summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* SDAP: Make password change timeout configurable with ldap_opt_timeoutJakub Hrozek2015-03-233-5/+10
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/1501 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Make simple bind timeout configurableJakub Hrozek2015-03-234-8/+19
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1501 Reuse the value of sdap_opt_timeout to set a longer bind timeout for user authentication, ID connection authentication and authentication during IPA migration mode. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: remove unused codePavel Reichl2015-03-231-5/+1
| | | | | | Also fix debug message. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: error out instead of leaving array element uninitializedSumit Bose2015-03-231-1/+4
| | | | | | | | | | | In general every object created by the AD provider should have a SID attribute. Since SIDs and GPOs are used for access control a missing SID should be treated as error for now until it is known if there is a valid reason why the SID is missing. Resolves https://fedorahosted.org/sssd/ticket/2608 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: properly handle binary objectGuid attributeSumit Bose2015-03-203-34/+21
| | | | | | | | | | | | | | Although in the initial processing SSSD treats the binary value right at some point it mainly assumes that it is a string. Depending on the value this might end up with the correct binary value stored in the cache but in most cases there will be only a broken entry in the cache. This patch converts the binary value into a string representation which is described in [MS-DTYP] and stores the result in the cache. Resolves https://fedorahosted.org/sssd/ticket/2588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: add debug hintPavel Reichl2015-03-201-1/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: set EINVAL if dn can't be linearizedPavel Reichl2015-03-191-0/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: make sure output variable is setSumit Bose2015-03-191-1/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* selinux: Handle setup with empty default and no configured rulesJakub Hrozek2015-03-172-4/+10
| | | | | | | | | | SSSD also needs to handle the setup where no rules match the machine and the default has no MLS component. Related to: https://fedorahosted.org/sssd/ticket/2587 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA idviews: check if view name is setSumit Bose2015-03-171-1/+4
| | | | | | | | | | When working with older FreeIPA releases the view name might not always been set. This patch add checks to might sure it is only dereferenced when set. Resolves https://fedorahosted.org/sssd/ticket/2604 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-1719-44/+46
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: do not resolve group members during tokenGroups requestSumit Bose2015-03-179-18/+64
| | | | | | | | | | | | | | | | | | | | | | During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa_selinux: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | src/providers/ipa/ipa_selinux.c: In function 'ipa_selinux_handler_done': src/providers/ipa/ipa_selinux.c:927:16: error: 'sci' may be used uninitialized in this function [-Werror=maybe-uninitialized] state->sci = sci; ^ src/providers/ipa/ipa_selinux.c:333:33: note: 'sci' was declared here struct selinux_child_input *sci; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: make sure extdom expo data is availableSumit Bose2015-03-131-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: do not treat missing sub-domain users as errorSumit Bose2015-03-131-3/+7
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2444 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: fix coverity warningPavel Reichl2015-03-111-2/+12
| | | | | | | In ldap_child_get_tgt_sync() variable 'ret' got overriden in done section without ever before being read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: More debugging for create_ccache()Jakub Hrozek2015-03-101-13/+41
| | | | | | | | It was difficult to find where the problem was without advanced techniques like strace. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* be_refresh: get rid of callback pointersPavel Březina2015-03-091-67/+31
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support groupsPavel Březina2015-03-083-0/+53
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support usersPavel Březina2015-03-083-0/+53
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: add sdap_refresh_initPavel Březina2015-03-085-30/+33
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refactor netgroups refreshPavel Březina2015-03-081-32/+77
| | | | | | | This is a preparation to support other object types without introducing duplicated code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_handle_acct_req_send: remove be_reqPavel Březina2015-03-084-17/+13
| | | | | | | | | | | be_req was used only as a talloc context for subreq. This memory context was replace by state of the parent request which is more suitable for tevent coding style. This change will allow us to use this function in be_refresh where none be_req is available. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refresh all domains in backendPavel Březina2015-03-084-37/+66
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: fix minor neglect in is_account_locked()Pavel Reichl2015-03-061-0/+2
| | | | | | | | | | It would be better to return explicit error code, although access is still denied and error message printed. Relates: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap_child: initialized ccname_file_dummySumit Bose2015-03-061-1/+1
| | | | | | | | | | ccname_file_dummy is used in the done-block which is called before ccname_file_dummy is set to a value. This patch initializes ccname_file_dummy to NULL. Related to https://fedorahosted.org/sssd/ticket/2592 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Lock out ssh keys when account naturally expiresPavel Reichl2015-03-053-90/+231
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* selinux: Delete existing user mapping on empty defaultJakub Hrozek2015-03-042-7/+17
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2587 The case of SELinux default user mapping being an empty string is valid, it should translate into "pick the default context on the target machine". In case the context is empty, we need to delete the per-user mapping from the SELinux database to make sure the default is used. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: unlink ccname_file_dummy if there is an errorDaniel Hjorth2015-03-041-1/+11
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2592 If there is an error after ccname_file_dummy is created but before it is renamed then the file isn't removed. This can cause a lot of files to be created and take up inodes in a filesystem. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: enable change phase of pw expire policy checkPavel Reichl2015-03-035-1/+89
| | | | | | | | | | | | | Implement new option which does checking password expiration policy in accounting phase. This allows SSSD to issue shadow expiration warning even if alternate authentication method is used. Resolves: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: refactor pwexpire policyPavel Reichl2015-03-032-32/+90
| | | | | | | | | Move part of pwexpire policy code to a separate function. Relates to: https://fedorahosted.org/sssd/ticket/2167 Reviewed-by: Sumit Bose <sbose@redhat.com>
* FO: Use SRV TTL in fail over codeJakub Hrozek2015-03-039-9/+48
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1884 Removes the hardcoded SRV TTL timeout and uses TTL from the DNS instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove useless assignment to function parameterLukas Slebodnik2015-03-021-1/+0
| | | | | | | | | | | | | Reported by: cppcheck void free_fun(struct info *info) free(info->name); free(info); info = NULL; ^^^^^^^^^^^ Assignment to function parameter has no effect outside the function. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: log expired accounts at lower severity levelPavel Reichl2015-03-021-4/+16
| | | | | | | Attempts to log into expired accounts were logged as SSSDBG_CRIT_FAILURE which is misleading as no real failures were happening. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Remove unused argument from ipa_id_get_group_uuidsLukas Slebodnik2015-03-021-2/+0
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove unused argument from be_nsupdate_create_fwd_msgLukas Slebodnik2015-03-023-3/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PROXY: add missing space in debug messagePavel Reichl2015-02-271-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: print the pam status as string, tooJakub Hrozek2015-02-251-1/+2
| | | | | | | | On several places, let's add a pam_strerror() call so that it's easier to debug user problems. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
* LDAP: Conditional jump depends on uninitialised valueLukas Slebodnik2015-02-231-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | ==31767== at 0x5B66CFC: users_get_posix_check_done (ldap_id.c:346) ==31767== by 0x4DCC6AA: _tevent_req_notify_callback (tevent_req.c:112) ==31767== by 0x4DCC724: tevent_req_finish (tevent_req.c:149) ==31767== by 0x4DCC782: _tevent_req_error (tevent_req.c:167) ==31767== by 0x5B7ED43: sdap_posix_check_done (sdap_async.c:2486) ==31767== by 0x4DCC6AA: _tevent_req_notify_callback (tevent_req.c:112) ==31767== by 0x4DCC724: tevent_req_finish (tevent_req.c:149) ==31767== by 0x4DCC782: _tevent_req_error (tevent_req.c:167) ==31767== by 0x5B7DE37: sdap_get_generic_op_finished (sdap_async.c:1523) ==31767== by 0x5B7D62B: sdap_process_result (sdap_async.c:357) ==31767== by 0x4DCFC1C: tevent_common_loop_timer_delay (tevent_timed.c:341) ==31767== by 0x4DD0E12: epoll_event_loop_once (tevent_epoll.c:911) ==31767== by 0x4DCF23E: std_event_loop_once (tevent_standard.c:114) ==31767== by 0x4DCB38F: _tevent_loop_once (tevent.c:530) ==31767== by 0x4DCB58B: tevent_common_loop_wait (tevent.c:634) ==31767== by 0x4DCF1BE: std_event_loop_wait (tevent_standard.c:140) ==31767== by 0x4DCB627: _tevent_loop_wait (tevent.c:653) ==31767== by 0x489AB98: server_loop (server.c:668) ==31767== by 0x10D035: main (data_provider_be.c:2915) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Handle ENOENT better in the cleanup taskJakub Hrozek2015-02-171-9/+8
| | | | | | | | | The cleanup task handled both count=0 and ret=ENOENT separately which makes no sense, the count=0 handler was dead code previously. Set count=0 on ENOENT instead to just bubble through the DEBUG message gracefully as well. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Add better DEBUG messages to the cleanup taskJakub Hrozek2015-02-171-0/+11
| | | | | | | | Some failures would shortcut to the done handler without telling us anything about why it failed. This commit decorates the cleanup task with more DEBUG statements. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Better debugging for gpo_child's mkdirJakub Hrozek2015-02-171-1/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: use hard coded getters instead of generatedPavel Březina2015-02-171-54/+3
| | | | | | | | | | | | | | | Properties are single value of a small number of predefined D-Bus types. There is no need to generate them with codegen. Actually, the source generator for property getters is already quite mess with branching for array, strings and object paths. Adding any more complex type in the future (such as dictionary) would require even more branching or creating a separate path for it. Hard coding the getters will simplify creating new ones for more complex types. This patch also reduces lots of code duplication and creates a simple function for GetAll. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SELINUX: Check the return value of setuid and setgidJakub Hrozek2015-02-131-2/+12
| | | | | | Silences a Coverity warning Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Fix warning: equality comparison with extraneous parenthesesLukas Slebodnik2015-02-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | Example of warning: src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: error: equality comparison with extraneous parentheses [-Werror,-Wparentheses-equality] if (((wbc_status) == WBC_ERR_SUCCESS)) { ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: note: remove extraneous parentheses around the comparison to silence this warning if (((wbc_status) == WBC_ERR_SUCCESS)) { ~ ^ ~ src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: note: use '=' to turn this equality comparison into an assignment if (((wbc_status) == WBC_ERR_SUCCESS)) { ^~ = The reason is definition of some macros which were used in if conditions. Reviewed-by: Michal Židek <mzidek@redhat.com>
* RESOLV: Add an internal function to read TTL from a DNS packetJakub Hrozek2015-02-111-1/+1
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/1884 Adds an internal resolver function that reads the TTL for SRV records as specified by RFC-2181. Several internal c-ares definitions are used until c-ares contains a function that exposes all this information via a parsing function. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Rename the _res output parameter to avoid clashing with libresolv in testsJakub Hrozek2015-02-112-4/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: use GC for SID requests as wellSumit Bose2015-01-302-10/+29
| | | | | | | | | If a universal group is looked up by SID the cross-domain members must be resolved with the help of the Global Catalog. Related to https://fedorahosted.org/sssd/ticket/2514 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa_s2n_save_objects: properly handle fully-qualified group namesSumit Bose2015-01-301-1/+1
| | | | | | | | | | Check if the given name is already fully-qualified instead of adding a domain name unconditionally. Related to https://fedorahosted.org/sssd/ticket/2529 and https://fedorahosted.org/sssd/ticket/2524 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Resolve IPA user groups' overrideDN in non-default viewJakub Hrozek2015-01-301-8/+312
| | | | | | | | | | When the client is in a non-default view, we need to store the override data, in particular the overrideDN as well. Resolves: https://fedorahosted.org/sssd/ticket/2571 Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 11:00:04 +0000