summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap
Commit message (Collapse)AuthorAgeFilesLines
...
* LDAP: Fix value initialization warningsLukas Slebodnik2013-04-042-2/+2
|
* Centralize resolv_init, remove resolv context listJakub Hrozek2013-04-031-16/+2
|
* Init failover with be_res optionsJakub Hrozek2013-04-031-24/+5
|
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-022-9/+15
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* refactor nested group processing: replace old codePavel Březina2013-04-022-1721/+21
| | | | https://fedorahosted.org/sssd/ticket/1784
* refactor nested group processing: add new codePavel Březina2013-04-021-0/+2229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1784 1. initialization (main-req), returns members of input group 2. evaluate group members (group) 3. perform individual search (no-deref) or dereference attribute (deref) 4a. no-deref 1. perform a lookup depending on the type of the member object 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups 4b. deref 1. perform a dereference lookup on member attribute 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups Tevent request flow: main-req | group |------------------------| no-deref deref | | |----|------|---------| | user group unknown recurse recurse / \ | | | ... | | | ... user group group group
* LDAP: Fix value initializationOndrej Kos2013-03-271-1/+1
|
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-214-4/+44
| | | | https://fedorahosted.org/sssd/ticket/1660
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-207-11/+191
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Convert sdap_access to new error codesSimo Sorce2013-03-193-453/+186
| | | | Also simplify sdap_access_send to avoid completely fake _send() routines.
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-191-10/+0
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Use common error facility instead of sdap_resultSimo Sorce2013-03-195-316/+202
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* Fix initialization of multiple variablesOndrej Kos2013-03-132-2/+2
|
* More generalized function open_debug_file_ex()Lukas Slebodnik2013-03-131-5/+1
| | | | | | | | Function open_debug_file_ex() set flag FD_CLOEXEC to opened file according to the value of third parameter. Removed duplicity of unsetting FD_CLOEXEC after calling function open_debug_file_ex()
* Fixed typo in debug message.Lukas Slebodnik2013-03-071-3/+5
| | | | | C compiler did not complain, because "index" is function defined in header file <string.h>
* Check the return value of sysdb_search_servicesJakub Hrozek2013-03-051-0/+6
|
* sdap_fill_memberships: continue if a member is not foud in sysdbPavel Březina2013-02-271-3/+7
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1755 sdap_find_entry_by_origDN() may return ENOENT in these non-error scenarios: If a member is out of scope of configured nesting level, sssd produces few noise lines indicating failure. The worse case is when a member is outside of configured search bases. In this case we save the group with incomplete membership,
* sysdb: try dealing with binary-content attributesJan Engelhardt2013-02-262-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1818 I have here a LDAP user entry which has this attribute loginAllowedTimeMap:: AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA In the function sysdb_attrs_add_string(), called from sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is the wrong thing to do. The result of strlen is then used to populate the .v_length member of a struct ldb_val - and this will set it to zero in this case. (There is also the problem that there may not be a '\0' at all in the blob.) Subsequently, .v_length being 0 makes ldb_modify(), called from sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End result is that users do not get stored in the sysdb, and programs like `id` or `getent ...` show incomplete information. The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave fine, but that may not mean that is the absolute lower boundary of introduction of the problem.
* LDAP: Check for authtok validityJakub Hrozek2013-02-111-7/+9
| | | | | | | | | | The default authtok type in the LDAP provider (unlike the new IPA and AD providers) is "password". This oddity dates back to when password was the only supported authtok type in the SSSD, so configuration specifying only the password and bind DN was valid. We need to check the authtok validity as well before attempting to use it.
* Add realm info to sss_domain_infoSimo Sorce2013-02-101-1/+1
|
* nested groups: fix group lookup hangs if member dn is incorrectPavel Březina2013-01-281-0/+24
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1783 When dn in member attribute is invalid (e.g. rdn instead of dn) or it is outside of configured search bases, we might hit a situation when tevent_req is marked as done before any callback could be attached on it.
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-215-8/+8
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-215-39/+43
| | | | In preparation for making be_req opaque
* Introduce be_req_terminate() helperSimo Sorce2013-01-214-17/+10
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove domain from be_req structureSimo Sorce2013-01-211-1/+1
|
* Pass domain not be_req to access check functionsSimo Sorce2013-01-213-17/+25
|
* Remove sysdb as a be request structure memberSimo Sorce2013-01-211-2/+2
| | | | The sysdb context is already available through the 'domain' context.
* Remove sysdb as a be context structure memberSimo Sorce2013-01-2113-27/+27
| | | | The sysdb context is already available through the 'domain' structure.
* Move ldap provider access functionsSimo Sorce2013-01-212-59/+86
| | | | | | It was confusing to see the ldap provider own handler mixed with the generic ldap access code used also by the ipa and ad providers. So move the ldap provider handler code in its own file.
* LDAP: Compare lists of DNs when saving autofs entriesJakub Hrozek2013-01-211-134/+147
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1758 The autofs entries do not have the key as an unique identifier, but rather the full (key, value) tuple as some keys have a special meaning, such as the direct mount key (/-) and may be present in a single map multiple times. Comparing the full DN that contains both the key and the value will allow for working updates if either key or value changes.
* LDAP: avoid complex realloc logic in save_rfc2307bis_group_membershipsJakub Hrozek2013-01-151-12/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1761 The function tried to be smart and realloc only when needed, but that only lead to hard-to find bugs where the logic would not allocate the proper space. Remove the reallocation and prefer readability over speed in this case.
* Add domain arguments to sysdb sudo functionsSimo Sorce2013-01-154-9/+22
|
* Add domain arguments to sysdb services functionsSimo Sorce2013-01-152-4/+5
| | | | also fix sysdb_svc_add declarations
* Add domain argument to sysdb autofs functionsSimo Sorce2013-01-152-11/+18
|
* Add domain arguemnt to sysdb_get_real_name()Simo Sorce2013-01-151-1/+2
|
* Add domain argument to sysdb_idmap_ funcitonsSimo Sorce2013-01-151-1/+2
|
* Add domain argument to sysdb_remove_attrs()Simo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_has/set_enumerated()Simo Sorce2013-01-153-3/+4
|
* Add domain arg to sysdb_search/delete_netgroup()Simo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_delete_group()Simo Sorce2013-01-152-3/+5
| | | | Also remove sysdb_delete_domgroup()
* Add domain argument to sysdb_search_groups()Simo Sorce2013-01-153-7/+12
|
* Add domain argument to sysdb_delete_user()Simo Sorce2013-01-152-4/+6
| | | | Also remove sysdb_delete_domuser()
* Add domain arg to sysdb_search_users()Simo Sorce2013-01-153-16/+25
|
* Add domain argument to sysdb_cache_password()Simo Sorce2013-01-151-0/+1
|
* Add domain arg to sysdb group member functionsSimo Sorce2013-01-152-7/+9
|
* Add domain argument to sysdb_store_group()Simo Sorce2013-01-151-3/+5
| | | | Also remove sysdb_store_domgroup()
* Add domain argument to sysdb_store_user()Simo Sorce2013-01-151-2/+3
| | | | Also remove sysdb_store_domuser()
* Add domain arguments to sysdb_add_inetgroup fns.Simo Sorce2013-01-151-1/+1
|
* Add domain arguments to sysdb_add_group functions.Simo Sorce2013-01-152-4/+6
|
* Add domain argument to sysdb_set_user_attr()Simo Sorce2013-01-152-3/+8
|
generated by cgit (git 2.34.1) at 2024-06-22 21:53:11 +0000