use it to discover the AD servers as well. This patch resets the discovery domain unless the admin configured SRV resolution for IPA servers manually. In the case he did, we try to warn him that service discovery of AD servers will most likely fail.
* LDAP: Make sdap_id_setup_tasks reusable for subdomainsJakub Hrozek2013-08-281-1/+1
| | | | | Instead of always performing the setup for the main domain, the setup can now be performed for subdomains as well.
* IPA: Enable AD sites when in server modeJakub Hrozek2013-08-281-1/+51
| | | | | | https://fedorahosted.org/sssd/ticket/1964 Currently the AD sites are enabled unconditionally
* KRB5: Do not send PAC in server modeJakub Hrozek2013-07-231-1/+7
| | | | | | | | The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
* IPA: Initialize server mode ctx if server mode is onJakub Hrozek2013-06-281-0/+6
| | | | | | | | | | This patch introduces a new structure that holds information about a subdomain and its ad_id_ctx. This structure will be used only in server mode to make it possible to search subdomains with a particular ad_id_ctx. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* Add ipa_idmap_init()Sumit Bose2013-06-281-1/+1
| | | | | | Use the sdap_idmap context for the IPA provider as well. https://fedorahosted.org/sssd/ticket/1961
* krb5: do not send pac for IPA users from the local domainSumit Bose2013-06-251-0/+1
| | | | | | | | | | | | | So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
* providers: refresh expired netgroupsPavel Březina2013-06-101-0/+10
| | | | https://fedorahosted.org/sssd/ticket/1713
* LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2013-06-071-8/+2
| | | | | | | | | | | | | | | | | | | With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
* IPA: Always initialize ID mappingSumit Bose2013-05-271-4/+10
| | | | | Because we now always want to store SIDs in the IPA provider, we also need to always initialize the ID mapping context.
* Remove unneeded parameter of setup_child and namespace itJakub Hrozek2013-05-201-1/+1
| | | | | setup_child() was accepting a parameter it didn't use. Also the function name was too generic, so I added a sdap prefix.
* Convert IPA-specific options to be back-end agnosticJakub Hrozek2013-05-031-18/+11
| | | | | | This patch introduces new options for dynamic DNS updates that are not specific to any back end. The current ipa dyndns options are still usable, just with a deprecation warning.
* SUDO: IPA providerLukas Slebodnik2013-05-031-0/+24
| | | | | | This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733
* DNS sites support - add IPA SRV pluginPavel Březina2013-04-101-5/+24
| | | | https://fedorahosted.org/sssd/ticket/1032
* DNS sites support - use SRV DNS lookup plugin in all providersPavel Březina2013-04-101-0/+10
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1032 We set a plugin during an initialization of ID provider, which is an authoritative provider for a plugin choice. The plugin is set only once. When other provider is initalized (e.g. id = IPA, sudo = LDAP), we do not overwrite the plugin. Since sssm_*_id_init() is called from all module constructors, this patch relies on the fact, that ID provider is initialized before all other providers.
* Expose an initializer function from subdomainSimo Sorce2012-08-011-22/+6
| | | | | | Instead of exporting internal structures, expose an initilizer function like the autofs code and initialize everything inside the ipa_subdomains.c file.
* Primary server support: new option in IPA providerJan Zeleny2012-08-011-4/+4
| | | | | | This patch adds support for new config option ipa_backup_server. The description of this option's functionality is included in man page in one of previous patches.
* Primary server support: IPA adaptationJan Zeleny2012-08-011-1/+1
| | | | | | This patch adds support for the primary server functionality into IPA provider. No backup servers are added at the moment, just the basic support is in place.
* Renamed session provider to selinux providerJan Zeleny2012-07-271-15/+15
|
* KRB5: Create a common init routine for krb5_child optionsStephen Gallagher2012-07-061-45/+6
| | | | | This will reduce code duplication between the krb5, ipa and ad providers
* Add support for ID rangesSumit Bose2012-06-211-0/+1
|
* IPA subdomains - ask for information about master domainJan Zeleny2012-06-101-2/+2
| | | | | | | The query is performed only if there is missing information in the cache. That means this should be done only once after restart when cache doesn't exist. All subsequent requests for subdomains won't include the request for master domain.
* IPA: Add get-domains targetSumit Bose2012-04-241-0/+38
|
* IPA: Check nsAccountLock during PAM_ACCT_MGMTStephen Gallagher2012-03-091-0/+11
| | | | https://fedorahosted.org/sssd/ticket/1227
* IPA hosts refactoringJan Zeleny2012-02-241-7/+3
|
* AUTOFS: IPA providerJakub Hrozek2012-02-071-2/+24
|
* IPA: Add host info handlerJan Cholasta2012-02-071-0/+49
|
* Session target in IPA providerJan Zeleny2012-02-061-0/+42
|
* Implemented support for multiple search bases in HBAC rules and servicesJan Zeleny2012-02-061-0/+1
|
* Support multiple search bases in HBACJan Zeleny2012-01-141-0/+1
|
* Pass sdap_id_ctx to online check from IPA providerJakub Hrozek2011-12-191-1/+1
|
* Move child_common routines to utilStephen Gallagher2011-12-191-1/+1
|
* IPA migration fixesJakub Hrozek2011-11-291-0/+9
| | | | | | | * use the id connection for looking up the migration flag * force TLS on the password based authentication connection https://fedorahosted.org/sssd/ticket/924
* Fix sdap_id_ctx/ipa_id_ctx mismatch in IPA providerJakub Hrozek2011-11-251-1/+3
| | | | | This was causing a segfault during HBAC processing and any ID lookups except for netgroups
* Added IPA account info handlerJan Zeleny2011-11-231-1/+2
| | | | | Currently it is only handling netgroups by itself, other requests are forwarded to LDAP provider.
* New IPA ID contextJan Zeleny2011-11-231-13/+21
|
* Cleanup: Remove unused parametersJakub Hrozek2011-11-221-1/+1
|
* Check DNS records before updatingJakub Hrozek2011-07-111-4/+2
| | | | https://fedorahosted.org/sssd/ticket/802
* Allow krb5_realm to override ipa_domainStephen Gallagher2011-02-221-8/+1
| | | | | | It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this.
* Remove check_access_time() from IPA access providerSumit Bose2010-12-081-7/+0
| | | | | | It is planned to release IPA 2.0 without time range specifications in the access control rules. To avoid confusion the evaluation is removed from sssd, too.
* Pass sdap_id_ctx in sdap_id_op functions.Simo Sorce2010-12-071-3/+1
|
* Add support for FAST in krb5 providerSumit Bose2010-12-071-1/+2
|
* Add check_online method to LDAP ID providerSumit Bose2010-12-011-1/+2
|
* Use new LDAP connection framework in IPA access backend.eindenbom2010-07-091-3/+3
|
* Add offline callback to disconnect global SDAP handleSumit Bose2010-05-271-0/+7
|
* Add krb5 SIGTERM handler to ipa auth providerSumit Bose2010-05-271-0/+6
|
generated by cgit (git 2.34.1) at 2024-05-23 14:19:43 +0000