summaryrefslogtreecommitdiffstats
path: root/src/responder/pam
Commit message (Collapse)AuthorAgeFilesLines
* Allocate PAM DP request data on responder context1.9.2-92Jakub Hrozek2013-07-253-5/+54
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1869 Currently the private data passed to the PAM request is a structure allocated on the client context. But in the odd case where the back end would be stopped or stuck until the idle timeout hits, the DP callback would access data that were freed when the client timed out. This patch introduces a new structure allocated on responder context, whose only purpose is to live as long as the request is active.
* RESPONDERS: Create a common file with service names and versionsJakub Hrozek2012-12-181-3/+1
| | | | | | | The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
* sssd_pam: Cleanup requests cache on sbus reconect1.9.2-45Simo Sorce2012-12-141-1/+4
| | | | | | | | | The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
* Refactor the way subdomain accounts are savedSimo Sorce2012-11-191-1/+4
| | | | | | | | | | | | | | | | | The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
* Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek2012-11-151-17/+12
|
* PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek2012-11-051-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
* Add new option default_domain_suffixSumit Bose2012-10-011-10/+21
|
* SELinux: Always use the default if it exists on the serverJakub Hrozek2012-09-131-22/+21
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
* Check if the SELinux login directory existsJakub Hrozek2012-09-041-3/+3
| | | | https://fedorahosted.org/sssd/ticket/1492
* Only create the SELinux login file if there are mappings on the serverJakub Hrozek2012-08-161-45/+77
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
* Do not try to remove the temp login file if already renamedJakub Hrozek2012-08-161-2/+3
| | | | | | | | | write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
* Build SELinux code in responder conditionallyJakub Hrozek2012-08-161-0/+7
| | | | https://fedorahosted.org/sssd/ticket/1480
* Fix bad checkJakub Hrozek2012-08-011-1/+1
|
* Write SELinux config files in responder instead of PAM moduleJan Zeleny2012-07-271-5/+95
|
* Move SELinux processing from session to account PAM stackJan Zeleny2012-07-271-1/+2
| | | | | | | | | | | | | | The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
* PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek2012-07-181-1/+1
|
* Fix uninitialized valuesNick Guay2012-07-181-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1379
* SELinux user maps: pick just one mapJan Zeleny2012-06-251-12/+11
| | | | | | | | | This patch modifies behavior of SSSD when putting together content of the file for pam_selinux. SSSD will now pick only the first user map in the priority list which matches to the user logging in. Other maps are ignored. https://fedorahosted.org/sssd/ticket/1360
* Fix re_expression matching with subdomainsJan Zeleny2012-06-211-33/+55
| | | | | | | | | | | This patch fixes an issue which resulted in a need to initialize responder with data from local domain, otherwise it would not correctly detect requests for subdomains. Similar situation can occur if new subdomain is added at runtime. The solution is to ask for a list of subdomains in case there is a candidate domain identified in the process of matching re_expressions with given name.
* Make re_expression and full_name_format per domain optionsStef Walter2012-06-122-12/+11
| | | | | | | | | | | * Allows different user/domain qualified names for different domains. For example Domain\User or user@domain. * The global re_expression and full_name_format options remain as defaults for the domains. * Subdomains get the re_expression and full_name_format of their parent domain. https://bugzilla.redhat.com/show_bug.cgi?id=811663
* PAM: Better pam_reply messageStephen Gallagher2012-06-101-1/+2
|
* Modify behavior of pam_pwd_expiration_warningJan Zeleny2012-05-041-35/+0
| | | | | | | | | | | | | | | | | | New option pwd_expiration_warning is introduced which can be set per domain and can override the value specified by the original pam_pwd_expiration_warning. If the value of expiration warning is set to zero, the filter isn't apllied at all - if backend server returns the warning, it will be automatically displayed. Default value for Kerberos: 7 days Default value for LDAP: don't apply the filter Technical note: default value when creating the domain is -1. This is important so we can distinguish between "no value set" and 0. Without this possibility it would be impossible to set different values for LDAP and Kerberos provider.
* Send PAM requests for subdomains to the right providerJan Zeleny2012-04-241-3/+41
|
* Modified responder_get_domain()Jan Zeleny2012-04-242-2/+2
| | | | Now it checks for subdomains as well as for the domain itself
* Add conn_name to allow different names for domains and connectionsJan Zeleny2012-04-241-1/+1
|
* Prevent printing NULL from DEBUG messagesJakub Hrozek2012-04-181-1/+2
|
* Remove sysdb_get_ctx_from_list()Sumit Bose2012-02-292-16/+15
|
* Don't give memory context in confdb where not neededJan Zeleny2012-02-212-6/+6
|
* RESPONDERS: Make the fd_limit setting configurableStephen Gallagher2012-02-171-1/+12
| | | | | | | | | | This code will now attempt first to see if it has privilege to set the value as specified, and if not it will fall back to the previous behavior. So on systems with the CAP_SYS_RESOURCE capability granted to SSSD, it will be able to ignore the limits.conf hard limit. https://fedorahosted.org/sssd/ticket/1197
* RESPONDERS: Allow increasing the file-descriptor limitStephen Gallagher2012-02-171-0/+5
| | | | | | | This patch will increase the file descriptor limit to 8k or the limits.conf maximum, whichever is lesser. https://fedorahosted.org/sssd/ticket/1197
* Only fetch SELinux string if the user is foundJakub Hrozek2012-02-101-1/+2
|
* SELinux support in PAM responderJan Zeleny2012-02-061-0/+163
|
* PAM: Do not overwrite retJakub Hrozek2012-01-261-3/+1
|
* DP: Fix bugs in sss_dp_get_account_intStephen Gallagher2012-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | The conversion to the tevent_req style introduced numerous bugs related to memory management of the various client requests. In some circumstances, this could cause memory corruption and segmentation faults in the NSS responder. This patch makes the following changes: 1) Rename the internal lookup from subreq to sidereq, to indicate that it is not a sub-request of the current lookup (and therefore is not cancelled if the current request is). 2) Change the handling of the callback loops since they call tevent_req_[done|error], which results in them being freed (and therefore removed from the cb_list. This was the source of the memory corruption that would occasionally result in dereferencing an unreadable request. 3) Remove the unnecessary sss_dp_get_account_int_recv() function and change sss_dp_get_account_done() so that it only frees the sidereq. All of the waiting processes have already been signaled with the final results from sss_dp_get_account_int_done()
* RESPONDER: Extend sss_dp_account_send() to include extra dataStephen Gallagher2012-01-211-1/+1
| | | | | | | Some NSS maps such as 'services' require more values to be passed to the data provider than just the name or ID. In these cases, we will amend an optional component to filter value to pass to the data provider backend.
* PAM: Fix reversed logicJakub Hrozek2012-01-181-1/+1
|
* sss_get_cased_name utility functionJakub Hrozek2011-12-211-2/+2
|
* PAM: make initgroups timeout work across multiple clientsStephen Gallagher2011-12-205-4/+241
| | | | | | | | | | | Instead of timing out the initgroups lookup on a per-cctx basis, we will maintain a hash table of recently-seen users and use this instead. This will allow SSSD to handle user's logging into multiple services simultaneously more graciously, as well as playing nicer with SSH (which makes calls to PAM both before and after a fork). https://fedorahosted.org/sssd/ticket/1063
* Use the case sensitivity flag in respondersJakub Hrozek2011-12-161-2/+6
|
* Canonicalize username in PAM providerJakub Hrozek2011-12-161-0/+27
|
* Responders: Split getting domain by name into separate functionJakub Hrozek2011-12-161-5/+2
|
* Ignore NULL-terminator when checking UTF8-validityStephen Gallagher2011-12-051-1/+1
| | | | | Glib fails if the NULL-terminator is included when a length is specified.
* RESPONDER: Refactor DP requests into tevent_req styleStephen Gallagher2011-11-291-11/+48
|
* RESPONDER: Ensure that all input strings are valid UTF-8Stephen Gallagher2011-11-181-0/+5
|
* Return users and groups based on aliasJakub Hrozek2011-09-281-2/+3
| | | | https://fedorahosted.org/sssd/ticket/926
* New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0Pavel Březina2011-08-251-1/+4
| | | | | | | | | | | | | | | | | | | | | Removed: SSS_UNRESOLVED_DEBUG_LEVEL (completely replaced with SSSDBG_UNRESOLVED) Added new macro: CONVERT_AND_SET_DEBUG_LEVEL(new_value) Changes unresolved debug level value (SSSDBG_UNRESOLVED) from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway, it has a minor effect, every time you want to load debug_level from command line parameters, you have to use following pattern: /* Set debug level to invalid value so we can deside if -d 0 was used. */ debug_level = SSSDBG_INVALID; pc = poptGetContext(argv[0], argc, argv, long_options, 0); while((opt = poptGetNextOpt(pc)) != -1) { ... } CONVERT_AND_SET_DEBUG_LEVEL(debug_level);
* New DEBUG facility - conversionPavel Březina2011-08-251-0/+2
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/925 Conversion of the old debug_level format to the new one. (only where it was necessary) Removed: SSS_DEFAULT_DEBUG_LEVEL (completely replaced with SSSDBG_DEFAULT)
* sysdb refactoring: memory context deletedJan Zeleny2011-08-152-9/+5
| | | | | | This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.
* sysdb refactoring: deleted domain variables in sysdb APIJan Zeleny2011-08-152-11/+5
| | | | | The patch also updates code using modified functions. Tests have also been adjusted.
* Revert "Allow LDAP to decide when an expiration warning is warranted"Stephen Gallagher2011-08-041-4/+3
| | | | This reverts commit b0b9c38dfce3e3ccbfaa4d00fdf2ea08a70d41a6.
generated by cgit (git 2.34.1) at 2024-05-12 14:57:13 +0000