summaryrefslogtreecommitdiffstats
path: root/src/responder/pam
Commit message (Collapse)AuthorAgeFilesLines
* SELinux support in PAM responderJan Zeleny2012-02-061-0/+163
|
* PAM: Do not overwrite retJakub Hrozek2012-01-261-3/+1
|
* DP: Fix bugs in sss_dp_get_account_intStephen Gallagher2012-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | The conversion to the tevent_req style introduced numerous bugs related to memory management of the various client requests. In some circumstances, this could cause memory corruption and segmentation faults in the NSS responder. This patch makes the following changes: 1) Rename the internal lookup from subreq to sidereq, to indicate that it is not a sub-request of the current lookup (and therefore is not cancelled if the current request is). 2) Change the handling of the callback loops since they call tevent_req_[done|error], which results in them being freed (and therefore removed from the cb_list. This was the source of the memory corruption that would occasionally result in dereferencing an unreadable request. 3) Remove the unnecessary sss_dp_get_account_int_recv() function and change sss_dp_get_account_done() so that it only frees the sidereq. All of the waiting processes have already been signaled with the final results from sss_dp_get_account_int_done()
* RESPONDER: Extend sss_dp_account_send() to include extra dataStephen Gallagher2012-01-211-1/+1
| | | | | | | Some NSS maps such as 'services' require more values to be passed to the data provider than just the name or ID. In these cases, we will amend an optional component to filter value to pass to the data provider backend.
* PAM: Fix reversed logicJakub Hrozek2012-01-181-1/+1
|
* sss_get_cased_name utility functionJakub Hrozek2011-12-211-2/+2
|
* PAM: make initgroups timeout work across multiple clientsStephen Gallagher2011-12-205-4/+241
| | | | | | | | | | | Instead of timing out the initgroups lookup on a per-cctx basis, we will maintain a hash table of recently-seen users and use this instead. This will allow SSSD to handle user's logging into multiple services simultaneously more graciously, as well as playing nicer with SSH (which makes calls to PAM both before and after a fork). https://fedorahosted.org/sssd/ticket/1063
* Use the case sensitivity flag in respondersJakub Hrozek2011-12-161-2/+6
|
* Canonicalize username in PAM providerJakub Hrozek2011-12-161-0/+27
|
* Responders: Split getting domain by name into separate functionJakub Hrozek2011-12-161-5/+2
|
* Ignore NULL-terminator when checking UTF8-validityStephen Gallagher2011-12-051-1/+1
| | | | | Glib fails if the NULL-terminator is included when a length is specified.
* RESPONDER: Refactor DP requests into tevent_req styleStephen Gallagher2011-11-291-11/+48
|
* RESPONDER: Ensure that all input strings are valid UTF-8Stephen Gallagher2011-11-181-0/+5
|
* Return users and groups based on aliasJakub Hrozek2011-09-281-2/+3
| | | | https://fedorahosted.org/sssd/ticket/926
* New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0Pavel Březina2011-08-251-1/+4
| | | | | | | | | | | | | | | | | | | | | Removed: SSS_UNRESOLVED_DEBUG_LEVEL (completely replaced with SSSDBG_UNRESOLVED) Added new macro: CONVERT_AND_SET_DEBUG_LEVEL(new_value) Changes unresolved debug level value (SSSDBG_UNRESOLVED) from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway, it has a minor effect, every time you want to load debug_level from command line parameters, you have to use following pattern: /* Set debug level to invalid value so we can deside if -d 0 was used. */ debug_level = SSSDBG_INVALID; pc = poptGetContext(argv[0], argc, argv, long_options, 0); while((opt = poptGetNextOpt(pc)) != -1) { ... } CONVERT_AND_SET_DEBUG_LEVEL(debug_level);
* New DEBUG facility - conversionPavel Březina2011-08-251-0/+2
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/925 Conversion of the old debug_level format to the new one. (only where it was necessary) Removed: SSS_DEFAULT_DEBUG_LEVEL (completely replaced with SSSDBG_DEFAULT)
* sysdb refactoring: memory context deletedJan Zeleny2011-08-152-9/+5
| | | | | | This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.
* sysdb refactoring: deleted domain variables in sysdb APIJan Zeleny2011-08-152-11/+5
| | | | | The patch also updates code using modified functions. Tests have also been adjusted.
* Revert "Allow LDAP to decide when an expiration warning is warranted"Stephen Gallagher2011-08-041-4/+3
| | | | This reverts commit b0b9c38dfce3e3ccbfaa4d00fdf2ea08a70d41a6.
* Allow LDAP to decide when an expiration warning is warrantedStephen Gallagher2011-08-011-3/+4
| | | | | | | | | Previously, we were only displaying expiration warnings if the password was going to expire within a day. We'll allow LDAP to make this decision (by whether it passes us the expiration time). In the future, we can add an option to clamp this down to a shorter period if the local admin prefers it.
* Allow changing the log level without restartStephen Gallagher2011-05-061-1/+1
| | | | | | We will now re-read the confdb debug_level value when processing the monitor_common_logrotate() function, which occurs when the monitor receives a SIGHUP.
* Fix unchecked return values of pam_add_responseJakub Hrozek2011-04-081-4/+12
| | | | https://fedorahosted.org/sssd/ticket/798
* Perform initgroups lookups for all domainsStephen Gallagher2011-02-211-3/+5
| | | | | | | | | | Previously, we were setting the client context PAM lookup timeout after the first domain replied. However, if the user wasn't a member of the first domain, their information wasn't being updated. This patch ensures that we only set this timeout after the user has been found or all domains were searched.
* Perform initgroups lookup for PAMStephen Gallagher2011-01-211-1/+3
| | | | | Previously we were only looking up the user, but we need to make sure that all groups are available for use by access providers.
* Use DEFAULT_PAM_VERBOSITY if config value cannot be retrievedSumit Bose2011-01-191-1/+1
|
* Add pam_pwd_expiration_warning config optionSumit Bose2011-01-191-12/+47
|
* Validate user supplied size of data itemsSumit Bose2011-01-111-76/+75
| | | | | | Specially crafted packages might lead to an integer overflow and the parsing of the input buffer might not continue as expected. This issue was identified by Sebastian Krahmer <krahmer@suse.de>.
* Update the ID cache for any PAM requestStephen Gallagher2010-12-223-8/+21
| | | | | | | | Also adds an option to limit how often we check the ID provider, so that conversations with multiple PAM requests won't update the cache multiple times. https://fedorahosted.org/sssd/ticket/749
* Ensure ID is checked in all domains for PAMStephen Gallagher2010-12-221-0/+2
| | | | | | | Previously, this was initialized to zero, so the first domain in the list wouldn't be checked for ID updates in pam_check_user_search. This initializes the first domain to check the provider.
* Remove unused newauthtok variable in LOCAL_pam_handlerSumit Bose2010-12-141-3/+0
| | | | https://fedorahosted.org/sssd/ticket/716
* Eliminate possible NULL-dereference in pam_check_user_searchStephen Gallagher2010-12-141-0/+7
| | | | https://fedorahosted.org/sssd/ticket/719
* Add support for server-side pam response messagesSumit Bose2010-12-031-0/+2
|
* Introduce pam_verbosity config optionSumit Bose2010-11-151-11/+90
| | | | | | | | | | | Currently we display all PAM messages generated by sssd to the user. But only some of them are important and others are just some useful information. This patch introduces a new option to the PAM responder which controls what kind of messages are displayed. As an example the 'Authenticated with cached credentials' message is used. This message is only displayed if pam_verbosity=1 or if there is an expire date.
* Avoid long long in messages to PAM client use int64_tSumit Bose2010-11-151-7/+7
|
* Move crypto functions into its own subdirJakub Hrozek2010-09-081-1/+1
| | | | | | A refactoring patch that creates a common util/crypto subdir with per-implementation subdirectories for each underlying crypto library supported by SSSD.
* Honor filter_users in PAMStephen Gallagher2010-06-173-10/+47
|
* Remove dead code from the PAM responderJakub Hrozek2010-06-062-13/+0
|
* Add support for delayed kinit if offlineSumit Bose2010-05-261-1/+1
| | | | | | | If the configuration option krb5_store_password_if_offline is set to true and the backend is offline the plain text user password is stored and used to request a TGT if the backend becomes online. If available the Linux kernel key retention service is used.
* sysdb: remove remaining traces of sysdb_handleSimo Sorce2010-04-121-1/+0
|
* sysdb: convert sysdb_get_user_attrSimo Sorce2010-04-121-57/+39
|
* sysdb: convert sysdb_getpwnamSimo Sorce2010-04-122-219/+119
|
* Remove remaining use of sysdb_transaction_sendSimo Sorce2010-04-122-232/+32
|
* sysdb: convert sysdb_cache_authSimo Sorce2010-04-121-47/+39
|
* sysdb: convert sysdb_set_entry/user/group_attrSimo Sorce2010-04-122-45/+7
|
* Fix warnings from -Wmissing-field-initializersSumit Bose2010-03-251-17/+17
| | | | This patch removes some tab-indentations from pamsrv.c, too.
* Fix a series of memory leaks in the SBUSStephen Gallagher2010-03-171-3/+5
|
* Properly handle dbus send attempts on a closed connectionStephen Gallagher2010-03-151-22/+5
| | | | | | | | dbus_connection_send_with_reply() will report success and return a NULL pending_reply when the connection is not open for communication. This patch creates a new wrapper around dbus_connection_send_with_reply() to properly detect this condition and report it as an error.
* Reopen logs when SIGHUP is caughtJakub Hrozek2010-03-081-0/+1
| | | | | | | | Upon receiving SIGHUP, the monitor signals all services to reopen their debug logs. It is also possible to signal individual services to reopen their particular files. Fixes: #332
* Add forgotten \n in DEBUG statementsMartin Nagy2010-03-041-1/+1
| | | | | | Logs from confdb with missing '\n' in the DEBUG statements annoyed me so I decided to fix them. I also made a quick grep through the code and found other places so I fixed them too.
* Eliminate monitor reconfigStephen Gallagher2010-03-041-13/+0
| | | | | | | | | | | | We disabled live reconfiguration a long time ago with the intent of fixing it so that it wasn't completely broken, but we've decided that live updates are too delicate to handle all cases gracefully. For the forseeable future, we will rely on process restart for updating the configuration. Furthermore, we had not completely disabled live updates. It would still attempt to run if we sent a SIGHUP. This has also been eliminated.
generated by cgit (git 2.34.1) at 2024-04-18 09:52:21 +0000