summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/ldap_auth.c
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Search for original DN during auth if it's missingJakub Hrozek2013-11-201-16/+194
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2077 If during the LDAP authentication we find out that the originalDN to bind as is missing (because the ID module is not LDAP based), we can try to look up the user from LDAP without saving him just in order to receive the originalDN.
* Fix formating of variables with type: time_tLukas Slebodnik2013-09-111-1/+1
|
* Fix formating of variables with type: longLukas Slebodnik2013-09-111-3/+4
|
* ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2013-08-111-0/+15
| | | | | | | | Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
* ldap: only update shadowLastChange when password change is successfulJim Collins2013-07-011-1/+2
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
* Display the last grace warning, tooJakub Hrozek2013-05-021-2/+2
| | | | | | | Due to a comparison error, the last warning when an LDAP password was in its grace period was never displayed. https://fedorahosted.org/sssd/ticket/1890
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-021-6/+6
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Use common error facility instead of sdap_resultSimo Sorce2013-03-191-164/+112
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-211-2/+2
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-211-19/+18
| | | | In preparation for making be_req opaque
* Introduce be_req_terminate() helperSimo Sorce2013-01-211-13/+6
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove domain from be_req structureSimo Sorce2013-01-211-1/+1
|
* Remove sysdb as a be context structure memberSimo Sorce2013-01-211-2/+2
| | | | The sysdb context is already available through the 'domain' structure.
* Add domain argument to sysdb_cache_password()Simo Sorce2013-01-151-0/+1
|
* Add domain argument to sysdb_get_user_attr()Simo Sorce2013-01-151-3/+4
|
* Change pam data auth tokens.Simo Sorce2013-01-101-54/+36
| | | | Use the new authtok abstraction and interfaces throught the code.
* let ldap_chpass_uri failover work when using same hostnamePavel Březina2012-12-151-11/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1699 We want to continue with the next server on all errors, not only on ETIMEDOUT. This particullar ticket was dealing with ECONNREFUSED.
* warn user if password is about to expirePavel Březina2012-12-021-3/+4
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1638 If pwd_exp_warning == 0, expiry warning should be printed if it is returned by server. If pwd_exp_warning > 0, expiry warning should be printed only if the password will expire in time <= pwd_exp_warning. ppolicy->expiry contains period in seconds after which the password expires. Not the exact timestamp. Thus we should not add 'now' to pwd_exp_warning.
* FO: Check server validity before setting statusJakub Hrozek2012-09-131-1/+3
| | | | | | | | | | | | | | | | | The list of resolved servers is allocated on the back end context and kept in the fo_service structure. However, a single request often resolves a server and keeps a pointer until the end of a request and only then gives feedback about the server based on the request result. This presents a big race condition in case the SRV resolution is used. When there are requests coming in in parallel, it is possible that an incoming request will invalidate a server until another request that holds a pointer to the original server is able to give a feedback. This patch simply checks if a server is in the list of servers maintained by a service before reading its status. https://fedorahosted.org/sssd/ticket/1364
* Retry the next server if bind during LDAP auth times outJakub Hrozek2012-09-051-1/+6
|
* Modify behavior of pam_pwd_expiration_warningJan Zeleny2012-05-041-12/+30
| | | | | | | | | | | | | | | | | | New option pwd_expiration_warning is introduced which can be set per domain and can override the value specified by the original pam_pwd_expiration_warning. If the value of expiration warning is set to zero, the filter isn't apllied at all - if backend server returns the warning, it will be automatically displayed. Default value for Kerberos: 7 days Default value for LDAP: don't apply the filter Technical note: default value when creating the domain is -1. This is important so we can distinguish between "no value set" and 0. Without this possibility it would be impossible to set different values for LDAP and Kerberos provider.
* Detect cycle in the fail over on subsequent resolve requests onlyJakub Hrozek2012-03-081-1/+2
|
* Only do one cycle when resolving a serverJakub Hrozek2012-03-061-2/+3
| | | | https://fedorahosted.org/sssd/ticket/1214
* Update shadowLastChanged attribute during LDAP password changeJan Zeleny2012-02-061-0/+46
| | | | https://fedorahosted.org/sssd/ticket/1019
* Cleanup: Remove unused parametersJakub Hrozek2011-11-221-2/+1
|
* Multiline macro cleanupJakub Hrozek2011-09-281-2/+2
| | | | | | | | | | This is mostly a cosmetic patch. The purpose of wrapping a multi-line macro in a do { } while(0) is to make the macro usable as a regular statement, not a compound statement. When the while(0) is terminated with a semicolon, the do { } while(0); block becomes a compound statement again.
* Improve error message for LDAP password constraint violationJakub Hrozek2011-09-061-11/+16
| | | | https://fedorahosted.org/sssd/ticket/985
* Improve password policy error code and messageSumit Bose2011-08-251-4/+9
| | | | | | Instead of returning PAM_SYSTEM_ERR if they necessary attributes for the requested password policy cannot be found we return PAM_PERM_DENIED. Additionally the log message says that the access is denied.
* sysdb refactoring: memory context deletedJan Zeleny2011-08-151-2/+1
| | | | | | This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.
* sysdb refactoring: deleted domain variables in sysdb APIJan Zeleny2011-08-151-2/+1
| | | | | The patch also updates code using modified functions. Tests have also been adjusted.
* Use ldap_init_fd() instead of ldap_initialize() if availableSumit Bose2011-06-301-1/+2
|
* Do not check pwdAttributeSumit Bose2011-06-161-9/+0
| | | | | | | It is not safe to check pwdAttribute to see if server side password policies are active. Only if a LDAP_CONTROL_PASSWORDPOLICYRESPONSE is present the bind response we can assume that there is a server side password policy.
* Fix unchecked return values of pam_add_responseJakub Hrozek2011-04-081-2/+7
| | | | https://fedorahosted.org/sssd/ticket/798
* Do not attempt to use START_TLS on SSL connectionsStephen Gallagher2011-02-161-9/+17
| | | | | | | Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL. https://fedorahosted.org/sssd/ticket/795
* Add option to disable TLS for LDAP authsssd-1_5_1Stephen Gallagher2011-01-271-1/+13
| | | | | Option is named to discourage use in production environments and is intentionally not listed in the SSSDConfig API.
* Fix return value checkSumit Bose2011-01-191-2/+2
|
* Add ldap_chpass_uri config optionSumit Bose2010-12-061-5/+14
|
* Make string_to_shadowpw_days() publicSumit Bose2010-12-061-33/+0
|
* Fix offline detection for LDAP auth/chpassSumit Bose2010-11-191-5/+13
|
* Return offline instead of errorStephen Gallagher2010-10-041-1/+2
| | | | | | | | When the failover code returns that there are no available servers while we are marked offline, we were returning an error to the PAM authentication code. Instead, we should return success with a result value of SDAP_UNAVAIL so that the PAM responder will mark the domain offline and attempt offline authentication.
* Treat a zero-length password as a failureStephen Gallagher2010-08-241-0/+7
| | | | | Some LDAP servers allow binding with blank passwords. We should not allow a blank password to authenticate the SSSD.
* Fix chpass operations with LDAP providerStephen Gallagher2010-08-041-0/+1
| | | | | | | The initial verification of the old password was returning an error because we were not explicitly setting dp_err to DP_ERR_SUCCESS and it was initialized earlier in the function to DP_ERR_FATAL.
* Add more warnings about nearly expired passwordsSumit Bose2010-05-071-5/+66
| | | | | For the shadow and mit_kerberos password policy warnings are sent to the client if the password is about to expire.
* Use all available servers in LDAP providerJakub Hrozek2010-05-071-6/+33
|
* Display a message if a password reset by root failsSumit Bose2010-04-261-0/+8
|
* sysdb: convert sysdb_get_user_attrSimo Sorce2010-04-121-134/+69
|
* sysdb: convert sysdb_cache_passwordSimo Sorce2010-04-121-32/+11
|
* Fix warnings from -Wmissing-field-initializersSumit Bose2010-03-251-1/+3
| | | | This patch removes some tab-indentations from pamsrv.c, too.
* Improvements for LDAP Password Policy supportRalf Haferkamp2010-03-221-2/+50
| | | | | | | | Display warnings about remaining grace logins and password expiration to the user, when LDAP Password Policies are used. Improved detection if LDAP Password policies are supported by LDAP Server.
* Fixed authentication check for CHAUTHTOK_PRELIMRalf Haferkamp2010-03-151-1/+1
| | | | | When changing passwords, treat SDAP_AUTH_PW_EXPIRED as a successful authentication in SSS_PAM_CHAUTHTOK_PRELIM.
generated by cgit (git 2.34.1) at 2024-06-10 06:05:59 +0000