summaryrefslogtreecommitdiffstats
path: root/src/responder/pam
Commit message (Collapse)AuthorAgeFilesLines
* Use lower-case name for case-insensitive searchesSumit Bose2013-12-191-2/+2
| | | | | | | | | | | | The patch makes sure that a completely lower-cased version of a fully qualified name is used for case insensitive searches. Currently there are code paths where the domain name was used as configured and was not lower-cased. To make sure this patch does not break with old entries in the cache or case sensitive domains a third template was added to the related filters templates which is either filled with a completely lower-cased version or with the old version. The other two template values are unchanged.
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-1/+1
|
* pam: Bad debug message format and parameter.Michal Zidek2013-08-221-1/+2
|
* PAM: Set negcache if user is not found after provider checkJakub Hrozek2013-08-081-0/+10
|
* PAM: Check negcache when searching for fully qualified users, tooJakub Hrozek2013-08-081-0/+8
|
* Remove unused memory contextLukas Slebodnik2013-07-291-6/+6
|
* Do not try to set password when authtok_length is zeroOndrej Kos2013-07-181-2/+6
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1814 When the authtok_length is zero, it shouldn't call sss_authtok_set_password, because it tries to determine lenght of passed string by itself and would read parts of DBus message behind boundaries of authtok.
* Lookup domains at startupSumit Bose2013-06-041-0/+6
| | | | | | | | | | | | To make sure that e.g. the short/NetBIOS domain name is available this patch make sure that the responders send a get_domains request to their backends at startup the collect the domain information or read it from the cache if the backend is offline. For completeness I added this to all responders even if they do not need the information at the moment. Fixes https://fedorahosted.org/sssd/ticket/1951
* Fixing critical format string issues.Lukas Slebodnik2013-05-203-4/+8
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* Remove unused TALLOC_CTX from responder_get_domain()Sumit Bose2013-05-021-2/+2
| | | | | | Recent refactoring removed the need to copy the domain info data of sub-domains because the related objects will not be removed from memory anymore.
* Allocate PAM DP request data on responder contextJakub Hrozek2013-04-083-5/+54
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1869 Currently the private data passed to the PAM request is a structure allocated on the client context. But in the odd case where the back end would be stopped or stuck until the idle timeout hits, the DP callback would access data that were freed when the client timed out. This patch introduces a new structure allocated on responder context, whose only purpose is to live as long as the request is active.
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-022-14/+12
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-021-1/+1
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* change responder contexts hierarchyPavel Březina2013-03-201-8/+12
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1575 The hierarchy is now: main_ctx -> responder_ctx -> specific_ctx where specific_ctx is one of sudo, pam, etc.
* do not leak memory on failure in *_process_init()Pavel Březina2013-03-201-1/+1
|
* Move SELinux processing to provider.Michal Zidek2013-03-191-309/+0
| | | | | | | | | | | | The SELinux processing was distributed between provider and pam responder which resulted in hard to maintain code. This patch moves the logic to provider. IT ALSO REQUIRES CHANGE IN THE SELINUX POLICY, because the provider also writes the content of selinux login file to disk (which was done by responder before). https://fedorahosted.org/sssd/ticket/1743
* Use the same dbg level for all ncache hits.Michal Zidek2013-03-041-3/+3
| | | | | | | | | We used different debug levels for messages informing about negative cache hits (old levels 2,3,4). Now it is only SSSDBG_TRACE_FUNC (same level is used in nsssrv_services.c and proposed in the ticket bellow). https://fedorahosted.org/sssd/ticket/1771
* if selinux is disabled, ignore that selogin dir is missingPavel Březina2013-02-261-3/+15
| | | | https://fedorahosted.org/sssd/ticket/1817
* Add function get_next_domain()Simo Sorce2013-02-101-3/+5
| | | | | | | Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
* Add domain argument to sysdb selinux functionsSimo Sorce2013-01-151-2/+4
|
* Add domain argument to sysdb_cache_auth()Simo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_set_user_attr()Simo Sorce2013-01-152-12/+10
|
* Add domain argument to sysdb_get_user_attr()Simo Sorce2013-01-151-2/+2
|
* Pass domain to sysdb_get<pw/gr>nam() functionsSimo Sorce2013-01-151-3/+1
| | | | | | Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore fqnames proper value in subdomains, by testing for a parent domain being present or not.
* Change pam data auth tokens.Simo Sorce2013-01-102-94/+94
| | | | Use the new authtok abstraction and interfaces throught the code.
* Code can only check for cached passwordsSimo Sorce2013-01-101-15/+24
| | | | | Make it clear to the API users that we can not take arbitrary auth tokens. We can only take a password for now so simplify and clarify the interface.
* RESPONDERS: Create a common file with service names and versionsJakub Hrozek2012-12-181-3/+1
| | | | | | | The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
* sssd_pam: Cleanup requests cache on sbus reconectSimo Sorce2012-12-141-1/+4
| | | | | | | | | The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
* Refactor the way subdomain accounts are savedSimo Sorce2012-11-191-1/+4
| | | | | | | | | | | | | | | | | The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
* Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek2012-11-121-17/+12
|
* PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek2012-11-021-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
* Include talloc log in our debug facilityMichal Zidek2012-10-291-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1495
* Add new option default_domain_suffixSumit Bose2012-10-011-10/+21
|
* SELinux: Always use the default if it exists on the serverJakub Hrozek2012-09-131-22/+21
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
* Check if the SELinux login directory existsJakub Hrozek2012-09-041-3/+3
| | | | https://fedorahosted.org/sssd/ticket/1492
* Only create the SELinux login file if there are mappings on the serverJakub Hrozek2012-08-161-45/+77
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
* Do not try to remove the temp login file if already renamedJakub Hrozek2012-08-161-2/+3
| | | | | | | | | write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
* Build SELinux code in responder conditionallyJakub Hrozek2012-08-161-0/+7
| | | | https://fedorahosted.org/sssd/ticket/1480
* Fix bad checkJakub Hrozek2012-08-011-1/+1
|
* Write SELinux config files in responder instead of PAM moduleJan Zeleny2012-07-271-5/+95
|
* Move SELinux processing from session to account PAM stackJan Zeleny2012-07-271-1/+2
| | | | | | | | | | | | | | The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
* PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek2012-07-181-1/+1
|
* Fix uninitialized valuesNick Guay2012-07-181-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1379
* SELinux user maps: pick just one mapJan Zeleny2012-06-251-12/+11
| | | | | | | | | This patch modifies behavior of SSSD when putting together content of the file for pam_selinux. SSSD will now pick only the first user map in the priority list which matches to the user logging in. Other maps are ignored. https://fedorahosted.org/sssd/ticket/1360
* Fix re_expression matching with subdomainsJan Zeleny2012-06-211-33/+55
| | | | | | | | | | | This patch fixes an issue which resulted in a need to initialize responder with data from local domain, otherwise it would not correctly detect requests for subdomains. Similar situation can occur if new subdomain is added at runtime. The solution is to ask for a list of subdomains in case there is a candidate domain identified in the process of matching re_expressions with given name.
* Make re_expression and full_name_format per domain optionsStef Walter2012-06-122-12/+11
| | | | | | | | | | | * Allows different user/domain qualified names for different domains. For example Domain\User or user@domain. * The global re_expression and full_name_format options remain as defaults for the domains. * Subdomains get the re_expression and full_name_format of their parent domain. https://bugzilla.redhat.com/show_bug.cgi?id=811663
* PAM: Better pam_reply messageStephen Gallagher2012-06-101-1/+2
|
* Modify behavior of pam_pwd_expiration_warningJan Zeleny2012-05-041-35/+0
| | | | | | | | | | | | | | | | | | New option pwd_expiration_warning is introduced which can be set per domain and can override the value specified by the original pam_pwd_expiration_warning. If the value of expiration warning is set to zero, the filter isn't apllied at all - if backend server returns the warning, it will be automatically displayed. Default value for Kerberos: 7 days Default value for LDAP: don't apply the filter Technical note: default value when creating the domain is -1. This is important so we can distinguish between "no value set" and 0. Without this possibility it would be impossible to set different values for LDAP and Kerberos provider.
* Send PAM requests for subdomains to the right providerJan Zeleny2012-04-241-3/+41
|
* Modified responder_get_domain()Jan Zeleny2012-04-242-2/+2
| | | | Now it checks for subdomains as well as for the domain itself
generated by cgit (git 2.34.1) at 2024-05-10 12:17:09 +0000