summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* KRB5: Check FAST kinit errors using get_tgt_times()Jakub Hrozek2014-12-111-13/+15
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* be_ptask: use gettimeofday() instead of time()Pavel Březina2014-12-111-1/+1
| | | | | | | | | | | Sometimes the timestamp from gettimeofday() slightly differs from the one obtained via time() which caused unit test to fail on occasionaly. Resolves: https://fedorahosted.org/sssd/ticket/2521 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* simple-access-provider: break matching allowed usersPavel Reichl2014-12-081-1/+3
| | | | | | | Stop matching username with names in simple_allow_users after positive match. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* simple access provider: non-existing objectPavel Reichl2014-12-081-10/+25
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2519 Not existing user/group in simple_allow_users/simple_allow_groups should not imply access denied. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Do not append domain name to fq nameLukas Slebodnik2014-12-081-4/+17
| | | | | | | | | | Usernames from AD subdomains are already in fqdn we should not append domain name in this case. Resolves: https://fedorahosted.org/sssd/ticket/2512 Reviewed-by: Michal Židek <mzidek@redhat.com>
* be_ptask: let backoff affect only periodPavel Březina2014-12-082-30/+43
| | | | | | With this patch the first and enabled delay values are respected. Reviewed-by: Michal Židek <mzidek@redhat.com>
* krb5: add wrapper for krb5_kt_have_content()Sumit Bose2014-12-071-1/+1
| | | | | | | | | krb5_kt_have_content() was introduced in MIT Kerberos 1.11. For older platforms this patch adds sss_krb5_kt_have_content() as a wrapper. Resolves https://fedorahosted.org/sssd/ticket/2518 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Relax DEBUG messageJakub Hrozek2014-12-031-2/+5
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_atomic_write_s() return value is signedJakub Hrozek2014-12-034-4/+4
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Remove useless includeJakub Hrozek2014-12-031-2/+0
| | | | | | Using a PAM include file in an LDAP child is confusing. Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Create the fast ccache in a child processJakub Hrozek2014-12-032-28/+100
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2503 In order to avoid calling Kerberos library calls as root, the krb5_child forks itself and recreates the FAST ccache as the SSSD user. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Add extra_args to exec_child()Jakub Hrozek2014-12-034-4/+7
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2503 Currently all child processes use the same arguments, the construction of argv[] is even hardcoded in exec_child(). Add an extra_args[] array that extends the common set of argvs so that we can have child-specific arguments. Also adds a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: sysdb_get_bool() return ENOENT & unit testsPavel Reichl2014-12-021-1/+5
| | | | | | | | | | | | | sysdb_get_bool() return ENOENT if no result is found. Unit test for sysdb_get_bool() & sysdb_set_bool() was added. This patch also fixes ldap_setup_enumeration() to handle ENOENT returned by sysdb_has_enumerated(). Resolves: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5_child: become user earlierSumit Bose2014-12-021-38/+93
| | | | | | | The host keytab and the FAST credential cache are copied into memory early at startup to allow to drop privileges earlier. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: copy keytab into memory to drop privileges earlierSumit Bose2014-12-021-19/+45
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: add copy_keytab_into_memory()Sumit Bose2014-12-022-0/+196
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: add copy_ccache_into_memory()Sumit Bose2014-12-022-0/+127
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: do not fail if checking the old ccache failedSumit Bose2014-12-021-2/+5
| | | | | | https://fedorahosted.org/sssd/ticket/2510 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: only update view data if it really changedSumit Bose2014-12-021-50/+66
| | | | | | https://fedorahosted.org/sssd/ticket/2510 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: make krb5 provider view awareSumit Bose2014-12-022-6/+25
| | | | | | https://fedorahosted.org/sssd/ticket/2510 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Set dp_error if gc was not usedLukas Slebodnik2014-12-021-0/+4
| | | | | | | | | | | | | | Global catalog was not used in ipa server mode and request failed then dp_error was not set (default is zero). dp_error should not be OK on failed request. [ipa_get_ad_acct_ad_part_done] (0x0040): AD lookup failed: 11 [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: 11 [sdap_id_op_destroy] (0x4000): releasing operation connection [ipa_account_info_error_text] (0x0020): Bug: dp_error is OK on failed request [acctinfo_callback] (0x0100): Request processed. Returned 3,11,Account info lookup failed Reviewed-by: Sumit Bose <sbose@redhat.com>
* be_ptask: do not store sync ctx to _taskPavel Březina2014-11-281-4/+0
| | | | | | | | The _task is an output variable of type struct be_ptask * which is filled by be_ptask_create(). However, we tried to set sync ctx there as a result of copy and paste error. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* be_ptask: add next_execution time to struct be_ptaskPavel Březina2014-11-282-0/+3
| | | | | | For debugging and testing purposes. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* be_ptask: handle OFFLINE_DISABLE mode before task executionPavel Březina2014-11-281-1/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* be_ptask: create a private header filePavel Březina2014-11-282-23/+48
| | | | | | This is done so we gain access to the be_ptask structure in unit tests. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Never store case_sensitive as "true" to confdbMichal Zidek2014-11-281-4/+6
| | | | | | | | | | | | | | If case_sensitive was set 'true' for AD backend, we ignore it and continue with AD default (false). However we still set confdb to whatever was set in sssd.conf for the responders. We should store to confdb the value that is used by the backend. Also fixes some misleading DEBUG messages in that code area. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb5: Check return value of sss_krb5_princ_realmLukas Slebodnik2014-11-282-0/+13
| | | | | | | | | | sss_krb5_princ_realm set output parameter realm to NULL and len to 0 in case of failure. Clang static analysers reported warning "Null pointer passed as an argument to a 'nonnull' parameter" in function match_principal. It was possible, that realm_name with value NULL could be used in strncmp. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* views: allow view name change at startupSumit Bose2014-11-251-16/+81
| | | | | | | | | | Currently some manual steps are needed on a FreeIPA to switch from one view to another. With this patch the IPA provider checks at startup if the view name changed and does the needed steps automatically. Besides saving the new view name this includes removing the old view data and marking the user and group entries as invalid. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD/IPA: add krb5_confd_path configuration optionSumit Bose2014-11-256-0/+20
| | | | | | | | | With this new parameter the directory where Kerberos configuration snippets are created can be specified. Fixes https://fedorahosted.org/sssd/ticket/2473 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Hint about removing sysdb if initializing ID map failsJakub Hrozek2014-11-241-1/+7
| | | | | | https://fedorahosted.org/sssd/ticket/2477 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Handle IPA groups returned from extop pluginJakub Hrozek2014-11-241-4/+9
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* BE: Fix a debug messageJakub Hrozek2014-11-241-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: check overrrides for IPA users as wellSumit Bose2014-11-203-4/+432
| | | | | | | | | Currently overrides were only available for sub-domains, e.g. trusted AD domains. With this patch overrides can be used for IPA users as well. Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: make get_object_from_cache() publicSumit Bose2014-11-202-4/+10
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: add get_be_acct_req_for_uuid()Sumit Bose2014-11-202-6/+40
| | | | | | | | | | This new call creates the needs data for a lookup by UUID which is needed when trying to find the original object for an IPA override object. Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: always store UUID if availableSumit Bose2014-11-202-13/+52
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: add support for lookups by UUIDSumit Bose2014-11-202-5/+55
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: add split_ipa_anchor()Sumit Bose2014-11-202-0/+65
| | | | | | | | | This call extracts the domain and the UUID part from an IPA override anchor. Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: sysdb_idmap_get_mappings returns ENOENTPavel Reichl2014-11-191-1/+1
| | | | | | | | | sysdb_idmap_get_mappings returns ENOENT if no results were found. Part od solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BE: Become a regular user after initializationJakub Hrozek2014-11-181-0/+13
| | | | | | | | | | | Some parts of initialization (Kerberos ticket renewal, checking the keytab for the right principal) still require the root privileges. Drop privileges after initializing the back ends. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Move all ccache operations to krb5_child.cJakub Hrozek2014-11-185-244/+267
| | | | | | | | | | | | | | | | | | | The credential cache operations must be now performed by the krb5_child completely, because the sssd_be process might be running as the sssd user who doesn't have access to the ccaches. src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5 until we fix Kerberos ticket renewal as non-root. Also includes a new error code that indicates that the back end should remove the old ccache attribute -- the child can't do that if it's running as the user. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move checking for illegal RE to krb5_utils.cJakub Hrozek2014-11-185-48/+42
| | | | | | | | | | | | Otherwise we would have to link krb5_child with pcre and transfer the regex, which would be cumbersome. Check for illegal patterns when expanding the template instead. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move ccache-related functions to krb5_ccache.cJakub Hrozek2014-11-189-709/+783
| | | | | | | | | | | | | Add a new module krb5_ccache.c that contains all ccache-related operations. The only user of this module shall be krb5_child.c as the other modules will run unprivileged and accessing the ccache requires either privileges of root or the ccache owner. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Drop privileges in the child, not the back endJakub Hrozek2014-11-182-21/+56
| | | | | | | | | | | | | | | | | | In future patches, sssd_be will be running as a non-privileged user, who will execute the setuid krb5_child. In this case, the child will start as root and drop the privileges as soon as possible. However, we need to also remove the privilege drop in sssd_be, because if we dropped to the user who is authenticating, we wouldn't be even allowed to execute krb5_child. The krb5_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Preserve service name in proxy providerMichal Zidek2014-11-131-1/+21
| | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2461 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* proxy: Do not try to store same alias twiceMichal Zidek2014-11-131-28/+49
| | | | | | | | | | | LDB does not store attributes if they have the same name and value and errors out instead. Fixes: https://fedorahosted.org/sssd/ticket/2461 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Disable token groups by defaultLukas Slebodnik2014-11-121-1/+1
| | | | | | | | | | | | | | | | We tried to speed up processing of initgroup lookups with tokenGroups even for the LDAP provider (if remote server is Active Directory), but it turns out that there are too many corner cases that we didn't catch during development that break. For instance, groups from other trusted domains might appear in TG and the LDAP provider isn't equipped to handle them. Overall, users who wish to use the added speed benefits of tokenGroups are advised to use the AD provider. Resolves: https://fedorahosted.org/sssd/ticket/2483 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: Change level of debug messageLukas Slebodnik2014-11-111-1/+1
| | | | | | | The end of dnf update is not an operation failure it is just a usefull debug message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Revert "LDAP: Change defaults for ldap_user/group_objectsid"Lukas Slebodnik2014-11-101-4/+4
| | | | | | | | | | | | This reverts commit f834f712548db811695ea0fd6d6b31d3bd03e2a3. OpenLDAP server cannot dereference unknown attributes. The attribute objectSID isn't in any standard objectclass on OpenLDAP server. This is a reason why objectSID cannot be set by default in rfc2307 map and rfc2307bis map. It is the same problem as using non standard attribute "nsUniqueId" in ticket https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PAM: Remove authtok from PAM stack with OTPLukas Slebodnik2014-11-071-0/+14
| | | | | | | | | | | We remove the password from the PAM stack when OTP is used to make sure that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore and have to request a password on their own. Resolves: https://fedorahosted.org/sssd/ticket/2287 Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-30 19:06:28 +0000