summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap_async_initgroups_ad.c
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Add a new error code for malformed access control filterJakub Hrozek2014-01-091-2/+2
| | | | | | | https://fedorahosted.org/sssd/ticket/2164 The patch adds a new error code and special cases the new code so that access is denied and a nicer log message is shown.
* AD: cross-domain membership fixSumit Bose2013-12-191-9/+148
| | | | | | | | | | | | | | | | | | | A recent patch directed all call related to group membership lookups to the AD LDAP port to fix an issue related to missing group memberships in the Global Catalog. As a side-effect it broke cross-domain group-memberships because those cannot be resolved by the connection to the LDAP port. The patch tires to fix this by restoring the original behaviour in the top-level lookup calls in the AD provider and switching to the LDAP port only for the LDAP request which is expected to return the full group membership. Additionally this patch contains a related fix for the tokenGroups with Posix attributes patch. The original connection, typically a Global Catalog connection in the AD case is passed down the stack so that the group lookup after the tokenGroups request can run over the same connection.
* AD: filter domain local groups for trusted/sub domainsSumit Bose2013-12-191-2/+4
| | | | | | | | | | | | | | In Active Directory groups with a domain local scope should only be used inside of the specific domain. Since SSSD read the group memberships from LDAP server of the user's domain the domain local groups are included in the LDAP result. Those groups should be filtered out if the domain is a sub/trusted domain, i.e. is not the domain the client running SSSD is joined to. The groups will still be in the cache but marked as non-POSIX groups and no GID will be assigned. Fixes https://fedorahosted.org/sssd/ticket/2178
* ad: use tokengroups even when id mapping is disabledPavel Březina2013-12-181-20/+517
| | | | https://fedorahosted.org/sssd/ticket/1568
* ad: refactor tokengroups initgroupsPavel Březina2013-12-181-213/+339
| | | | | sdap_get_ad_tokengroups_initgroups is split into more parts so it can be reused later.
* Initialize sid_str to NULL to avoid freeing random dataJakub Hrozek2013-11-081-1/+1
| | | | | If any function before failed, sss_idmap_free_sid() might have been called with random data.
* free idmapped SIDs correctlyPavel Březina2013-11-071-0/+2
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2133
* ad: store group in correct tree on initgroups via tokenGroupsPavel Březina2013-09-261-11/+41
| | | | | | | | | If tokenGroups contains group from different domain than user's, we stored it under the user's domain tree in sysdb. This patch changes it so we store it under group's domain tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
* Fix formating of variables with type: gid_tLukas Slebodnik2013-09-111-2/+1
|
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-1/+1
|
* sysdb_add_incomplete_group: store SID string is availableSumit Bose2013-08-191-1/+1
| | | | | | During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
* LDAP: new SDAP domain structureJakub Hrozek2013-06-071-1/+1
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* Fixing critical format string issues.Lukas Slebodnik2013-05-201-1/+1
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* Add domain arg to sysdb group member functionsSimo Sorce2013-01-151-2/+2
|
* Add domain arguments to sysdb_add_group functions.Simo Sorce2013-01-151-2/+4
|
* Add domain to sysdb_search_group_by_gid()Simo Sorce2013-01-151-1/+1
| | | | Also remove unused sysdb_search_domgroup_by_gid()
* Add domain to sysdb_search_group_by_name()Simo Sorce2013-01-151-1/+3
| | | | Also remove unused sysdb_search_domgroup_by_name()
* Add domain to sysdb_search_user_by_name()Simo Sorce2013-01-151-4/+10
| | | | Also remove unused sysdb_search_domuser_by_name()
* idmap: Silence DEBUG messages when dealing with built-in SIDs.Michal Zidek2012-11-281-1/+5
| | | | | | | | When converting built-in SID to unix GID/UID a confusing debug message about the failed conversion was printed. This patch special cases these built-in objects. https://fedorahosted.org/sssd/ticket/1593
* AD: Handle sysdb lookup failure during tokenGroups processingStephen Gallagher2012-09-241-0/+6
|
* AD: Optimize initgroups lookups with tokenGroupsStephen Gallagher2012-09-241-0/+277
| | | | https://fedorahosted.org/sssd/ticket/1355
* LDAP: Add support for AD chain matching extension in initgroupsStephen Gallagher2012-06-131-0/+292
generated by cgit (git 2.34.1) at 2024-06-09 18:35:07 +0000