summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* Do not return DP_ERR_FATAL in case of successSumit Bose2013-09-271-1/+5
|
* ipa_server_mode: write capaths to krb5 include fileSumit Bose2013-09-272-2/+4
| | | | | | | | | | | | If there are member domains in a trusted forest which are DNS-wise not proper children of the forest root the IPA KDC needs some help to determine the right authentication path. In general this should be done internally by the IPA KDC but this works requires more effort than letting sssd write the needed data to the include file for krb5.conf. If this functionality is available for the IPA KDC this patch might be removed from the sssd tree. Fixes https://fedorahosted.org/sssd/ticket/2093
* IPA: store forest name for forest member domainsSumit Bose2013-09-272-2/+87
| | | | | In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
* IPA: Ignore dns_discovery_domain in server modeJakub Hrozek2013-09-261-0/+36
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2079 If the dns_discovery_domain is set in the server mode, then the current failover code will use it to discover the AD servers as well. This patch resets the discovery domain unless the admin configured SRV resolution for IPA servers manually. In the case he did, we try to warn him that service discovery of AD servers will most likely fail.
* ad: store group in correct tree on initgroups via tokenGroupsPavel Březina2013-09-261-11/+41
| | | | | | | | | If tokenGroups contains group from different domain than user's, we stored it under the user's domain tree in sysdb. This patch changes it so we store it under group's domain tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
* sysdb: get_sysdb_grouplist() can return either names or dnPavel Březina2013-09-262-16/+55
| | | | | | | | | We need to work with distinguish names when processing cross-domain membership, because groups and users may be stored in different sysdb tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
* KRB5: Fix bad comparisonJakub Hrozek2013-09-261-1/+1
|
* krb5: Be more lenient on failures for old ccacheSimo Sorce2013-09-252-2/+2
| | | | | | | | | | | Fix a check for an error return code that can be returned when the ccache is not found. Even in case of other errors still do not fail authentication but allow it to proceed using a new ccache file if necessary. Related: https://fedorahosted.org/sssd/ticket/2053
* Include header file in implementation module.Lukas Slebodnik2013-09-2412-0/+12
| | | | | Declarations of public functions was in header files, but header files was not included in implementation file.
* Convert IN_MULTICAST parameter to host orderJakub Hrozek2013-09-242-2/+2
| | | | | | | https://fedorahosted.org/sssd/ticket/2087 IN_MULTICAST accepts address in the host order, but network order was supplied.
* krb5: do not expand enterprise principals is offlineSumit Bose2013-09-231-1/+1
| | | | | | | | Expanding a principle to an enterprise principal only makes sense if there is a KDC available which can process it. If we are offline the plain principal should be used, e.g. to create an expired ccache. Fixes https://fedorahosted.org/sssd/ticket/2060
* krb5: save canonical upn to sysdbSumit Bose2013-09-234-20/+57
| | | | | | | | | | | | | If the returned TGT contains a different user principal name (upn) than used in the request, i.e. the upn was canonicalized, we currently save it to sysdb into the same attribute where the upn coming from an LDAP server is stored as well. This means the canonical upn might be overwritten when the user data is re-read from the LDAP server. To avoid this this patch add a new attribute to sysdb where the canonical upn is stored and makes sure it is used when available. Fixes https://fedorahosted.org/sssd/ticket/2060
* Check return values of setenv and unsetenvJakub Hrozek2013-09-221-1/+5
|
* LDAP: Use primary cn to search netgroupLukas Slebodnik2013-09-203-7/+22
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2075
* AD: Failure to get flat name is not fatalJakub Hrozek2013-09-203-68/+86
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2067 Some AD or AD-like servers do not contain the netlogon attribute in the master domain name. Instead of failing completely, we should just abort the master domain request and carry on. The only functionality we miss would be getting users by domain flat name.
* sdap_domain_add: remove too strict consistency checkSumit Bose2013-09-201-10/+0
| | | | | The check worked for simple setups but fails e.g. in environment with trusts.
* LDAP: Deprecate ldap_{user,group}_search_filterJakub Hrozek2013-09-201-0/+12
|
* AD: Download master domain info when enumeratingJakub Hrozek2013-09-185-7/+211
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2068 With the current design, downloading master domain data was tied to subdomains refresh, triggered by responders. But because enumeration is a background task that can't be triggered on its own, we can't rely on responders to download the master domain data and we need to check the master domain on each enumeration request.
* LDAP: sdap_id_setup_tasks accepts a custom enum requestJakub Hrozek2013-09-184-18/+29
| | | | AD provider will override the default with its own.
* AD: async request to retrieve master domain infoJakub Hrozek2013-09-184-214/+414
| | | | Adds a reusable async request to download the master domain info.
* BE: Log domain name to journald if availableJakub Hrozek2013-09-181-0/+2
| | | | | | | | If the SSSD is compiled with journald support, then all sss_log() statements will include a new field called "SSSD_DOMAIN" that includes the domain name. Filtering only messages from the single domain is then as easy as: # journalctl SSSD_DOMAIN=foo.example.com
* KRB5: Call umask before mkstemp in the krb5 child codeJakub Hrozek2013-09-171-0/+3
|
* simple provider: obey case sensitivity for subdomain users and groupsPavel Březina2013-09-171-7/+43
| | | | | | | | When comparing username and his groups to access list, we will obey case sensitivity of object from access list. Resolves: https://fedorahosted.org/sssd/ticket/2034
* simple provider: support subdomain groupsPavel Březina2013-09-171-23/+64
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2034
* simple provider: support subdomain usersPavel Březina2013-09-171-5/+10
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2034
* util: add sss_idmap_talloc[_free]Pavel Březina2013-09-173-39/+9
| | | | Remove code duplication.
* IPA: Deprecate ipa_hbac_support_srchost optionOndrej Kos2013-09-132-0/+11
| | | | | | | | | This option got already deprecated on the ipa server side. Option is undocumented and warning is printed both to the sssd log files and syslog. Resolves: https://fedorahosted.org/sssd/ticket/1918
* KRB: Remove unused function parametersLukas Slebodnik2013-09-121-4/+2
| | | | | Parameter "int *dp_err" and parameter "int *pam_status" were unused in static function krb5_auth_prepare_ccache_name.
* KRB: Remove unused memory contextLukas Slebodnik2013-09-123-3/+3
| | | | mem_ctx was unused in function get_domain_or_subdomain
* Fix formating of variables with type: gid_tLukas Slebodnik2013-09-115-19/+19
|
* Fix formating of variables with type: uid_tLukas Slebodnik2013-09-113-8/+12
|
* Fix formating of variables with type: id_tLukas Slebodnik2013-09-112-5/+9
|
* Use right formating to print stringLukas Slebodnik2013-09-111-1/+1
| | | | format specifies type 'int' but the argument has type 'const char *'
* Fix warning: data argument not used by format stringLukas Slebodnik2013-09-111-2/+5
|
* Fix formating of variables with ber_ typeLukas Slebodnik2013-09-112-3/+4
|
* Fix formating of variables with type: time_tLukas Slebodnik2013-09-117-9/+10
|
* Fix formating of variables with type defined in stdint.hLukas Slebodnik2013-09-113-5/+7
|
* Fix formating of variables with type: key_serial_tLukas Slebodnik2013-09-111-1/+2
|
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-1127-63/+76
|
* Fix formating of variables with type: ssize_tLukas Slebodnik2013-09-113-5/+5
|
* Use the same variable type like in struct ldb_message_elementLukas Slebodnik2013-09-111-1/+1
| | | | | struct ldb_message_element.num_values is unsigned This patch indirectly fixes printf format string warning.
* Fix formating of variables with type: intLukas Slebodnik2013-09-112-3/+4
|
* Fix formating of variables with type: unsigned longLukas Slebodnik2013-09-111-1/+1
|
* Fix formating of variables with type: longLukas Slebodnik2013-09-115-10/+13
|
* LDAP: Store cleanup timestamp after initial cleanupJakub Hrozek2013-09-113-10/+10
| | | | | | When the SSSD changes serves (and hence lastUSN) we perform a cleanup as well. However, after recent changes, we didn't set the cleanup timestamp correctly, which made the lastUSN logic fail.
* is_dn(): free dnPavel Březina2013-09-101-0/+2
|
* krb5: Fix warning sometimes uninitializedLukas Slebodnik2013-09-101-0/+2
| | | | | | | warning: variable 'ret' is used uninitialized whenever 'if' condition is false if (kerr) { ^~~~
* krb5_child: Simplify ccache creationSimo Sorce2013-09-091-387/+87
| | | | | | | | | | | | The containing ccache directory is precreated by the parent code, so there is no special need to do so here for any type. Also the special handling for the FILE ccache temporary file is not really useful, because libkrb5 internally unlinks and then recreate the file, so mkstemp cannot really prevent subtle races, it can only make sure the file is unique at creation time. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add file/dir path precheckSimo Sorce2013-09-092-0/+35
| | | | | | | | | | | | | | | | | | | | | | | Add a precheck on the actual existence at all of the file/dir ccname targeted (for FILE/DIR types), and bail early if nothing is available. While testing I found out that without this check, the krb5_cc_resolve() function we call as user to check old paths would try to create the directory if it didn't exist. With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would cause two undesirable side effects: First it would actually create a directory with the old name, when it should not. Second, because for some reason the umask is set to 0127 in sssd_be, it would create the directory with permission 600 (missing the 'x' traverse bit on the directory. If the new ccache has the same name it would cause the krb5_child process to fal to store the credential cache in it. Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Remove unused ccache backend infrastructureSimo Sorce2013-09-096-144/+14
| | | | | | | | Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
generated by cgit (git 2.34.1) at 2025-10-01 19:24:07 +0000