summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
* sudo: support users from subdomainsPavel Březina2012-11-144-60/+214
| | | | https://fedorahosted.org/sssd/ticket/1616
* use tmp_ctx in sudosrv_get_sudorules_from_cache()Pavel Březina2012-11-141-8/+20
|
* sudo: fix missing parameter in two debug messagesPavel Březina2012-11-141-3/+3
|
* Store the original group DN in the subdomain user objectSumit Bose2012-11-121-26/+58
| | | | | | | | | | | For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
* Get lists of GIDs to be added and deleted and use themSumit Bose2012-11-121-3/+89
| | | | | | | Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
* Add pac_user_get_grp_info() to read current group membershipsSumit Bose2012-11-121-0/+106
| | | | | | | | | | | | To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
* Add diff_gid_lists() with testSumit Bose2012-11-122-0/+172
| | | | | | | | This patch adds a new call which compares a list of current GIDs with a list of new GIDs and return a list of GIDs which are currently missing and must be added and another list of GIDs which are not used anymore and must be deleted. The method is the same as used by diff_string_lists().
* sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina2012-11-121-1/+2
| | | | | | | If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
* sss_cache: Remove fastcache even if sssd is not running.Michal Zidek2012-11-061-3/+23
| | | | https://fedorahosted.org/sssd/ticket/1584
* PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek2012-11-051-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
* Free the internal DP requestJakub Hrozek2012-11-051-0/+8
|
* pac responder: add user principal and name alias to cached user objectSumit Bose2012-11-053-4/+46
| | | | | | | The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
* pac responder: use only lower case user nameSumit Bose2012-11-052-5/+15
| | | | | Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
* pac responder: fix copy-and-paste errorSumit Bose2012-11-051-7/+0
| | | | This error prevent proper id-mapping in the PAC responder.
* Fix two errors in the nss responderSumit Bose2012-11-051-1/+3
| | | | | | | | | One is a copy-and-paste error which was introduce by 1774ee9a61b9d691dadd1a0538f32bcdcc84f72f. The second fixes a missing explicit setting of the return value. In the case where we want fully qualified names ret contains the number of characters from the last snprintf() which is almost ever not 0.
* Check for subdomains if getpwuid or getgrgid are the first requestsSumit Bose2012-10-121-0/+72
| | | | Fixes https://fedorahosted.org/sssd/ticket/1561
* Save time of last get_domains requestSumit Bose2012-10-121-0/+16
|
* Fix memory hierarchy in subdomains discoveryJakub Hrozek2012-10-111-116/+160
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1571 The patch changes the subdomains discovery to use the tevent_req style. Previously, the code violated several rules which made the code very unreadable and led to memory hierarchy issues and use-after-free errors.
* nss_cmd_retpwent(): do not go into infinite loop if n < 0Pavel Březina2012-10-111-0/+8
| | | | https://fedorahosted.org/sssd/ticket/1551
* do not call dp callbacks when responder is shutting downPavel Březina2012-10-113-0/+25
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
* Fix typosYuri Chornoivan2012-10-092-2/+2
|
* Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek2012-10-091-1/+2
|
* SSH: Expire hosts in known_hostsJan Cholasta2012-10-053-1/+21
|
* SSH: Refactor sysdb and related codeJan Cholasta2012-10-052-73/+52
|
* Fix few coding style issuesPavel Březina2012-10-021-1/+1
|
* Use flat name for master domain as wellSumit Bose2012-10-012-1/+18
|
* Add new option default_domain_suffixSumit Bose2012-10-0110-24/+65
|
* SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2012-09-242-6/+2
| | | | | The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
* sss_cache tool invalidates records in memory cache.Michal Zidek2012-09-243-2/+126
|
* SSH: Fix possible infinite loop when updating known_hostsJan Cholasta2012-09-201-3/+1
|
* SELinux: Always use the default if it exists on the serverJakub Hrozek2012-09-131-22/+21
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
* NSS: Fix off-by-one error in parse_getservbynameJakub Hrozek2012-09-131-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1438
* SSH: Simplify public key formatting functionJan Cholasta2012-09-041-4/+2
|
* SSH: Return error code in SSH utility functionsJan Cholasta2012-09-041-6/+7
|
* Check if the SELinux login directory existsJakub Hrozek2012-09-041-3/+3
| | | | https://fedorahosted.org/sssd/ticket/1492
* accept_fd_handler: add missing returnSumit Bose2012-08-211-0/+1
|
* Only create the SELinux login file if there are mappings on the serverJakub Hrozek2012-08-161-45/+77
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
* Do not try to remove the temp login file if already renamedJakub Hrozek2012-08-161-2/+3
| | | | | | | | | write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
* Build SELinux code in responder conditionallyJakub Hrozek2012-08-161-0/+7
| | | | https://fedorahosted.org/sssd/ticket/1480
* Fix LOCAL domain lookupsPavel Březina2012-08-151-19/+22
| | | | | | https://fedorahosted.org/sssd/ticket/1436 Now subdomains are not evaluated for local domains.
* Remove SYSDB_SUDO_CACHE_OC from attribute listsPavel Březina2012-08-071-1/+0
| | | | It is not an attribute.
* Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina2012-08-071-1/+1
| | | | | It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
* Change subdomain_infoSimo Sorce2012-08-011-1/+1
| | | | | Rename the structure to use a standard name prefix so it is properly name-spaced, in preparation for changing the structure itself.
* Fix bad checkJakub Hrozek2012-08-011-1/+1
|
* Write SELinux config files in responder instead of PAM moduleJan Zeleny2012-07-271-5/+95
|
* Move SELinux processing from session to account PAM stackJan Zeleny2012-07-271-1/+2
| | | | | | | | | | | | | | The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
* NSS: Add override_shell optionStephen Gallagher2012-07-203-2/+18
| | | | | | | | | If override_shell is specified in the [nss] section, all users managed by SSSD will have their shell set to this value. If it is specified in the [domain/DOMAINNAME] section, it will apply to only that domain (and override the [nss] value, if any). https://fedorahosted.org/sssd/ticket/1087
* PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek2012-07-181-1/+1
|
* Fix uninitialized valuesNick Guay2012-07-183-5/+5
| | | | https://fedorahosted.org/sssd/ticket/1379
* Add newline to DEBUG messagesJakub Hrozek2012-07-121-2/+2
|
generated by cgit (git 2.34.1) at 2024-05-27 18:58:03 +0000