summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
* New utility function sss_get_domain_nameJakub Hrozek2013-06-072-19/+10
| | | | | Instead of copying a block of code that checks whether domain is a subdomain and uses only name of FQDN as appropriate, wrap the logic into a function.
* Enhance PAC responder for AD usersSumit Bose2013-06-063-927/+659
| | | | | | | | | | | This patch modifies the PAC responder so that it can be used with the AD provider as well. The main difference is that the POSIX UIDs and GIDs are now lookup up with the help of the SID instead of being calculated algorithmically. This was necessary because the AD provider allows either algorithmic mapping or reading the value from attributes stored in AD. Fixes https://fedorahosted.org/sssd/ticket/1558
* Lookup domains at startupSumit Bose2013-06-048-0/+89
| | | | | | | | | | | | To make sure that e.g. the short/NetBIOS domain name is available this patch make sure that the responders send a get_domains request to their backends at startup the collect the domain information or read it from the cache if the backend is offline. For completeness I added this to all responders even if they do not need the information at the moment. Fixes https://fedorahosted.org/sssd/ticket/1951
* Remove branching to improve readabilityJakub Hrozek2013-05-301-23/+11
|
* Allow flat name in the FQname formatJakub Hrozek2013-05-301-3/+3
| | | | | | | https://fedorahosted.org/sssd/ticket/1648 Adds another expansion in the printf format that allows the user to use the domain flat name in the format.
* Add utility functions for formatting fully-qualified namesJakub Hrozek2013-05-303-34/+22
| | | | | | Instead of using printf-like functions directly, provide two wrappers that would encapsulate formatting the fully-qualified names. No functional change is present in this patch.
* Fixing critical format string issues.Lukas Slebodnik2013-05-207-14/+25
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* sudo responder: search rules for subdomains in parent domain subtreePavel Březina2013-05-101-0/+5
| | | | | | | | https://fedorahosted.org/sssd/ticket/1912 SUDO rules are stored under cn=ipa.domain,cn=sysdb tree but sobdomains users are in cn=sub.domain,cn=sysdb. When we search for rules for subdomain users we have to switch domain context to parent.
* Add missing \n to debug stringSumit Bose2013-05-101-1/+1
|
* SSH: Do not skip domains with use_fully_qualified_names in host key requestsJan Cholasta2013-05-071-6/+0
|
* SSH: Use separate field for domain name in client requestsJan Cholasta2013-05-071-27/+64
| | | | | Instead of appending @domain to names when the --domain option of sss_ssh_* is used, put domain name in a separate field in client requests.
* SSH: Fix parsing of names from client requestsJan Cholasta2013-05-073-3/+30
| | | | | | Try to parse names in the form user@domain first, as that's what sss_ssh_* send in requests when the --domain option is used. Do not parse host names using domain-specific regular expression.
* Add SID related calls to the NSS responderSumit Bose2013-05-032-3/+795
| | | | | | | | | | The patch adds 4 new calls to the NSS responder: - SSS_NSS_GETSIDBYNAME - SSS_NSS_GETSIDBYID - SSS_NSS_GETNAMEBYSID - SSS_NSS_GETIDBYSID to either return the SIDs of the requested object or map the SID to the name or the POSIX ID of the related object.
* Add sss_ncache_set_sid() and sss_ncache_check_sid()Sumit Bose2013-05-022-0/+31
| | | | | Two new calls are added to allow to add SID based lookups to the negative cache.
* Add responder_get_domain_by_id()Sumit Bose2013-05-022-0/+52
| | | | | | | | | | | This new call is similar to responder_get_domain() but uses the domain SID as search parameter. Since the length of the stored domain SID is used in the comparison, SIDs of users and groups and be used directly without stripping the RID component. The functionality is not merged into responder_get_domain() to allow to calculate the timeout correctly and return a specific error code if the entry is expired.
* Add idmap context to nss contextSumit Bose2013-05-022-0/+22
| | | | | This allows the nss responder to use libsss_idmap to convert between different SID representations.
* Add two new request types to the data-provider interfaceSumit Bose2013-05-022-1/+9
| | | | | | | The patch adds two new request types for SID related requests. The first one is used if a SID is given and the corresponding object should be found. The second one can be used if the SID for an object is requested but it is not clear if the object is a user or a group.
* Add secid filter to responder-dp protocolSumit Bose2013-05-021-4/+14
| | | | | This patch add a new filter type to the data-provider interface which can be used for SID-based lookups.
* responder_get_domain(): remove timeout calculationSumit Bose2013-05-021-10/+1
| | | | | | | The current timout calculation code in responder_get_domain() is flawed and I think it always was. I removed the related code because - it currently has no effect, a match is returned even if it is expired - that callers do not have any code to handle expired domains.
* responder_get_domain: do not return disabled domainsSumit Bose2013-05-021-0/+4
| | | | | | Recent refactoring introduced to concept of disabled domains, i.e. domains which does not exists anymore. responder_get_domain() should not return disabled domains.
* Remove unused TALLOC_CTX from responder_get_domain()Sumit Bose2013-05-0211-20/+16
| | | | | | Recent refactoring removed the need to copy the domain info data of sub-domains because the related objects will not be removed from memory anymore.
* DB: Switch to new libini_config APIOndrej Kos2013-04-262-2/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1786 Since we need to support the old interface as well, the configure scritp is modified and correct ini interface is chosen.
* Refactoring: remove duplicated code in nss responderSumit Bose2013-04-212-622/+240
| | | | | Different user and group lookup requests used nearly identical code, this patch unifies some of the related code paths.
* Fix and rename get_my_domain_data()Sumit Bose2013-04-213-12/+14
| | | | | | | | | | | | | | | | | The task of get_my_domain_data() is to read some information about the configured domain from the cache. While the sysdb interface was redesigned some changes changed the behaviour so that the data of the domain of the current request was read. If this domain is a sub-domain the wrong data was read. As a result group-memberships of the configured domain were not taken into account. The original code didn't made it easy to see that always the parent domain should be used here, because there was no comment indication this and the function name get_my_domain_data() didn't made it clear either. Additionally to fixing the issue this patch also adds a comment and rename the function to get_parent_domain_data(). Fixes https://fedorahosted.org/sssd/ticket/1888
* Inform about function duplication.Michal Zidek2013-04-171-0/+3
| | | | | | | | | | | | | | | sss_mc_set_recycled is a static function, that should not be used outside nsssrv_mmap_cache.c. The sss_cache tool is an exception, because in the case when sssd is not running, sss_cache must invalidate the memory cache file. That is why sss_mc_set_recycled was copied to the tools_mc_util.c (as helper function for sss_memcache_invalidate function). It was duplicated to allow this function to remain static (and invisible to any .h files), so that it is not used anywhere else. Wrong usage of this function might cause race conditions and corrupt the cache. I'll add comments about the duplication to the code.
* Allow using flatname for subdomain home dir templateJakub Hrozek2013-04-102-5/+7
| | | | https://fedorahosted.org/sssd/ticket/1609
* Allocate PAM DP request data on responder contextJakub Hrozek2013-04-083-5/+54
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1869 Currently the private data passed to the PAM request is a structure allocated on the client context. But in the odd case where the back end would be stopped or stuck until the idle timeout hits, the DP callback would access data that were freed when the client timed out. This patch introduces a new structure allocated on responder context, whose only purpose is to live as long as the request is active.
* Check for correct variable nameJakub Hrozek2013-04-031-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1864
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-022-14/+12
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-021-1/+1
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* coding style fixPavel Březina2013-03-201-1/+1
|
* change responder contexts hierarchyPavel Březina2013-03-206-65/+94
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1575 The hierarchy is now: main_ctx -> responder_ctx -> specific_ctx where specific_ctx is one of sudo, pam, etc.
* do not leak memory on failure in *_process_init()Pavel Březina2013-03-207-35/+62
|
* Move SELinux processing to provider.Michal Zidek2013-03-191-309/+0
| | | | | | | | | | | | The SELinux processing was distributed between provider and pam responder which resulted in hard to maintain code. This patch moves the logic to provider. IT ALSO REQUIRES CHANGE IN THE SELINUX POLICY, because the provider also writes the content of selinux login file to disk (which was done by responder before). https://fedorahosted.org/sssd/ticket/1743
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-191-1/+0
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Move sss_cmd_execute from client to responder code.Jakub Hrozek2013-03-083-7/+15
| | | | | I think it logically belongs there and allows to better exercise the responder commands from unit tests.
* Debug message in sss_mc_create_file.Michal Zidek2013-03-071-0/+5
| | | | | | This patch adds debug message for the case if sssd fails to open old mc file for some other reason than the file does not exist.
* File descriptor leak in nss responder.Michal Zidek2013-03-071-18/+43
| | | | | | | | | File descriptors leaked every time sss_mmap_cache_reinit was called and also the old memory cache was still maped in memory (munmap was not called). This patch adds destructor for memory cache context to call close() and munmap() automaticly. https://fedorahosted.org/sssd/ticket/1826
* Removing unused parameter type from sudosrv_get_sudorules_query_cache()Lukas Slebodnik2013-03-071-6/+4
| | | | https://fedorahosted.org/sssd/ticket/1825
* Remove the alt_db_path parameter of sysdb_initMichal Zidek2013-03-051-1/+1
| | | | | | This parameter was never used. https://fedorahosted.org/sssd/ticket/1765
* Use the same dbg level for all ncache hits.Michal Zidek2013-03-042-21/+28
| | | | | | | | | We used different debug levels for messages informing about negative cache hits (old levels 2,3,4). Now it is only SSSDBG_TRACE_FUNC (same level is used in nsssrv_services.c and proposed in the ticket bellow). https://fedorahosted.org/sssd/ticket/1771
* Remove unused functionsJakub Hrozek2013-03-044-36/+0
|
* autofs: fix invalid header 'number of entries' in packetPavel Březina2013-03-011-1/+5
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1739 Pointer to packet body may change while filling packet with autofs mount points. As a consequence, we sometimes wrote the number of entries into invalid body and we recieved an arbitrary number on the client side. If the number was 0, there were some skipped entries. If the number was greater than 0, everything worked correctly, because we iterate through the cached entries until we reach packet length - we don't compare to the number.
* if selinux is disabled, ignore that selogin dir is missingPavel Březina2013-02-261-3/+15
| | | | https://fedorahosted.org/sssd/ticket/1817
* Fix uninitialized time_t var in responderOndrej Kos2013-02-211-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1810
* Lower the DEBUG level if an entry cannot be deleted from memcacheJakub Hrozek2013-02-141-3/+3
|
* Introduce IS_SUBDOMAIN() macroSimo Sorce2013-02-104-8/+8
| | | | Fixes https://fedorahosted.org/sssd/ticket/1766
* Parent and subdomains use the same sysdbSimo Sorce2013-02-102-71/+8
| | | | | | Remove code that tries to get the 'right' sysdb, as it is always going to get the same answer anyway since the recent patches to rework the domains/sysdb relationship.
* Change the way domains are linked.Simo Sorce2013-02-103-78/+32
| | | | | | | | | | | | | | | | | | | - Use a double-linked list for domains and subdomains. - Never remove a subdomain, simply mark it as disabled if it becomes unused. - Rework the way subdomains are refreshed. Now sysdb_update_subdomains() actually updates the current subdomains and marks as disabled the ones not found in the sysdb or add new ones found. It never removes them. Removal of missing domains from sysdb is deferred to the providers, which will perform it at refresh time, for the ipa provider that is done by ipa_subdomains_write_mappings() now. sysdb_update_subdomains() is then used to update the memory hierarchy of the subdomains. - Removes sysdb_get_subdomains() - Removes copy_subdomain() - Add sysdb_subdomain_delete()
* Add function get_next_domain()Simo Sorce2013-02-1011-101/+83
| | | | | | | Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
generated by cgit (git 2.34.1) at 2024-05-08 13:23:28 +0000