summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* RFC2307bis initgroups: fix nested groups processingsssd-1.5.1-64.el6Jakub Hrozek2011-10-311-20/+33
| | | | | Due to incorrectly written loop, SSSD would go into infitite loop if it processed the same group on two different levels of membership.
* Plug memory leaks in LDAP providersssd-1.5.1-61.el6Jakub Hrozek2011-10-251-0/+3
|
* Use fewer transactions during RFC2307bis initgroupsJakub Hrozek2011-10-171-539/+802
| | | | | | | | Utility functions for LDAP nested schema initgroups Use fewer transactions during RFC2307bis initgroups Use fewer transactions during IPA initgroups
* Add a missing breakJakub Hrozek2011-10-171-0/+1
|
* Improve performance of HBAC with large numbers of hostsStephen Gallagher2011-10-144-206/+334
| | | | | | | | | | HBAC: Do not save member/memberOf links We can just trust the values from the FreeIPA server HBAC: Use originalMember for identifying servicegroups HBAC: Use originalMember for identifying hostgroups
* Append PID to sbus server socket name, let clients use a symlinkJakub Hrozek2011-10-132-2/+2
| | | | | | | | Add option to follow symlinks to check_file() Append PID to sbus server socket name, let clients use a symlink https://fedorahosted.org/sssd/ticket/1034
* Use explicit base 10 for converting strings to integerssssd-1.5.1-54.el6Jakub Hrozek2011-10-062-4/+4
| | | | https://fedorahosted.org/sssd/ticket/1013
* Better handling for aliasesJakub Hrozek2011-10-063-94/+225
| | | | | | | | | | | | | | Add sysdb interface to get name aliases Add a sysdb_get_direct_parents function Store name aliases for users, groups Return users and groups based on alias https://fedorahosted.org/sssd/ticket/926 Fix typo in sysdb_get_direct_parents
* IPA access: hostname comparison should be case-insensitiveJakub Hrozek2011-09-301-1/+1
|
* HBAC: fix typos preventing proper hostgroup evaluationStephen Gallagher2011-09-301-3/+3
|
* Fix uninitialized pointer read in sdap_gssapi_get_default_realm()Jakub Hrozek2011-09-201-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1003
* Use sss_ldap_err2string() instead of ldap_err2string()sssd-1.5.1-51.el6Pavel Březina2011-09-123-37/+35
| | | | | | | | | | sss_ldap_err2string() - function created https://fedorahosted.org/sssd/ticket/986 sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() https://fedorahosted.org/sssd/ticket/986
* Improve error message for LDAP password constraint violationJakub Hrozek2011-09-123-16/+29
| | | | https://fedorahosted.org/sssd/ticket/985
* Do not access memory out of boundsSumit Bose2011-09-071-2/+2
|
* HBAC: Properly skip all non-group memberOf entriesStephen Gallagher2011-08-291-1/+2
|
* Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANONJakub Hrozek2011-08-295-3/+17
| | | | https://fedorahosted.org/sssd/ticket/978
* HBAC: Use of hostgroups for targethost or sourcehost was brokenStephen Gallagher2011-08-291-4/+4
| | | | | We were trying to look up the wrong attribute for the name of the hostgroup.
* HBAC: Handle saving groups that have no membersStephen Gallagher2011-08-291-7/+21
|
* Improve password policy error code and messageSumit Bose2011-08-291-4/+9
| | | | | | Instead of returning PAM_SYSTEM_ERR if they necessary attributes for the requested password policy cannot be found we return PAM_PERM_DENIED. Additionally the log message says that the access is denied.
* Use sysdb attribute name for GID, not LDAP attributeStephen Gallagher2011-08-291-3/+3
|
* Use the default Kerberos realm for LDAP with GSSAPI authJakub Hrozek2011-08-291-3/+55
| | | | https://fedorahosted.org/sssd/ticket/970
* Fix returning groups when gidNumber attribute is not orderedJakub Hrozek2011-08-043-4/+10
| | | | https://fedorahosted.org/sssd/ticket/951
* Explicitly ignore groups with gidNumber=0Jakub Hrozek2011-08-042-11/+18
| | | | https://fedorahosted.org/sssd/ticket/916
* Set gidNumber of non-posix groups to 0 even on updatesJakub Hrozek2011-08-041-8/+44
|
* Rewrite HBAC rule evaluatorStephen Gallagher2011-08-0415-1697/+3614
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add helper function msgs2attrs_array This function converts a list of ldb_messages into a list of sysdb_attrs. Conflicts: src/providers/ldap/ldap_common.c src/providers/ldap/ldap_common.h Add HBAC evaluator and tests Add helper functions for looking up HBAC rule components Remove old HBAC implementation Add new HBAC lookup and evaluation routines Conflicts: Makefile.am Add ipa_hbac_refresh option This option describes the time between refreshes of the HBAC rules on the IPA server. Add ipa_hbac_treat_deny_as option By default, we will treat the presence of any DENY rule as denying all users. This option will allow the admin to explicitly ignore DENY rules during a transitional period. Treat NULL or empty rhost as unknown Previously, we were assuming this meant it was coming from the localhost, but this is not a safe assumption. We will now treat it as unknown and it will fail to match any rule that requires a specified srchost or group of srchosts. libipa_hbac: Support case-insensitive comparisons with UTF8 UTF8 HBAC test Fix memory leak in ipa_hbac_evaluate_rules https://fedorahosted.org/sssd/ticket/933 Fix incorrect NULL check in ipa_hbac_common.c https://fedorahosted.org/sssd/ticket/936 Require matched version and release for libipa_hbac Add rule validator to libipa_hbac https://fedorahosted.org/sssd/ticket/943
* Request password control unconditionally during bindJakub Hrozek2011-08-041-6/+6
| | | | https://fedorahosted.org/sssd/ticket/940
* Do not add a NULL host parsed from LDAP URIJakub Hrozek2011-08-041-1/+8
| | | | https://fedorahosted.org/sssd/ticket/911
* ipa_dyndns: Use sockaddr_storage for storing IP addressesJakub Hrozek2011-07-131-12/+17
| | | | https://fedorahosted.org/sssd/ticket/915
* Fix TLS/SSL validation after switch to ldap_init_fdSumit Bose2011-07-138-71/+149
| | | | | | | | | | | | | | Add sockaddr_storage to sdap_service Add sdap_call_conn_cb() to call add connection callback directly Use name based URI instead of IP address based URIs Use ldap_init_fd() instead of ldap_initialize() if available Do not access state after tevent_req_done() is called. Call ldap_install_tls() on ldaps connections
* Honor the TTL value of SRV record lookupsJakub Hrozek2011-07-136-29/+30
| | | | | | | | | | | | | | | | | | | | | | | | | Add new resolv_hostent data structure and utility functions Resolve hosts by name from files into resolv_hostent Resolve hosts by name from DNS into resolv_hostent Switch resolver to using resolv_hostent and honor TTL Conflicts: src/providers/fail_over.c Provide TTL structure names for c-ares < 1.7 https://fedorahosted.org/sssd/ticket/898 In c-ares 1.7, the upstream renamed the addrttl/addr6ttl structures to ares_addrttl/ares_addr6ttl so they are in the ares_ namespace. Because they are committed to stable ABI, the contents are the same, just the name changed -- so it is safe to just #define the new name for older c-ares version in case the new one is not detected in configure time.
* Delete cached ccache file if password is expiredSumit Bose2011-07-131-8/+63
|
* Do not check pwdAttributeSumit Bose2011-07-131-9/+0
| | | | | | | It is not safe to check pwdAttribute to see if server side password policies are active. Only if a LDAP_CONTROL_PASSWORDPOLICYRESPONSE is present the bind response we can assume that there is a server side password policy.
* Handle non-POSIX groups in nestingsssd-1.5.1-40.el6Jan Zeleny2011-06-022-28/+69
| | | | | | | | Added sysdb_attrs_get_bool() function Non-posix group processing - sysdb changes Non-posix group processing - ldap provider and nss responder
* Properly support IPv6 in LDAP URIs for IPA and LDAP providersJakub Hrozek2011-06-023-23/+82
| | | | | | | | | | | | | | | | | Add utility function to return IP address as string Add a utility function to escape IPv6 address for use in URIs Use escaped IP addresses in LDAP provider Escape IPv6 IP addresses in the IPA provider https://fedorahosted.org/sssd/ticket/880 Fix bad merge We merged in a patch, but missed that it missed a dependency added by another earlier patch.
* Add online callback only once for TGT renewalSumit Bose2011-06-021-25/+44
|
* Sanitize username during initgroups callsssd-1.5.1-37.el6Sumit Bose2011-05-251-1/+7
|
* Always generate kpasswdinfo filesssd-1.5.1-36.el6Stephen Gallagher2011-05-241-2/+1
| | | | | Previously, we only generated it when performing a password change, but this didn't play nicely with kpasswd.
* IPA Provider: don't fail if user is not a member of any groupsStephen Gallagher2011-05-241-2/+5
|
* Enable paging support for LDAPStephen Gallagher2011-05-246-26/+132
|
* simple provider: Don't treat primary GID lookup failures as fatalStephen Gallagher2011-05-241-13/+19
|
* Only save members for successfully saved groupsJakub Hrozek2011-05-241-2/+17
|
* Make "password" the default for ldap_default_authtok_typeStephen Gallagher2011-05-241-1/+1
|
* Return pam data to the renewal item if renewal failsSumit Bose2011-05-021-4/+9
| | | | | | | | | A previous patch changed a talloc_steal() into a talloc_move(). Now it is not enough to change the parent memory context with talloc_steal to give back the data, but it has to be assigned back too. Additionally this patch uses the missing pam data as an indication that a renewal request for this data is currently running.
* Fix bad password caching when using automatic TGT renewalStephen Gallagher2011-04-291-3/+12
|
* Fix regressions in the negative cachesssd-1.5.1-30.el6Stephen Gallagher2011-04-151-4/+4
| | | | | | | | | | Do not throw a DP error when failing to delete a nonexistent entity Add debug logging to the negative cache Fix a regression with the negative cache in multi-domain configurations Fix regression where nonexistent entries were never added to the negative cache
* Never remove gecos from the sysdb cachesssd-1.5.1-28.el6Stephen Gallagher2011-04-121-0/+9
| | | | | Now that gecos can come from either the 'gecos' or 'cn' attributes, we need to ensure that we never remove it from the cache.
* Initialise rootdse to NULL if not availablesssd-1.5.1-27.el6Sumit Bose2011-04-121-0/+1
|
* Initialise srv_opts even if rootDSE is missingsssd-1.5.1-26.el6Sumit Bose2011-04-112-46/+49
|
* Remove detection of duplicates from SRV result processingJakub Hrozek2011-04-111-9/+0
|
* Read only rootDSE data if rootDSE is availableSumit Bose2011-04-081-20/+22
|
generated by cgit (git 2.34.1) at 2024-05-14 15:35:20 +0000