summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa
Commit message (Collapse)AuthorAgeFilesLines
* IPA: Look up AD users directly if IPA server mode is onJakub Hrozek2013-06-284-4/+155
| | | | | | | | https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
* IPA: Create and remove AD id_ctx for subdomains discovered in server modeJakub Hrozek2013-06-281-0/+182
| | | | | | | | | When IPA server mode is on, then this patch will create an ad_id_ctx for each subdomain discovered in IPA provider. The ID context is needed to perform direct lookups using the AD provider. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Initialize server mode ctx if server mode is onJakub Hrozek2013-06-284-0/+62
| | | | | | | | | | This patch introduces a new structure that holds information about a subdomain and its ad_id_ctx. This structure will be used only in server mode to make it possible to search subdomains with a particular ad_id_ctx. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Add a server mode optionJakub Hrozek2013-06-282-0/+2
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1993 SSSD needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, is introduced which defaults to false but is set to true during ipa-server-install or during updates of the FreeIPA server if it is not already set.
* Save mpg state for subdomainsSumit Bose2013-06-281-3/+10
| | | | | | The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
* IPA: read ranges before subdomainsSumit Bose2013-06-281-29/+27
| | | | | | | Since FreIPA will start to support external mapping for trusted domains as well the range type for the domain must be know before the domain object is created. The reason is that external mapping will not use magic private groups (mpg) while algorithmic mapping will use them.
* Replace new_subdomain() with find_subdomain_by_name()Sumit Bose2013-06-282-7/+5
| | | | | | new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
* Add support for new ipaRangeType attributeSumit Bose2013-06-283-6/+36
| | | | | | | | | Recent versions of FreeIPA support a range type attribute to allow different type of ranges for sub/trusted-domains. If the attribute is available it will be used, if not the right value is determined with the help of the other idrange attributes. Fixes https://fedorahosted.org/sssd/ticket/1961
* Add ipa_idmap_init()Sumit Bose2013-06-283-1/+275
| | | | | | Use the sdap_idmap context for the IPA provider as well. https://fedorahosted.org/sssd/ticket/1961
* Add now options ldap_min_id and ldap_max_idSumit Bose2013-06-281-0/+2
| | | | | | | Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
* SSH: When host is removed from LDAP, remove it from the cache as wellJan Cholasta2013-06-271-1/+8
| | | | https://fedorahosted.org/sssd/ticket/1949
* AD: Write out domain-realm mappingsJakub Hrozek2013-06-271-164/+3
| | | | | This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
* krb5: do not send pac for IPA users from the local domainSumit Bose2013-06-251-0/+1
| | | | | | | | | | | | | So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
* IPA: Do not download or store the member attribute of host groupsJakub Hrozek2013-06-242-2/+0
| | | | | | | | https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
* handle ERR_ACCOUNT_EXPIRED properlyPavel Březina2013-06-171-0/+4
| | | | https://fedorahosted.org/sssd/ticket/1953
* subdomains: touch krb5.conf when creating new domain-realm mappingsPavel Březina2013-06-161-0/+8
| | | | https://fedorahosted.org/sssd/ticket/1815
* Fix minor typosYuri Chornoivan2013-06-121-1/+1
|
* A new option krb5_use_kdcinfoJakub Hrozek2013-06-102-12/+25
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1883 The patch introduces a new Kerberos provider option called krb5_use_kdcinfo. The option is true by default in all providers. When set to false, the SSSD will not create krb5 info files that the locator plugin consumes and the user would have to set up the Kerberos options manually in krb5.conf
* providers: refresh expired netgroupsPavel Březina2013-06-101-0/+10
| | | | https://fedorahosted.org/sssd/ticket/1713
* Move domain_to_basedn outside IPA subtreeJakub Hrozek2013-06-072-65/+0
| | | | | The utility function will be reused to guess search base from the base DN of AD trusted domains.
* LDAP: new SDAP domain structureJakub Hrozek2013-06-072-12/+19
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* LDAP: Pass in a connection to ID functionsJakub Hrozek2013-06-071-1/+1
| | | | | | | Instead of using the default connection from the sdap_id_ctx, allow the caller to specify which connection shall be used for this particular request. Again, no functional change is present in this patch, just another parameter is added.
* LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2013-06-078-15/+11
| | | | | | | | | | | | | | | | | | | With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
* Do not obfuscate calls with booleansJakub Hrozek2013-06-071-7/+21
| | | | | | Instead of using boolean variables to denote whether the call is adding a primary or a secondary server, use a function wrapper that tells what it's doing by its name.
* Add utility functions for formatting fully-qualified namesJakub Hrozek2013-05-301-4/+4
| | | | | | Instead of using printf-like functions directly, provide two wrappers that would encapsulate formatting the fully-qualified names. No functional change is present in this patch.
* IPA: Check for ENOMEMJakub Hrozek2013-05-281-0/+3
|
* Fix dyndns timer initializationJakub Hrozek2013-05-272-2/+8
| | | | | | | The dyndns init function was starting the timer even if the updates were set to False. This patch splits the init of dynamic updates and the timer into two functions so that the back end can start the updates separately from reading the options.
* IPA: read user and group SIDSumit Bose2013-05-271-2/+2
| | | | | To allow mapping of SIDs to names or POSIX IDs and back the related attributes must be read from the FreeIPA directory server.
* IPA: Always initialize ID mappingSumit Bose2013-05-271-4/+10
| | | | | Because we now always want to store SIDs in the IPA provider, we also need to always initialize the ID mapping context.
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-231-0/+1
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* Remove unneeded parameter of setup_child and namespace itJakub Hrozek2013-05-201-1/+1
| | | | | setup_child() was accepting a parameter it didn't use. Also the function name was too generic, so I added a sdap prefix.
* Fix broken build with selinux.Lukas Slebodnik2013-05-142-2/+4
| | | | | | | | | Header file selinux/selinux.h was removed in commit 245cc346 from file ipa_selinux.c, because it breaks build without selinux. But new error was introduced. This patch fixes compilation with selinux and include header file selinux/selinux.h only if both macros exist HAVE_SELINUX and HAVE_SELINUX_LOGIN_DIR. Now ipa_selinux.c should be correctly built with and without selinux.
* Fixes compilation without selinux.Lukas Slebodnik2013-05-131-1/+0
| | | | | | | | Compilation fail if ./configure is called with arguments --with-selinux --with-semanage and selinux header files are not installed. We didn't not catch this in fedora, because krb5-devel depends on libselinux-devel, but other distribution can package it differently. And API from selinux.h is not used in file ipa_selinux.c
* Split out the common code from timed DNS updatesJakub Hrozek2013-05-031-60/+12
|
* dyndns: new option dyndns_authJakub Hrozek2013-05-032-0/+2
| | | | | | This options is mostly provided for future expansion. Currently it is undocumented and both IPA and AD dynamic DNS updates default to GSS-TSIG. Allowed values are GSS-TSIG and none.
* dyndns: new option dyndns_force_tcpJakub Hrozek2013-05-031-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1831 Adds a new option that can be used to force nsupdate to only use TCP to communicate with the DNS server.
* dyndns: New option dyndns_update_ptrJakub Hrozek2013-05-032-1/+4
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1832 While some servers, such as FreeIPA allow the PTR record to be synchronized when the forward record is updated, other servers, including Active Directory, require that the PTR record is synchronized manually. This patch adds a new option, dyndns_update_ptr that automatically generates appropriate DNS update message for updating the reverse zone. This option is off by default in the IPA provider. Also renames be_nsupdate_create_msg to be_nsupdate_create_fwd_msg
* dyndns: new option dyndns_refresh_intervalJakub Hrozek2013-05-034-1/+114
| | | | | | | This new options adds the possibility of updating the DNS entries periodically regardless if they have changed or not. This feature will be useful mainly in AD environments where the Windows clients periodically update their DNS records.
* Convert IPA-specific options to be back-end agnosticJakub Hrozek2013-05-035-28/+123
| | | | | | This patch introduces new options for dynamic DNS updates that are not specific to any back end. The current ipa dyndns options are still usable, just with a deprecation warning.
* Refactor dynamic DNS updatesJakub Hrozek2013-05-032-1164/+75
| | | | | | | | | | | | Provides two new layers instead of the previous IPA specific layer: 1) dp_dyndns.c -- a very generic dyndns layer on the DP level. Its purpose it to make it possible for any back end to use dynamic DNS updates. 2) sdap_dyndns.c -- a wrapper around dp_dyndns.c that utilizes some LDAP-specific features like autodetecting the address from the LDAP connection. Also converts the dyndns code to new specific error codes.
* Add SID related lookups to IPA subdomainsSumit Bose2013-05-032-29/+213
| | | | | This patch add the functionality to handle lookup by SIDs and lookups for SIDs to the subdomain branch of the IPA ID provider.
* SUDO: IPA providerLukas Slebodnik2013-05-033-0/+84
| | | | | | This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733
* Use struct to hold different types of request parametersSumit Bose2013-05-024-26/+48
| | | | | | | Currently the POSIX ID or the user name are passed in different parameters to some calls. The method will get cumbersome and error-prone if new parameters like, e.g. the SID, are added. This patch adds a union to hold the different kind of parameters.
* Remove unused attribute listSumit Bose2013-05-023-14/+1
|
* IPA SRV plugin: improve debuggingPavel Březina2013-05-021-0/+6
|
* IPA SRV plugin: use fo_discover_servers requestPavel Březina2013-05-021-105/+20
|
* selinux: if no domain matches, make the debug message louderJakub Hrozek2013-04-291-3/+3
|
* Make IPA SELinux provider aware of subdomain usersSumit Bose2013-04-293-2/+41
| | | | Fixes https://fedorahosted.org/sssd/ticket/1892
* Allow usage of enterprise principalsSumit Bose2013-04-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
* DNS sites support - add IPA SRV pluginPavel Březina2013-04-105-5/+369
| | | | https://fedorahosted.org/sssd/ticket/1032
generated by cgit (git 2.34.1) at 2024-05-30 18:27:00 +0000