summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* Do not leak LDAP URI with high log levelJakub Hrozek2011-05-041-2/+7
|
* Do not leak pcre contextJakub Hrozek2011-05-041-0/+12
|
* Fix minor typo in error messageStephen Gallagher2011-05-021-1/+1
| | | | https://fedorahosted.org/sssd/ticket/825
* Return pam data to the renewal item if renewal failsSumit Bose2011-05-021-4/+9
| | | | | | | | | A previous patch changed a talloc_steal() into a talloc_move(). Now it is not enough to change the parent memory context with talloc_steal to give back the data, but it has to be assigned back too. Additionally this patch uses the missing pam data as an indication that a renewal request for this data is currently running.
* Fix order of arguments in select_principal_from_keytab() callJakub Hrozek2011-04-291-1/+1
|
* Fix bad password caching when using automatic TGT renewalStephen Gallagher2011-04-291-3/+12
| | | | Fixes CVE-2011-1758, https://fedorahosted.org/sssd/ticket/856
* Fix segfault in IPA providerStephen Gallagher2011-04-291-2/+2
| | | | | | We were trying to request the krb5 keytab from the auth provider configuration, but it hasn't yet been set up. Much better to use the value in the ID provider.
* Fix IPA config bug with SDAP_KRB5_REALMStephen Gallagher2011-04-281-1/+1
|
* Do not leak LDAP paging controlsJakub Hrozek2011-04-281-0/+5
|
* Add ldap_page_size configuration optionStephen Gallagher2011-04-276-5/+12
|
* Enable paging support for LDAPStephen Gallagher2011-04-271-23/+117
|
* Log the LDAP message type we're processingStephen Gallagher2011-04-271-0/+57
|
* simple provider: Don't treat primary GID lookup failures as fatalStephen Gallagher2011-04-271-13/+19
|
* Modify principal selection for keytab authenticationJan Zeleny2011-04-257-28/+73
| | | | | | | | | | | | | | | | Currently we construct the principal as host/fqdn@REALM. The problem with this is that this principal doesn't have to be in the keytab. In that case the provider fails to start. It is better to scan the keytab and find the most suitable principal to use. Only in case no suitable principal is found the backend should fail to start. The second issue solved by this patch is that the realm we are authenticating the machine to can be in general different from the realm our users are part of (in case of cross Kerberos trust). The patch adds new configuration option SDAP_SASL_REALM. https://fedorahosted.org/sssd/ticket/781
* Allow new option to specify principal for FASTJan Zeleny2011-04-255-6/+58
| | | | https://fedorahosted.org/sssd/ticket/700
* Extend and move function for finding principal in keytabJan Zeleny2011-04-251-80/+2
| | | | | | | | The function now supports finding principal in keytab not only based on realm, but based on both realm and primary/instance parts. The function also supports * wildcard at the beginning or at the end of primary principal part. The function for finding principal has been moved to util/sss_krb5.c, so it can be used in other parts of the code.
* Add last usn checking after reconnectionJan Zeleny2011-04-192-1/+31
| | | | | | | | | | | When reconnecting to the LDAP server supporting USNs (either because of new incomming id operation or invokation of callback responsible for checking status of the backend), detect whether the highest USN is lower than the one SSSD has recorded. If so, setup enumeration/cleanup to refresh potentionally changed account information in the SSSD cache. Related ticket: https://fedorahosted.org/sssd/ticket/734
* Add value of the last USN to server configurationStephen Gallagher2011-04-192-0/+16
| | | | | Related: https://fedorahosted.org/sssd/ticket/734
* Add user and group search LDAP filter optionsJakub Hrozek2011-04-194-19/+82
| | | | https://fedorahosted.org/sssd/ticket/647
* Always generate kpasswdinfo fileStephen Gallagher2011-04-191-2/+1
| | | | | Previously, we only generated it when performing a password change, but this didn't play nicely with kpasswd.
* Set same status for duplicate serversJakub Hrozek2011-04-151-0/+21
|
* Do not throw a DP error when failing to delete a nonexistent entityStephen Gallagher2011-04-151-4/+4
|
* Never remove gecos from the sysdb cacheStephen Gallagher2011-04-121-0/+9
| | | | | Now that gecos can come from either the 'gecos' or 'cn' attributes, we need to ensure that we never remove it from the cache.
* Initialise rootdse to NULL if not availableSumit Bose2011-04-121-0/+1
|
* Initialise srv_opts even if rootDSE is missingSumit Bose2011-04-112-46/+49
|
* Remove detection of duplicates from SRV result processingJakub Hrozek2011-04-111-9/+0
|
* Read only rootDSE data if rootDSE is availableSumit Bose2011-04-081-20/+22
|
* Fix unchecked return values of pam_add_responseJakub Hrozek2011-04-082-3/+11
| | | | https://fedorahosted.org/sssd/ticket/798
* Don't pass NULL to printf for TLS errorsJakub Hrozek2011-04-083-33/+24
| | | | https://fedorahosted.org/sssd/ticket/643
* Do not attempt to resolve nameless serversJakub Hrozek2011-04-011-1/+1
| | | | | | | | | | | The failover code is not strictly in charge of resolving. Its main function is to provide a server to connect to for a service. It is legal, although not currently used, to have a server that has no name (server->common == NULL). In this case, no resolving should be done and it is assumed that the failover user, which are the SSSD back ends in our case, would perform any resolving out of band, perhaps using the user_data attribute of fo_server structure.
* Only save members for successfully saved groupsJakub Hrozek2011-04-011-2/+17
|
* Fall back to cn if gecos is not availableStephen Gallagher2011-03-301-0/+9
| | | | | | | | | | | | | We were not fully compliant with section 5.3 of RFC 2307 which states: An account's GECOS field is preferably determined by a value of the gecos attribute. If no gecos attribute exists, the value of the cn attribute MUST be used. (The existence of the gecos attribute allows information embedded in the GECOS field, such as a user's telephone number, to be returned to the client without overloading the cn attribute. It also accommodates directories where the common name does not contain the user's full name.)
* Mark transaction as done when cancelledJakub Hrozek2011-03-281-2/+8
|
* RFC2307: Ignore zero-length member names in group lookupsStephen Gallagher2011-03-281-0/+4
|
* Always complete the transaction in sdap_process_group_members_2307Stephen Gallagher2011-03-281-0/+11
| | | | | | If the loop ran through at least one sdap_process_missing_member_2307() call and errored out later, we were not canceling the transaction.
* Fix typo in sdap_nested_group_process_stepJakub Hrozek2011-03-281-1/+1
|
* Return from functions in LDAP provider after marking request as failedJakub Hrozek2011-03-241-1/+4
|
* Add host access control supportPierre Ossman2011-03-246-3/+157
| | | | https://fedorahosted.org/sssd/ticket/746
* Add sysdb_attrs_primary_name_list() routineStephen Gallagher2011-03-231-18/+22
| | | | | | This routine will replace the use of sysdb_attrs_to_list() for any case where we're trying to get the name of the entry. It's a necessary precaution in case the name is multi-valued.
* Use sysdb_attrs_primary_name() in sdap_initgr_nested_store_groupStephen Gallagher2011-03-231-1/+3
|
* Use fake groups during IPA schema initgroupsJakub Hrozek2011-03-231-114/+418
| | | | https://fedorahosted.org/sssd/ticket/822
* Add originalDN to fake groupsJakub Hrozek2011-03-231-1/+10
|
* RFC2307bis: Ignore aliases for groupsStephen Gallagher2011-03-231-14/+26
| | | | | | | Groups in ldap with multiple values for their groupname attribute will now be compared against the RDN of the entry to determine the "primary" group name. We will save only this primary group name to the ldb cache.
* RFC2307: Ignore aliases for groupsStephen Gallagher2011-03-231-23/+35
| | | | | | | Groups in ldap with multiple values for their groupname attribute will now be compared against the RDN of the entry to determine the "primary" group name. We will save only this primary group name to the ldb cache.
* Ignore aliases for usersStephen Gallagher2011-03-231-20/+26
| | | | | | | Users in ldap with multiple values for their username attribute will now be compared against the RDN of the entry to determine the "primary" username. We will save only this primary name to the ldb cache.
* Sanitize DN when searching the original DN in the cacheSumit Bose2011-03-221-1/+9
|
* Fix incorrect return value checkStephen Gallagher2011-03-171-1/+1
|
* Fix LDAP search filter for nested initgroupsJakub Hrozek2011-03-151-1/+1
|
* Fix one unlikely case of failure in sdap_id_op moduleJan Zeleny2011-03-141-1/+3
| | | | | | | | There can be an unlikely scenario when the first part of sdap_id_op_connect_done works fine and there is no need to mark backend offline. But right after the check, the memory allocation can fail in which case the backend needs to be marked offline along with disabled reconnecting.
* Require existence of username, uid and gid for user enumerationStephen Gallagher2011-03-141-12/+18
| | | | We will ignore users that do not have these three values.
generated by cgit (git 2.34.1) at 2024-07-04 09:10:07 +0000