summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa
Commit message (Collapse)AuthorAgeFilesLines
* Primary server support: IPA adaptationJan Zeleny2012-08-013-35/+77
| | | | | | This patch adds support for the primary server functionality into IPA provider. No backup servers are added at the moment, just the basic support is in place.
* Primary server support: basic support in failover codeJan Zeleny2012-08-011-1/+1
| | | | | | | | Now there are two list of servers for each service. If currently selected server is only backup, then an event will be scheduled which tries to get connection to one of primary servers and if it succeeds, it starts using this server instead of the one which is currently connected to.
* Support fetching of host from sysdb in SELinux codeJan Zeleny2012-07-311-11/+55
| | | | | The host record will be fetched if HBAC is used as access provider since the record is already downloaded and it can be trusted to be valid.
* Support fetching of HBAC rules from sysdb in SELinux codeJan Zeleny2012-07-311-14/+47
| | | | | If HBAC is active, SELinux code will reuse them instead of downloading them from the server again.
* Modify hbac_get_cached_rules() so it can be used outside of HBAC codeJan Zeleny2012-07-312-14/+22
|
* Renamed session provider to selinux providerJan Zeleny2012-07-274-47/+47
|
* Provide counter of possible matches in SELinux IPA providerJan Zeleny2012-07-251-6/+6
| | | | | | The counter is important so the for cycle doesn't depend on the first NULL pointer. That would cause potential errors if more records are following after this first NULL pointer.
* Fix linking of HBAC rules and SELinux user mapsJan Zeleny2012-07-251-0/+13
| | | | | | | Translate manually memberHost and memberUser to originalMemberUser and originalMemberHost. Without this, the HBAC rule won't be matched against current user and/or host, meaning that no SELinux user map connected to it will be matched againts any user on the system.
* Remove ipa_selinux_map_merge()Jan Zeleny2012-07-253-55/+0
| | | | | This function is no longer necessary since sysdb interface for copying elements has been implemented.
* Added some DEBUG statements into SELinux related codeJan Zeleny2012-07-231-4/+14
|
* Fix uninitialized valuesNick Guay2012-07-181-4/+4
| | | | https://fedorahosted.org/sssd/ticket/1379
* IPA: Return and save all SELinux rules in the providerJakub Hrozek2012-07-181-47/+27
| | | | https://fedorahosted.org/sssd/ticket/1421
* IPA: Download defaults even if there are no SELinux mappingsJakub Hrozek2012-07-181-60/+59
| | | | | We should always download the defaults because even if there are no rules, we might want to use (or update) the defaults.
* Modify priority evaluation in SELinux user mapsJan Zeleny2012-07-181-2/+34
| | | | | | | | | | | | | | | | | | | The functionality now is following: When rule is being matched, its priority is determined as a combination of user and host specificity (host taking preference). After the rule is matched in provider, only its host priority is stored in sysdb for later usage. When rules are matched in the responder, their user priority is determined. After that their host priority is retrieved directly from sysdb and sum of both priorities is user to determine whether to use that rule or not. If more rules have the same priority, the order given in IPA config is used. https://fedorahosted.org/sssd/ticket/1360 https://fedorahosted.org/sssd/ticket/1395
* Remove dead code in ipa_subdomains_handler_done()Sumit Bose2012-07-101-1/+1
| | | | Fixes https://fedorahosted.org/sssd/ticket/1410
* KRB5: Create a common init routine for krb5_child optionsStephen Gallagher2012-07-061-45/+6
| | | | | This will reduce code duplication between the krb5, ipa and ad providers
* KRB5: Drop memctx parameter of krb5_try_kdcipStephen Gallagher2012-07-061-1/+1
| | | | | | | | | | | | | | | | This function is not supposed to return any newly-allocated memory directly. It was actually leaking the memory for krb5_servers if krb5_kdcip was being used, though it was undetectable because it was allocated on the provided memctx. This patch removes the memctx parameter and allocates krb5_servers temporarily on NULL and ensures that it is freed on all exit conditions. It is not necessary to retain this memory, as dp_opt_set_string() performs a talloc_strdup onto the appropriate context internally. It also updates the DEBUG messages for this function to the appropriate new macro levels.
* IPA: Don't hang onto memory longer than necessaryStephen Gallagher2012-07-021-0/+1
| | | | | This request and attached memory would be freed at the end of access-check processing, but it's a waste to keep it around.
* sudo: add host info optionsPavel Březina2012-06-291-0/+5
| | | | | | | | | | Adds some option that allows to manually configure a host filter. ldap_sudo_use_host_filter - if false, we will download all rules regardless their sudoHost attribute ldap_sudo_hostnames - list hostnames and/or fqdn that should be downloaded, separated with spaces ldap_sudo_ip - list of IPv4/6 address and/or network that should be downloaded, separated with spaces ldap_sudo_include_netgroups - include rules that contains netgroup in sudoHost ldap_sudo_include_regexp - include rules that contains regular expression in sudoHost
* sudo provider: add ldap_sudo_smart_refresh_intervalPavel Březina2012-06-291-0/+1
|
* sudo provider: remove old timerPavel Březina2012-06-291-2/+0
|
* sudo provider: add ldap_sudo_full_refresh_intervalPavel Březina2012-06-291-0/+1
|
* Add support for ID rangesSumit Bose2012-06-216-10/+197
|
* Make krb5_ccname_template and krb5_ccachedir configurableJakub Hrozek2012-06-141-2/+2
|
* LDAP: Add ldap_*_use_matching_rule_in_chain optionsStephen Gallagher2012-06-131-0/+2
|
* IPA subdomains - ask for information about master domainJan Zeleny2012-06-106-17/+164
| | | | | | | The query is performed only if there is missing information in the cache. That means this should be done only once after restart when cache doesn't exist. All subsequent requests for subdomains won't include the request for master domain.
* Add support for filtering atributesJan Zeleny2012-05-315-7/+12
| | | | | This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
* Fixed issue in SELinux user mapsJan Zeleny2012-05-221-0/+2
| | | | | | There was an issue when IPA provider didn't set PAM_SUCCESS when successfully finished loading SELinux user maps. This lead to the map not being read in the responder.
* Filter out IP addresses inappropriate for DNS forward recordsJakub Hrozek2012-05-101-1/+57
| | | | https://fedorahosted.org/sssd/ticket/949
* LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher2012-05-105-7/+8
| | | | | | | This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
* LDAP: Map the user's primaryGroupIDStephen Gallagher2012-05-031-0/+1
|
* LDAP: Allow setting a default domain for id-mapping slice 0Stephen Gallagher2012-05-031-0/+2
|
* LDAP: Add autorid compatibility modeStephen Gallagher2012-05-031-0/+1
|
* LDAP: Add ID mapping range settingsStephen Gallagher2012-05-031-0/+3
|
* LDAP: Add id-mapping optionStephen Gallagher2012-05-031-0/+1
|
* LDAP: Add objectSID config optionStephen Gallagher2012-05-031-0/+2
|
* SSH: Add dp_get_host_send to common responder codeJakub Hrozek2012-05-031-9/+6
| | | | | | | | Instead of using account_info request, creates a new ssh specific request. This improves code readability and will make the code more flexible in the future. https://fedorahosted.org/sssd/ticket/1176
* IPA: Check return valuesJakub Hrozek2012-05-032-2/+12
|
* HBAC: Prevent NULL dereference in hbac_evaluateJakub Hrozek2012-05-021-2/+4
| | | | 'info' is optional parameter and can be set to NULL
* ipa_get_config_send: remove unused assignmentJakub Hrozek2012-05-021-1/+0
|
* IPA netgroups: return EOK when there are no netgroups to processJakub Hrozek2012-05-021-0/+1
| | | | If the code fell through the loop, ret would have been random value.
* execv, excvp and exec_child never return EOKStef Walter2012-05-011-5/+3
| | | | * So don't need to handle that case
* Utilize sysdb context within be_req in HBACJan Zeleny2012-04-241-2/+2
|
* Detect subdomain request in IPA access providerJan Zeleny2012-04-241-0/+10
|
* Accept be_req instead if be_ctx in LDAP access providerJan Zeleny2012-04-241-1/+1
|
* Basic support for subdomains in auth providerJan Zeleny2012-04-241-0/+6
|
* Add ID operations in subdomainsJan Zeleny2012-04-243-0/+276
|
* Add s2n extended operationSumit Bose2012-04-242-0/+667
|
* IPA: Add get-domains targetSumit Bose2012-04-246-0/+425
|
* Prevent printing NULL from DEBUG messagesJakub Hrozek2012-04-183-4/+4
|
generated by cgit (git 2.34.1) at 2024-05-26 07:53:15 +0000