summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/ldap_common.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANONJakub Hrozek2011-08-261-1/+2
| | | | https://fedorahosted.org/sssd/ticket/978
* sysdb refactoring: deleted domain variables in sysdb APIJan Zeleny2011-08-151-3/+1
| | | | | The patch also updates code using modified functions. Tests have also been adjusted.
* fo_get_server_name() getter for a server nameJakub Hrozek2011-07-211-1/+10
| | | | | Allows to be more concise in tests and more defensive in resolve callbacks
* Rename fo_get_server_name to fo_get_server_str_nameJakub Hrozek2011-07-211-2/+2
|
* Do not add a NULL host parsed from LDAP URIJakub Hrozek2011-07-211-1/+8
| | | | https://fedorahosted.org/sssd/ticket/911
* Add LDAP access control based on NDS attributesSumit Bose2011-07-081-2/+8
|
* Add helper function msgs2attrs_arrayStephen Gallagher2011-07-081-0/+29
| | | | | This function converts a list of ldb_messages into a list of sysdb_attrs.
* Use name based URI instead of IP address based URIsSumit Bose2011-06-301-37/+2
|
* Add sockaddr_storage to sdap_serviceSumit Bose2011-06-301-0/+11
|
* Switch resolver to using resolv_hostent and honor TTLJakub Hrozek2011-06-151-2/+2
|
* Use escaped IP addresses in LDAP providerJakub Hrozek2011-06-021-6/+56
|
* Make "password" the default for ldap_default_authtok_typeStephen Gallagher2011-05-241-1/+1
|
* Use dereference when processing RFC2307bis nested groupsJakub Hrozek2011-05-201-1/+2
| | | | | | | | Instead of issuing N LDAP requests when processing a group with N users, utilize the dereference functionality to pull down all the members in a single LDAP request. https://fedorahosted.org/sssd/ticket/799
* Add ldap_page_size configuration optionStephen Gallagher2011-04-271-1/+2
|
* Modify principal selection for keytab authenticationJan Zeleny2011-04-251-0/+1
| | | | | | | | | | | | | | | | Currently we construct the principal as host/fqdn@REALM. The problem with this is that this principal doesn't have to be in the keytab. In that case the provider fails to start. It is better to scan the keytab and find the most suitable principal to use. Only in case no suitable principal is found the backend should fail to start. The second issue solved by this patch is that the realm we are authenticating the machine to can be in general different from the realm our users are part of (in case of cross Kerberos trust). The patch adds new configuration option SDAP_SASL_REALM. https://fedorahosted.org/sssd/ticket/781
* Add user and group search LDAP filter optionsJakub Hrozek2011-04-191-0/+20
| | | | https://fedorahosted.org/sssd/ticket/647
* Never remove gecos from the sysdb cacheStephen Gallagher2011-04-121-0/+9
| | | | | Now that gecos can come from either the 'gecos' or 'cn' attributes, we need to ensure that we never remove it from the cache.
* Add host access control supportPierre Ossman2011-03-241-2/+4
| | | | https://fedorahosted.org/sssd/ticket/746
* Do not attempt to use START_TLS on SSL connectionsStephen Gallagher2011-02-161-0/+9
| | | | | | | Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL. https://fedorahosted.org/sssd/ticket/795
* Add option to disable TLS for LDAP authsssd-1_5_1Stephen Gallagher2011-01-271-1/+5
| | | | | Option is named to discourage use in production environments and is intentionally not listed in the SSSDConfig API.
* Delete attributes that are removed from LDAPStephen Gallagher2011-01-211-0/+117
| | | | | | | | Sometimes, a value in LDAP will cease to exist (the classic example being shadowExpire). We need to make sure we purge that value from SSSD's sysdb as well. https://fedorahosted.org/sssd/ticket/750
* Add ldap_tls_{cert,key,cipher_suite} config optionsTyson Whitehead2011-01-201-0/+3
| | | | Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
* Add LDAP expire policy base RHDS/IPA attributeSumit Bose2011-01-191-2/+4
| | | | | The attribute nsAccountLock is used by RHDS, IPA and other directory servers to indicate that the account is locked.
* Add LDAP expire policy based on AD attributesSumit Bose2011-01-191-2/+6
| | | | | | The second bit of userAccountControl is used to determine if the account is enabled or disabled. accountExpires is checked to see if the account is expired.
* Add ldap_search_enumeration_timeout config optionSumit Bose2011-01-171-2/+3
|
* Convert obfuscated password once at startupSumit Bose2011-01-061-0/+41
|
* Add authorizedService supportStephen Gallagher2010-12-211-2/+4
| | | | https://fedorahosted.org/sssd/ticket/670
* Start first enumeration immediatelyStephen Gallagher2010-12-171-3/+28
| | | | | | | | | | | | | | Previously, we would wait for ten seconds before starting an enumeration. However, this meant that on the first startup (before we had run our first enumeration) there was a ten-second window where clients would immediately get back a response with no entries instead of blocking until the enumeration completed. With this patch, SSSD will now run an enumeration immediately upon startup. Further startups will retain the ten-second delay so as not to slow down system bootups. https://fedorahosted.org/sssd/ticket/616
* Fix uninitialized value error in sdap_account_expired_shadow()Sumit Bose2010-12-141-2/+2
| | | | https://fedorahosted.org/sssd/ticket/726
* Replace krb5_kdcip by krb5_server in LDAP providerSumit Bose2010-12-071-3/+11
|
* ldap: Use USN entries if available.Simo Sorce2010-12-071-2/+6
| | | | Otherwise fallback to the default modifyTimestamp indicator
* ldap: add checks to determine if USN features are available.Simo Sorce2010-12-071-5/+5
|
* Add ldap_chpass_uri config optionSumit Bose2010-12-061-1/+9
|
* Add new account expired rule to LDAP access providerSumit Bose2010-12-061-1/+3
| | | | | | | | | | | | | | Two new options are added to the LDAP access provider to allow a broader range of access control rules to be evaluated. 'ldap_access_order' makes it possible to run more than one rule. To keep compatibility with older versions the default is 'filter'. This patch adds a new rule 'expire'. 'ldap_account_expire_policy' specifies which LDAP attribute should be used to determine if an account is expired or not. Currently only 'shadow' is supported which evaluates the ldap_user_shadow_expire attribute.
* Make string_to_shadowpw_days() publicSumit Bose2010-12-061-0/+34
|
* Allow protocol fallback for SRV queriesJakub Hrozek2010-12-011-3/+2
| | | | https://fedorahosted.org/sssd/ticket/691
* Properly document ldap_purge_cache_timeoutStephen Gallagher2010-11-151-1/+9
| | | | Also allow it to be disabled entirely
* Make ldap_search_base a non-mandatory optionSumit Bose2010-11-041-35/+25
|
* Add ldap_deref optionSumit Bose2010-10-221-1/+12
|
* Add option to limit nested groupsSimo Sorce2010-10-181-1/+2
|
* Add infrastructure to LDAP provider for netgroup supportSumit Bose2010-10-131-2/+38
|
* Initialize kerberos service for GSSAPIJakub Hrozek2010-10-131-0/+171
|
* Add KDC to the list of LDAP optionsJakub Hrozek2010-10-131-0/+1
|
* Remove remainder of now unused global LDAP connection handle.eindenbom2010-07-091-171/+0
|
* Add dns_discovery_domain optionJakub Hrozek2010-06-301-1/+0
| | | | | | | | | | | | The service discovery used to use the SSSD domain name to perform DNS queries. This is not an optimal solution, for example from the point of view of authconfig. This patch introduces a new option "dns_discovery_domain" that allows to set the domain part of a DNS SRV query. If this option is not set, the default behavior is to use the domain part of the machine's hostname. Fixes: #479
* Disable connection callbacks when going onlineStephen Gallagher2010-06-091-0/+10
| | | | | | | | Under certain circumstances, the openldap libraries will continue internally trying to reconnect to a connection lost (as during a cable-pull test). We need to drop the reconnection callbacks when marking the backend offline in order to guarantee that they are not called with an invalid sdap_handle.
* Add ldap_access_filter optionStephen Gallagher2010-05-271-1/+2
| | | | | | | | | | This option (applicable to access_provider=ldap) allows the admin to set an additional LDAP search filter that must match in order for a user to be granted access to the system. Common examples for this would be limiting access to users by in a particular group, for example: ldap_access_filter = memberOf=cn=access_group,ou=Groups,dc=example,dc=com
* Add offline callback to disconnect global SDAP handleSumit Bose2010-05-271-1/+9
|
* Add ldap_krb5_ticket_lifetime optionSumit Bose2010-05-161-1/+2
|
* Use service discovery in backendsJakub Hrozek2010-05-071-8/+49
| | | | | | | | | Integrate the failover improvements with our back ends. The DNS domain used in the SRV query is always the SSSD domain name. Please note that this patch changes the default value of ldap_uri from "ldap://localhost" to "NULL" in order to use service discovery with no server set.
generated by cgit (git 2.34.1) at 2024-05-19 18:12:08 +0000