summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* AD: Use the correct include guardJakub Hrozek2013-08-191-3/+3
|
* Remove include recursionLukas Slebodnik2013-08-191-1/+0
| | | | Header file proxy.h included itself.
* Check whether servername is not empty string.Lukas Slebodnik2013-08-191-1/+1
| | | | Previous check was wrong, servername cannot be NULL.
* proxy: Alocate auth tokens in struct authtok_convLukas Slebodnik2013-08-191-0/+20
| | | | | | | | | | | Struct sss_auth_token became opaque in commit 9acfb09f7969a69f58bd45c856b01700541853ca. All ocasions of "struct sss_auth_token" was replaced with pointer to this struct, but proper initialization of auth_tokens was missing in struct authtok_conv. Resolves: https://fedorahosted.org/sssd/ticket/2046
* ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2013-08-112-0/+30
| | | | | | | | Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
* AD: Cast SASL callbacks to propper typeOndrej Kos2013-08-091-1/+3
| | | | | | The initialization of ad_sasl_callbacks raised an incompatible pointer type warning. This was caused because the cyrus-sasl API hasa changed. The callback function list needs to be cast now.
* Remove unused constantJakub Hrozek2013-08-091-2/+0
|
* Use the correct resolv timeoutJakub Hrozek2013-08-091-1/+1
|
* Enable removing nonexisting dn in sdap_handle_account_infoLukas Slebodnik2013-08-081-1/+1
| | | | Change was introduced in commit ca344fde
* Fix memory context for hash entriesSumit Bose2013-08-081-2/+4
| | | | | | | | In sdap_nested_group_populate_users() username and orignal_dn are allocated on a temporary memory context. If the corresponding user is not found in the cache both are added to a hash which is later on returned to the caller. To avoid a use-after-free when the hash entries are looked up both must be reassigned to the memory context of the hash.
* simple access provider: allow fully qualified namesPavel Březina2013-08-071-46/+95
| | | | https://fedorahosted.org/sssd/ticket/2026
* Fix memory context for a state memberSumit Bose2013-08-071-1/+1
| | | | | | primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
* sssd_ad: Add hackish workaround for sasl ad_compatSimo Sorce2013-08-061-0/+41
| | | | | | | | | This tries to set the ad_compat option for sasl, by working around the openldap/sasl initialization as openldap does not allow us to pass down to sasl our own getopt callback. Resolves: https://fedorahosted.org/sssd/ticket/2040
* sudo: print better debug message when a rule has multiple cn valuesPavel Březina2013-08-051-1/+5
|
* sudo: skip rule on error instead of failing completelyPavel Březina2013-08-051-1/+3
| | | | https://fedorahosted.org/sssd/ticket/2031
* Use GID if subdomain is not MPGJakub Hrozek2013-07-291-1/+8
| | | | | | | https://fedorahosted.org/sssd/ticket/2032 In non-MPG subdomains (such as those that manage their IDs manually with POSIX attributes), we need to set the GID ourself.
* Prevent using uninitialized "group_name" in done section.Lukas Slebodnik2013-07-251-1/+1
| | | | Coverity ID: 11927
* Set default DNS resolution timeout to 6 seconds.Michal Zidek2013-07-241-2/+2
| | | | | | | | Partially solves ticket: https://fedorahosted.org/sssd/ticket/1966 To avoid the problem mentioned in the ticket above, option dns_discovery_domain must be set properly.
* LDAP: Use domain-specific name where appropriateJakub Hrozek2013-07-245-112/+159
| | | | | | | | | The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
* Fix possible dereference of a NULL pointer.Lukas Slebodnik2013-07-231-1/+1
| | | | | | We check if function ipa_get_ad_id_ctx returns NULL, but function ipa_get_ad_id_ctx could never return NULL. This issue was found by scan-build.
* KRB5: Do not send PAC in server modeJakub Hrozek2013-07-235-7/+27
| | | | | | | | The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
* Fix warnings: uninitialized variableLukas Slebodnik2013-07-222-4/+3
|
* Remove unused memory context from function unpack_authtokLukas Slebodnik2013-07-221-3/+3
|
* Fix the default FQDN formatJakub Hrozek2013-07-191-1/+1
| | | | | | Commit 52ae806bd17c3c00d70bd1aed437f10f5ae51a1c changed the default FQDN format by accident to the one we only ever user internally. This commit fixes the mistake.
* AD: Set the bool value same as default value in optsJakub Hrozek2013-07-191-4/+4
| | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2023 When the option values are copied using dp_opt_copy_map, the .val member is used if it's not NULL. At the same time, the bool options are never NULL, unlike integers or strings that can have special NULL-like values such as NULL_STRING. This effectively means that when copying a bool option, the .val member is always used. But in the AD maps, some .val fields were set differently from the .def_val fields. The effect was that when the AD subdomain provider was initialized from IPA subdomain provider using only the defaults, some options (notably referral chasing) were set to a value that didn't make sense for the AD provider. This patch makes sure that for all boolean option, the .val is always the same as .def_val.
* IPA: warn if full_name_format is customized in server modeJakub Hrozek2013-07-191-0/+17
| | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2009 If the IPA server mode is on and the SSSD is running on the IPA server, then the server's extdom plugin calls getpwnam_r to read info about trusted users from the AD server and return them to the clients that called the extended operation. The SSSD returns the subdomain users fully-qualified, ie "user@domain" by default. The format of the fully qualified name is configurable. However, the extdom plugin returns the user name without the domain component. With this patch, when ipa_server_mode is on, warn if the full_name_format is set to a non-default value. That would prompt the admin to change the format if he changed it to something exotic.
* Add mising argument required by format stringLukas Slebodnik2013-07-191-2/+3
|
* Remove unused be_ctx->sigchld_ctxJakub Hrozek2013-07-182-9/+0
|
* KRB: Replace multiple calls with variableOndrej Kos2013-07-181-6/+9
| | | | | Instead of multiple calls of sss_authtok_get_type, perform the call just once and store into variable.
* KRB: Handle empty password gracefullyOndrej Kos2013-07-181-0/+11
| | | | | | https://fedorahosted.org/sssd/ticket/1814 Return authentication error when empty password is passed.
* SIGCHLD handler: do not call callback when pvt data where freedPavel Březina2013-07-173-3/+7
| | | | https://fedorahosted.org/sssd/ticket/1992
* print hint about password complexity when new password is rejectedPavel Březina2013-07-172-1/+15
| | | | https://fedorahosted.org/sssd/ticket/1827
* LDAP: When resolving a SID, search for groups first, then usersJakub Hrozek2013-07-171-19/+18
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1997 Most of the time, the SIDs are resolved as a call coming from the PAC responder during initgroups. In that case at least, it makes sense to search for group matching that SID first, then users. We may consider making this behaviour configurable ie for the server mode where typically the users should be queried first.
* Use conditional build for retrieving ccache.Lukas Slebodnik2013-07-152-88/+22
| | | | | | | | Some krb5 functions needn't be available for retrieving ccache with principal. Therefore ifdef is used to solve this situation with older version of libkrb5. There were two functions with similar functionality in krb5_child and krb5_utils. They were merged to one universal function, which was moved to file src/util/sss_krb5.c
* Return right directory name for dircacheLukas Slebodnik2013-07-111-6/+10
| | | | | | | Dircache can be either file or directory. Wrong value was used when dircache was itself directory. https://fedorahosted.org/sssd/ticket/2002
* Always set port status to neutral when resetting service.Michal Zidek2013-07-111-1/+2
| | | | | | | | We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
* KRB5_CHILD: Fix handling of get_password return codeOndrej Kos2013-07-101-4/+10
| | | | The switch statement was dead code due to missing case/default.
* ldap: only update shadowLastChange when password change is successfulJim Collins2013-07-011-1/+2
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
* IPA: Look up AD users directly if IPA server mode is onJakub Hrozek2013-06-286-6/+168
| | | | | | | | https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
* IPA: Create and remove AD id_ctx for subdomains discovered in server modeJakub Hrozek2013-06-281-0/+182
| | | | | | | | | When IPA server mode is on, then this patch will create an ad_id_ctx for each subdomain discovered in IPA provider. The ID context is needed to perform direct lookups using the AD provider. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek2013-06-283-65/+78
| | | | | | | | Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Initialize server mode ctx if server mode is onJakub Hrozek2013-06-284-0/+62
| | | | | | | | | | This patch introduces a new structure that holds information about a subdomain and its ad_id_ctx. This structure will be used only in server mode to make it possible to search subdomains with a particular ad_id_ctx. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* AD: initialize failover with custom realm, domain and failover serviceJakub Hrozek2013-06-283-28/+41
| | | | | | | | | | This is needed so we can initialize failover using IPA realm and on-the-fly discovered DNS domain. The subdomains discovered on-thefly will use the subdomain name for realm, domain and failover service to avoid conflicts. Subtaks of: https://fedorahosted.org/sssd/ticket/1962
* AD: decouple ad_id_ctx initializationJakub Hrozek2013-06-283-102/+285
| | | | | | | | | The IPA subdomain code will perform lookups on its own in the server mode. For this, the AD provider must offer a way to initialize the ad_id_ctx for external consumers. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* LDAP: Add utility function sdap_copy_mapJakub Hrozek2013-06-282-0/+45
| | | | | | | | | The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Add a server mode optionJakub Hrozek2013-06-282-0/+2
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1993 SSSD needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, is introduced which defaults to false but is set to true during ipa-server-install or during updates of the FreeIPA server if it is not already set.
* Save mpg state for subdomainsSumit Bose2013-06-282-4/+13
| | | | | | The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
* IPA: read ranges before subdomainsSumit Bose2013-06-281-29/+27
| | | | | | | Since FreIPA will start to support external mapping for trusted domains as well the range type for the domain must be know before the domain object is created. The reason is that external mapping will not use magic private groups (mpg) while algorithmic mapping will use them.
* Replace new_subdomain() with find_subdomain_by_name()Sumit Bose2013-06-285-16/+11
| | | | | | new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
* Add support for new ipaRangeType attributeSumit Bose2013-06-283-6/+36
| | | | | | | | | Recent versions of FreeIPA support a range type attribute to allow different type of ranges for sub/trusted-domains. If the attribute is available it will be used, if not the right value is determined with the help of the other idrange attributes. Fixes https://fedorahosted.org/sssd/ticket/1961
generated by cgit (git 2.34.1) at 2024-06-23 08:56:36 +0000