summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* failover: Protect against empty host namesMichal Zidek2013-01-026-8/+8
| | | | | | | | | | Added new parameter to split_on_separator that allows to skip empty values. The whole function was rewritten. Unit test case was added to check the new implementation. https://fedorahosted.org/sssd/ticket/1484
* set ret to EOK after for loop in sdap_sudo_purge_sudoersPavel Březina2013-01-021-0/+2
| | | | | | | | | | If we are unable to delete some rule from cache we print a debug message and ignore the error. Thus we should set ret to EOK after the for loop otherwise we return whether the last rule was deleted successfully or not. This also removes compilation warning that ret may be used uninitialized (when we don't go inside the loop at all).
* krb5 tgt renewal: fix usage of ldb_dn_get_component_val()Sumit Bose2012-12-201-4/+4
| | | | | For some reason I was under the impression that the DN components are counted backwards in libldb. This patch corrects this.
* Add default section to switch statementSumit Bose2012-12-191-0/+3
| | | | | | switch statements should always have a default section. In this particular case gcc gave a "'send_fn' may be used uninitialized in this function" warning.
* DP: invalidate all cached maps if a request for auto.master comes inJakub Hrozek2012-12-183-0/+16
| | | | | | If the Data Provider receives a request for the auto.master map, it passes on a flag to let the actual provider let know he should invalidate the existing maps
* sudo: do full refresh when data provider is back onlinePavel Březina2012-12-182-7/+75
| | | | | | | | https://fedorahosted.org/sssd/ticket/1689 Add a online callback if the first full refresh fails due to the provider beeing offline so we can perform the refresh as soon as possible.
* sudo: schedule another full refresh in short interval if the first failsPavel Březina2012-12-182-0/+28
| | | | | | | https://fedorahosted.org/sssd/ticket/1689 If the first full refresh of sudo rules fails because the data provider is offline, we will schedule another one in 2, 4, ... minutes.
* check dp error in sdap_sudo_full_refresh_done()Pavel Březina2012-12-181-3/+8
| | | | https://fedorahosted.org/sssd/ticket/1689
* add sdap_sudo_schedule_refresh()Pavel Březina2012-12-182-43/+77
| | | | Reduces amount of code duplication.
* try primary server after retry_timeout + 1 seconds when switching to backupPavel Březina2012-12-183-1/+13
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1679 The problem is when we are about to reset the server status, we don't get through the timeout (30 seconds) because the "switch to primary server" task is scheduled 30 seconds after fall back to a backup server. Thus the server status remains "not working" and is resetted after another 30 seconds. We need to make sure that the server status is tried after the timeout period. retry_timeout is currently hardcoded to 30, thus the change in man page.
* PROXY: fix groups cachingOndrej Kos2012-12-171-0/+6
| | | | | | https://fedorahosted.org/sssd/ticket/1685 Properly react on deleting group which was not found in sysdb.
* let ldap_chpass_uri failover work when using same hostnamePavel Březina2012-12-151-11/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1699 We want to continue with the next server on all errors, not only on ETIMEDOUT. This particullar ticket was dealing with ECONNREFUSED.
* sudo: don't get stuck in rules and smart refresh when offlinePavel Březina2012-12-111-4/+14
| | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1682 The problem was in following code: if (ret != EOK || state->dp_error != DP_ERR_OK || state->error != EOK) { tevent_req_error(req, ret); return; } In situation when data provider error occurs (e.g. when offline), ret == EOK but dp_error != DP_ERR_OK and we take the true branch. This results in calling tevent_req_error(req, EOK). Unfortunately, with EOK tevent_req_error only returns false, but does not trigger callback and this tevent request hangs forever, because no tevent_req_done(req) is called.
* LDAP: remove dead assignmentJakub Hrozek2012-12-101-1/+0
|
* let krb5_kpasswd failover workPavel Březina2012-12-101-3/+7
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1680 There were two errors: 1. kr->kpasswd_srv was never set 2. bad service name (KERBEROS) was provided when setting port status, thus the port status never changed
* PROXY: fix negative cacheOndrej Kos2012-12-101-20/+24
| | | | | | | | https://fedorahosted.org/sssd/ticket/1685 The PROXY provider wasn't storing credentials to negative cache due to bad return value. This was delegated from attempt to delete these credentials from local cache. Therefore ENOENT is replaced as EOK.
* SUDO: strdup the input variableJakub Hrozek2012-12-071-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1701
* Fix comment on wrong lineSimo Sorce2012-12-051-1/+1
|
* LDAP: Continue adjusting group membership even if there is nothing to addJakub Hrozek2012-12-051-2/+1
| | | | https://fedorahosted.org/sssd/ticket/1695
* Add backchannel NSS provider query on initgr callsSimo Sorce2012-12-051-0/+165
| | | | | | | | | This is needed in order to assure the memcache is properly and promptly cleaned up if a user memberships change on login. The list of the current groups for the user is sourced before it is updated and sent to the NSS provider to verify if it has changed after the update call has been made.
* Hook for mmap cache update on initgroup callsSimo Sorce2012-12-051-0/+1
| | | | | This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
* Hook to perform a mmap cache update from sssd_nssSimo Sorce2012-12-051-0/+6
| | | | | This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
* Use an entry type mask macro to filter entry typesSimo Sorce2012-12-045-5/+6
| | | | | Avoids hardcoding magic numbers everywhere and self documents why a mask is being applied.
* Streamline ipa_account_info handlerSimo Sorce2012-12-041-74/+55
| | | | | | | | | | In particular note that we merge ipa_account_info_netgroups_done() and ipa_account_info_users_done() into a single fucntion called ipa_account_info_done() that handles both cases We also remove the auxiliary function ipa_account_info_complete() that unnecessarily violates the tevent_req style and instead use a new function named ipa_account_info_error_text() to generate error text.
* Fix tevent_req style for get_netgroup in ipa_idSimo Sorce2012-12-041-80/+71
| | | | Also do not intermix two tevent_req sequences
* Fix ipa_subdomain_id names and tevent_req styleSimo Sorce2012-12-043-52/+36
|
* Fix tevent_req style for krb5_authSimo Sorce2012-12-044-371/+334
| | | | | | No functionality changes, just make the code respect the tevent_req style and naming conventions and enhance readability by adding some helper functions.
* Missing parameter in DEBUG message.Michal Zidek2012-12-041-1/+2
|
* Indentation fixJakub Hrozek2012-12-041-5/+2
|
* warn user if password is about to expirePavel Březina2012-12-021-3/+4
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1638 If pwd_exp_warning == 0, expiry warning should be printed if it is returned by server. If pwd_exp_warning > 0, expiry warning should be printed only if the password will expire in time <= pwd_exp_warning. ppolicy->expiry contains period in seconds after which the password expires. Not the exact timestamp. Thus we should not add 'now' to pwd_exp_warning.
* IPA: Handle bad results from c-ares lookupStephen Gallagher2012-12-021-1/+11
| | | | | | | | | In some situations, the c-ares lookup can return NULL instead of a list of addresses. In this situation, we need to avoid dereferencing NULL. This patch adds a log message and sets the count to zero so it is handled appropriately below.
* idmap: Silence DEBUG messages when dealing with built-in SIDs.Michal Zidek2012-11-284-79/+108
| | | | | | | | When converting built-in SID to unix GID/UID a confusing debug message about the failed conversion was printed. This patch special cases these built-in objects. https://fedorahosted.org/sssd/ticket/1593
* Save errno before it might be modified.Simo Sorce2012-11-261-8/+16
| | | | | The DEBUG() macro may, at any time, change and start calling functions that touch errno. Save errno before logging and then return the saved error.
* LDAP: fix uninitialized variableOndrej Kos2012-11-231-1/+1
| | | | initialized variable, was causing build warning
* fix SIGSEGV in IPA provider when ldap_sasl_authid is not setPavel Březina2012-11-201-1/+1
| | | | | | | | https://fedorahosted.org/sssd/ticket/1657 IPA_HOSTNAME is not stored in ipa_opts->id options so it the option was always NULL here. This caused SIGSEGV when accessed by strchr() in subsequent function.
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-204-9/+39
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
* Disable canonicalization during password changesSumit Bose2012-11-191-2/+43
| | | | | | | | | | | | | | | If canonicalization is enabled Active Directory KDCs return 'krbtgt/AD.DOMAIN' as service name instead of the expected 'kadmin/changepw' which causes a 'KDC reply did not match expectations' error. Additionally the forwardable and proxiable flags are disabled, the renewable lifetime is set to 0 and the lifetime of the ticket is set to 5 minutes as recommended in https://fedorahosted.org/sssd/ticket/1405 and also done by the kpasswd utility. Fixes: https://fedorahosted.org/sssd/ticket/1405 https://fedorahosted.org/sssd/ticket/1615
* Fix compare_principal_realm() checkSumit Bose2012-11-191-9/+3
| | | | | In case of a short UPN compare_principal_realm() erroneously returns an error.
* Just use the service name with krb5_get_init_creds_password()Sumit Bose2012-11-191-24/+2
| | | | | | | | | Currently we add the realm name to change password principal but according to the MIT Kerberos docs and the upstream usage the realm name is just ignored. Dropping the realm name also does not lead to confusion if the change password request was received for a user of a trusted domain.
* LDAP: Make it possible to use full principal in ldap_sasl_authid againJakub Hrozek2012-11-191-4/+16
|
* LDAP: Checking the principal should not be considered fatalJakub Hrozek2012-11-191-6/+10
| | | | | | | | | | | | | | The check is too restrictive as the select_principal_from_keytab can return something else than user requested right now. Consider that user query for host/myserver@EXAMPLE.COM, then the select_principal_from_keytab function will return "myserver" in primary and "EXAMPLE.COM" in realm. So the caller needs to add logic to also break down the principal to get rid of the host/ part. The heuristics would simply get too complex. select_principal_from_keytab will error out anyway if there's no suitable principal at all.
* LDAP: Provide a common sdap_set_sasl_options init functionJakub Hrozek2012-11-194-91/+95
| | | | | The AD and IPA initialization functions shared the same code. This patch moves the code into a common initialization function.
* Do not save HBAC rules in subdomain subtreeSumit Bose2012-11-193-16/+32
| | | | | | | | | | | | | | Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the configured domain apply to all users it is sufficient to save them once in the subtree of the configured domain. Since most of the sysdb operations during a HBAC request are related to the HBAC rules and related data this patch does not change the default sysdb context but only create a special context to look up subdomain users.
* Refactor the way subdomain accounts are savedSimo Sorce2012-11-192-4/+61
| | | | | | | | | | | | | | | | | The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
* LDAP: Refactor saving ghost usersJakub Hrozek2012-11-191-88/+99
|
* LDAP: use the correct memory contextJakub Hrozek2012-11-191-1/+1
| | | | | The element being reallocated is part of the "group_attrs" array, not attrs.
* LDAP: Fix saving empty groupsJakub Hrozek2012-11-191-2/+4
| | | | | | | | https://fedorahosted.org/sssd/ticket/1647 A logic bug in the LDAP provider causes an attempt to allocate a zero-length array for group members while processing an empty group. The allocation would return NULL and saving the empty group would fail.
* LDAP: Allocate the temporary context on NULL, not memctxJakub Hrozek2012-11-191-1/+1
| | | | | | Allocating temporary context on NULL helps vind memory leaks with valgrind and avoid growing memory over time by allocating on a long-lived context.
* LDAP: Remove double breakJakub Hrozek2012-11-191-1/+0
|
* LDAP: Expire even non authenticated connectionsJakub Hrozek2012-11-181-8/+11
| | | | | | | The connections request was terminated before setting the expiry timeout in case no authentication was set. https://fedorahosted.org/sssd/ticket/1649
generated by cgit (git 2.34.1) at 2024-06-10 19:57:50 +0000