summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap_async_users.c
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Don't fail if subdomain cannot be found by sidLukas Slebodnik2014-01-221-4/+6
| | | | | | | | | Domain needn't contain sid if id_provider is ldap. With enabled id mapping, user couldn't be stored, because domain couldn't be found by sid. Resolves: https://fedorahosted.org/sssd/ticket/2172
* LDAP: Split out a request to search for a user w/o savingJakub Hrozek2013-11-201-33/+131
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2077 Certain situations require that a user entry is downloaded for further inpection, but not saved to the sysdb right away. This patch splits the previously monolithic request into one that just downloads the data and one that uses the new one to download and save the user.
* sdap_save_user: try to determine domain by SIDPavel Březina2013-10-291-22/+32
| | | | | | | | | | | | | GC contains objects from both parent domain and subdomain. Lets say we have user with UID 5000 that belongs to a subdomain and overlapping search bases dc=ad,dc=pb and dc=sub,dc=ad,dc=pb. Now we call 'getent passwd 5000' and this request goes through data provider, searching in parent domain first. Even though this user does not belong to this domain it is found and stored as ad.pb user. With this patch we look at user's SID and put it into correct domain.
* sdap_idmap_domain_has_algorithmic_mapping: add domain name argumentSumit Bose2013-10-251-0/+1
| | | | | | | | | | | | | When libss_idmap was only used to algorithmically map a SID to a POSIX ID a domain SID was strictly necessary and the only information needed to find a domain. With the introduction of external mappings there are cases where a domain SID is not available. Currently we relied on the fact that external mapping was always used as a default if not specific information about the domain was found. The lead to extra CPU cycles and potentially confusing debug messages. Adding the domain name as a search parameter will avoid this.
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-2/+3
|
* sdap_save_user: save original primary GID of subdomain usersSumit Bose2013-08-191-11/+22
| | | | | | | | | | | | | | If ID mapping is enabled we use magic private groups (MPG) for subdomains, i.e. the UID and the primary GID of the user will have the same numerical value. As a consequence the information about the original primary group might get lost because neither in AD domains nor on a typical UNIX system the user is an explicit member of it's primary group. With this patch the mapped GID or the original primary group is saved in the cached user object under a new attribute. Fixes https://fedorahosted.org/sssd/ticket/2027
* LDAP: Use domain-specific name where appropriateJakub Hrozek2013-07-241-42/+39
| | | | | | | | | The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
* Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose2013-06-281-1/+4
| | | | | | | | | | Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
* LDAP: Do not store separate GID for subdomain usersJakub Hrozek2013-06-071-10/+18
| | | | | As the subdomains are MPG domains, we don't want to store a separate GID for the subdomain users, but rather just create a UPG.
* Split generating primary GID for ID mapped users into a separate functionJakub Hrozek2013-06-071-41/+70
| | | | | | Move the part of sdap_save_user into a separate function so that it can be special cased an only called for users in primary domains, not subdomain users.
* LDAP: store FQDNs for trusted users and groupsJakub Hrozek2013-06-071-2/+10
| | | | | | Because the NSS responder expects the name attribute to contain FQDN, we must save the name as FQDN in the LDAP provider if the domain we save to is a subdomain.
* LDAP: always store SID if availableSumit Bose2013-05-021-12/+30
| | | | | | | Currently the string representation of a SID is only stored in the cache for debugging purpose if SID based ID-mapping is used. This patch unconditionally stores the SID if available to allow SID-to-name mappings from the cache.
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-201-0/+91
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Add domain argument to sysdb_store_user()Simo Sorce2013-01-151-2/+3
| | | | Also remove sysdb_store_domuser()
* AD: replace GID/UID, do not add another oneJakub Hrozek2013-01-091-2/+5
| | | | | | | The code would call sysdb_attrs_add_uint32 which added another UID or GID to the ID=0 we already downloaded from LDAP (0 is the default value) when ID-mapping an entry. This led to funky behaviour later on when we wanted to process the ID.
* idmap: Silence DEBUG messages when dealing with built-in SIDs.Michal Zidek2012-11-281-44/+51
| | | | | | | | When converting built-in SID to unix GID/UID a confusing debug message about the failed conversion was printed. This patch special cases these built-in objects. https://fedorahosted.org/sssd/ticket/1593
* LDAP: fix uninitialized variableOndrej Kos2012-11-231-1/+1
| | | | initialized variable, was causing build warning
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-201-5/+17
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
* do not default fullname to gecos when schema = adPavel Březina2012-11-081-0/+14
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1482 When we add fullname to user_attrs, then sysdb_add_basic_user() will set fullname to gecos when it initially creates the user object in the cache, but it will be overwritten in the same transaction when sysdb_store_user() adds all the user_attrs.
* Unify usage of sysdb transactionsMichal Zidek2012-08-231-1/+12
| | | | | | Removing bad examples of usage of sysdb_transaction_start/commit/end functions and making it more consistent (all files except of src/db/sysdb_*.c).
* Ghost members - removed sdap_check_aliases()Jan Zeleny2012-05-311-6/+0
| | | | | | | This function is no longer necessary because we don't have fake user entries any more. The original purpose of this function was to check if there are fake user entries for particular user and, if yes, to update its membership.
* LDAP: Add helper function to map IDsStephen Gallagher2012-05-031-57/+6
| | | | | This function will also auto-create a new ID map if the domain has not been seen previously.
* LDAP: Do not remove uidNumber and gidNumber attributes when saving id-mapped ↵Stephen Gallagher2012-05-031-0/+11
| | | | entries
* LDAP: Add helper routine to convert LDAP blob to SID stringStephen Gallagher2012-05-031-20/+4
|
* LDAP: Map the user's primaryGroupIDStephen Gallagher2012-05-031-12/+64
|
* LDAP: Allow automatically-provisioning a domain and rangeStephen Gallagher2012-05-031-3/+43
| | | | | | | | If we get a user who is a member of a domain we haven't seen before, add a domain entry (auto-assigning its slice). Since we don't know the domain's real name, we'll just save the domain SID string as the name as well.
* LDAP: Enable looking up ID-mapped users by nameStephen Gallagher2012-05-031-9/+54
|
* Modifications to simplify list_missing_attrsJan Zeleny2012-02-241-11/+2
|
* LDAP: Only use paging control on requests for multiple entriesStephen Gallagher2012-02-241-1/+2
| | | | | | | | | | The paging control can cause issues on servers that put limits on how many paging controls can be active at one time (on some servers, it is limited to one per connection). We need to reduce our usage so that we only activate the paging control when making a request that may return an arbitrary number of results. https://fedorahosted.org/sssd/ticket/1202 phase one
* Fix memory hierarchy when processing nested group membershipsJakub Hrozek2012-02-141-1/+2
| | | | https://fedorahosted.org/sssd/ticket/1186
* NSS: Add individual timeouts for entry typesStephen Gallagher2012-02-041-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1016
* LDAP: Do not fail if RootDSE check cannot determine search basesStephen Gallagher2012-02-041-0/+9
| | | | https://fedorahosted.org/sssd/ticket/1152
* Save original memberof, not memberofJakub Hrozek2011-12-201-4/+16
|
* Use the case sensitivity flag in the LDAP providerJakub Hrozek2011-12-161-1/+1
|
* Refactor saving sdap entitiesJakub Hrozek2011-12-161-78/+20
| | | | | There was too much code duplication between sdap_save_{user,group,netgroup}. This patch removes the most egregious ones.
* LDAP: Add support for multiple search bases for user enumerationStephen Gallagher2011-11-021-5/+43
|
* LDAP: Support multiple user search bases (non-enumeration)Stephen Gallagher2011-11-021-13/+62
|
* SysDB commands that save lastUpdate allows this value to be passed inPavel Březina2011-10-131-3/+6
| | | | https://fedorahosted.org/sssd/ticket/836
* Store name aliases for users, groupsJakub Hrozek2011-09-281-0/+21
| | | | | | Also checks fake users for aliases when storing a real users so that getgrnam for a RFC2307 group that references a user by his secondary name followed by getpwnam for this user by his primary name works
* sdap_async_accounts.c splitJan Zeleny2011-08-151-0/+513
The file has been split in three: sdap_async_users.c sdap_async_groups.c sdap_async_initgroups.c https://fedorahosted.org/sssd/ticket/864
generated by cgit (git 2.34.1) at 2024-05-12 08:03:36 +0000