summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* DNS sites support - add AD SRV pluginPavel Březina2013-05-025-5/+849
| | | | https://fedorahosted.org/sssd/ticket/1032
* sdap: add sdap_connect_host requestPavel Březina2013-05-022-0/+201
| | | | | Create connection to specified LDAP server without using any failover stuff.
* IPA SRV plugin: improve debuggingPavel Březina2013-05-021-0/+6
|
* IPA SRV plugin: use fo_discover_servers requestPavel Březina2013-05-021-105/+20
|
* add fo_discover_servers requestPavel Březina2013-05-022-1/+254
| | | | | | | | | This request takes discovery domain for primary servers and other domain for backup servers and returns list of primary and backup servers. If primary domain is not reachable, it returns servers found in backup domain as primary servers.
* Display the last grace warning, tooJakub Hrozek2013-05-022-3/+3
| | | | | | | Due to a comparison error, the last warning when an LDAP password was in its grace period was never displayed. https://fedorahosted.org/sssd/ticket/1890
* libsss_idmap: function to calculate rangeMichal Zidek2013-04-292-115/+54
| | | | | | | | Calculation of range for domains is moved from sdap_idmap code to sss_idmap code. Some refactoring have been done to allow this move. https://fedorahosted.org/sssd/ticket/1844
* selinux: if no domain matches, make the debug message louderJakub Hrozek2013-04-291-3/+3
|
* Make IPA SELinux provider aware of subdomain usersSumit Bose2013-04-293-2/+41
| | | | Fixes https://fedorahosted.org/sssd/ticket/1892
* Allow usage of enterprise principalsSumit Bose2013-04-226-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
* Convert the simple access check to new error codesJakub Hrozek2013-04-191-9/+17
| | | | | | | | https://fedorahosted.org/sssd/ticket/453 It makes sense to keep using the boolean for access granted/denied, but when the user/group is not found, the request would now return ERR_ACCOUNT_UNKNOWN
* LDAP: do not invalidate pointer with realloc while processing ghost usersJakub Hrozek2013-04-191-3/+13
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1799 One peculiarity of the sysdb_attrs_get_el interface is that if the attribute does not exist, then the attrs array is reallocated and the element is created. But in case other pointers are already pointing into the array, the realloc might invalidate them. Such case was in the sdap_process_ghost_members function where if the group had no members, the "gh" pointer requested earlier might have been invalidated by the realloc in order to create the member element.
* Fix simple access group control in case-insensitive domainsJakub Hrozek2013-04-151-16/+9
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1713 In the simple access provider, we need to only canonicalize user names when comparing with values in the ACL, not when searching the cache. The sysdb searches might do a base search with a DN constructed with the username which fails if the username is lower case.
* Fix krbcc dir creation issue with MIT krb5 1.11Lukas Slebodnik2013-04-122-11/+61
| | | | | | | | | | | | | | | | In krb5-libs >= 1.11, function krb5_cc_resolve verify if credential cache dir exists. If it doesn't exist, than it will be created with process permissions and not user permissions. Function cc_residual_is_used has already checked for non existing directory, but it wasn't considered to be a failure and therefore next call of krb5_init_context will create directory with wrong permissions. Now if directory doesn't exist, it will be handled like there was not ccache attribute in sysdb cache. We also check if "primary" file in ccache directory has right permissions. But we ignore missing "primary" file. https://fedorahosted.org/sssd/ticket/1822
* DNS sites support - add IPA SRV pluginPavel Březina2013-04-105-5/+369
| | | | https://fedorahosted.org/sssd/ticket/1032
* DNS sites support - use SRV DNS lookup plugin in all providersPavel Březina2013-04-103-0/+29
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1032 We set a plugin during an initialization of ID provider, which is an authoritative provider for a plugin choice. The plugin is set only once. When other provider is initalized (e.g. id = IPA, sudo = LDAP), we do not overwrite the plugin. Since sssm_*_id_init() is called from all module constructors, this patch relies on the fact, that ID provider is initialized before all other providers.
* DNS sites support - replace SRV lookup code with a plugin callPavel Březina2013-04-101-258/+73
| | | | | | | | https://fedorahosted.org/sssd/ticket/1032 Removes hard coded SRV lookup code with a plugin call. This patch breaks SRV lookups as there is currently no plugin in use. It is fixed in next patch.
* fail over - add function to insert multiple servers to the listPavel Březina2013-04-101-10/+101
|
* DNS sites support - SRV DNS lookup pluginPavel Březina2013-04-104-0/+521
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1032 This plugin mimics the current behaviour. If discovery_domain is set it is the only domain that is tried. If discovery_domain is not set, we try to autodetect domain first and if that fails or SRV lookup on this domain fails, we fallback to SSSD domain name.
* DNS sites support - SRV lookup plugin interfacePavel Březina2013-04-105-0/+135
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1032 Introduces two new error codes: - ERR_SRV_NOT_FOUND - ERR_SRV_LOOKUP_ERROR Since id_provider is authoritative in case of SRV plugin choise, ability to override the selected pluging during runtime is not desirable. We rely on the fact that id_provider is initialized before all other providers, thus the plugin is set correctly.
* Allow using flatname for subdomain home dir templateJakub Hrozek2013-04-101-1/+2
| | | | https://fedorahosted.org/sssd/ticket/1609
* LDAP: Always fail if a map can't be foundJakub Hrozek2013-04-091-4/+2
|
* Check for the correct variablesJakub Hrozek2013-04-051-2/+2
| | | | https://fedorahosted.org/sssd/ticket/1864
* Further restrict become_user drop of privileges.Simo Sorce2013-04-051-15/+18
| | | | | | | | | | | | | | | | We never need to regain root after we call become_user() so tighten up even further our privilege drop. Add a setgroups() call to remove all secondary groups root may have been given for whateve reason. Then use the setres[ug]id function to also drop the saved uid/gid so the process cannot regain back root id. Capabilities are also implicitly dropped here, no more CAP_SETUID so this is a Point of No Return, once changed to non-root the process can't get back. Remove redefinition of sys/types.h and unistd.h, they are already defined in util.h and they need to be included after _GNU_SOURCE/_BSD_SOURCE is defined or the prototypes for setres[ug]id will not be found. Add grp.h after util.h for the same reason.
* dyndns: Fix initializing sdap_id_ctxJakub Hrozek2013-04-041-1/+1
|
* LDAP: Fix value initialization warningsLukas Slebodnik2013-04-042-2/+2
|
* Centralize resolv_init, remove resolv context listJakub Hrozek2013-04-033-25/+4
|
* Init failover with be_res optionsJakub Hrozek2013-04-035-81/+124
|
* Allow setting krb5_renew_interval with a delimiterAriel Barria2013-04-035-8/+32
| | | | | | | https://fedorahosted.org/sssd/ticket/902 changed the data type the krb5_renew_interval to string. function krb5_string_to_deltat is used to convert and allow delimiters
* Check for correct variable nameJakub Hrozek2013-04-032-5/+1
| | | | https://fedorahosted.org/sssd/ticket/1864
* krb5 child: Use the correct type when processing OTPJakub Hrozek2013-04-031-1/+1
|
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-0214-78/+115
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-022-1/+13
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* refactor nested group processing: replace old codePavel Březina2013-04-022-1721/+21
| | | | https://fedorahosted.org/sssd/ticket/1784
* refactor nested group processing: add new codePavel Březina2013-04-021-0/+2229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1784 1. initialization (main-req), returns members of input group 2. evaluate group members (group) 3. perform individual search (no-deref) or dereference attribute (deref) 4a. no-deref 1. perform a lookup depending on the type of the member object 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups 4b. deref 1. perform a dereference lookup on member attribute 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups Tevent request flow: main-req | group |------------------------| no-deref deref | | |----|------|---------| | user group unknown recurse recurse / \ | | | ... | | | ... user group group group
* selinux: Remove unused parameterJakub Hrozek2013-03-271-1/+0
| | | | https://fedorahosted.org/sssd/ticket/1848
* LDAP: Fix value initializationOndrej Kos2013-03-271-1/+1
|
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-215-4/+50
| | | | https://fedorahosted.org/sssd/ticket/1660
* Return error code from ipa_subdom_storeJakub Hrozek2013-03-201-5/+13
|
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-209-11/+193
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Convert sdap_access to new error codesSimo Sorce2013-03-195-480/+212
| | | | Also simplify sdap_access_send to avoid completely fake _send() routines.
* Resolve GIDs in the simple access providerJakub Hrozek2013-03-193-122/+655
| | | | | | | | | | | | | | Changes the simple access provider's interface to be asynchronous. When the simple access provider encounters a group that has gid, but no meaningful name, it attempts to resolve the name using the be_file_account_request function. Some providers (like the AD provider) might perform initgroups without resolving the group names. In order for the simple access provider to work correctly, we need to resolve the groups before performing the access check. In AD provider, the situation is even more tricky b/c the groups HAVE name, but their name attribute is set to SID and they are set as non-POSIX
* Do not compile main() in DP if UNIT_TESTING is definedJakub Hrozek2013-03-191-0/+2
| | | | | | | | | | | The simple access provider unit tests now need to link against the Data Provider when they start using the be_file_account_request() function. But then we would start having conflicts as at least the main() functions would clash. If UNIT_TESTING is defined, then the data_provider_be.c module does not contain the main() function and can be linked against directly from another module that contains its own main() function
* Provide a be_get_account_info_send functionJakub Hrozek2013-03-192-19/+144
| | | | | | | | | | | | | | In order to resolve group names in the simple access provider we need to contact the Data Provider in a generic fashion from the access provider. We can't call any particular implementation (like sdap_generic_send()) because we have no idea what kind of provider is configured as the id_provider. This patch splits introduces the be_file_account_request() function into the data_provider_be module and makes it public. A future patch should make the be_get_account_info function use the be_get_account_info_send function.
* Make the SELinux refresh time configurable.Michal Zidek2013-03-193-2/+5
| | | | Option ipa_selinux_refresh is added to basic ipa options.
* Reuse cached SELinux mappings.Michal Zidek2013-03-192-3/+29
| | | | | | | | Reuse cached SELinux maps when they are requested within time interval (in this patch it is hardcoded to be 5 seconds). https://fedorahosted.org/sssd/ticket/1744
* Move SELinux processing to provider.Michal Zidek2013-03-192-31/+388
| | | | | | | | | | | | The SELinux processing was distributed between provider and pam responder which resulted in hard to maintain code. This patch moves the logic to provider. IT ALSO REQUIRES CHANGE IN THE SELINUX POLICY, because the provider also writes the content of selinux login file to disk (which was done by responder before). https://fedorahosted.org/sssd/ticket/1743
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-192-12/+2
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Use common error facility instead of sdap_resultSimo Sorce2013-03-197-347/+229
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* Decrease krb5_auth_timeout defaultOndrej Kos2013-03-183-3/+3
| | | | https://fedorahosted.org/sssd/ticket/1738
generated by cgit (git 2.34.1) at 2024-06-13 01:14:27 +0000