summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
...
* RESPONDERS: Create a common file with service names and versionsJakub Hrozek2012-12-1810-16/+49
| | | | | | | The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
* AUTOFS: remove all maps from hash if request for auto.master comes inJakub Hrozek2012-12-182-3/+59
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1592 When a request for auto.master comes in, we need to remove all the maps from the lookup hash table. We can't simply delete the maps, because another request might be processing them, so instead the maps are removed from the hash table, effectively becoming orphaned. The maps will get freed when the timed destructor is invoked.
* AUTOFS: allow removing entries from hash tableJakub Hrozek2012-12-183-1/+32
| | | | | | | | | There is a timed desctructor in the autofs responder that, when the entry timeout passes, removes the autofs map from the hash table while the map is freed. This patch adds a hash delete callback so that if the map is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
* sssd_pam: Cleanup requests cache on sbus reconectSimo Sorce2012-12-141-1/+4
| | | | | | | | | The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
* Allow mmap calls to gracefully return absent ctxSimo Sorce2012-12-141-0/+25
| | | | | This is to allow to freely call mc functions even if initialization failed. They will now gracefully fail instead of segfaulting.
* sssd_nss: Remove entries from memory cache if not found in sysdbMichal Zidek2012-12-131-0/+23
| | | | | Functions nss_cmd_getXXnam remove entries from memory cache if not found in sysdb cache of a local domain.
* NSS: Fix the error handler in sss_mc_create_fileJakub Hrozek2012-12-111-10/+16
| | | | | | | https://fedorahosted.org/sssd/ticket/1704 The function is short enough so that we can simply stick with return and release resources before returning as appropriate.
* PAC: check the return value of diff_git_listsJakub Hrozek2012-12-101-0/+4
|
* SSH: Reject requests for authorized keys of rootJan Cholasta2012-12-101-0/+5
| | | | https://fedorahosted.org/sssd/ticket/1687
* sudo: print rule name if notBefore or notAfter attribute is missingPavel Březina2012-12-061-1/+1
| | | | | | | | | | | ...and if sudo_timed = true. https://fedorahosted.org/sssd/ticket/1688 A comma was missing in attribute list. This caused concatenation of the two attributes so we requested one attribute called "objectClasscn". This doesn't affect functionality, only debug messages.
* Always append rctx as private dataSimo Sorce2012-12-051-1/+1
| | | | This is used for the new calls back from the data provider.
* Hook for mmap cache update on initgroup callsSimo Sorce2012-12-053-0/+147
| | | | | This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
* Hook to perform a mmap cache update from sssd_nssSimo Sorce2012-12-053-0/+118
| | | | | This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
* mmap cache: public functions to invalidate recordsSimo Sorce2012-12-052-0/+135
| | | | | | These functions can be called from the nss responder to invalidate records that have ceased to exist or that need to be refreshed the first time an application needs them.
* NSS: Fix netgroup midpoint cache refreshJakub Hrozek2012-12-043-3/+3
| | | | | | | | https://fedorahosted.org/sssd/ticket/1683 The result of the percent calculation was always 0 as it used plain ints. The patch switches to using explicit floats to avoid reintroducing the bug again even with brackets.
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-201-1/+1
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
* Refactor the way subdomain accounts are savedSimo Sorce2012-11-194-29/+53
| | | | | | | | | | | | | | | | | The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
* Display more information on DB version crashOndrej Kos2012-11-191-0/+1
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1589 Added check for determining, whether database version is higher or lower than expected. To distinguish it from other errors it uses following retun values (further used for appropriate error message): EMEDIUMTYPE for lower version than expected EUCLEAN for higher version than expected When SSSD or one of it's tools fails on DB version mismatch, new error message is showed suggesting how to proceed.
* SUDO: Fix wrong variable checkJakub Hrozek2012-11-191-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1650
* sudo: print how many rules we are refreshing or returningPavel Březina2012-11-141-3/+4
|
* sudo: do not send domain name with usernamePavel Březina2012-11-143-6/+5
| | | | | | | | This caused troubles with subdomain users and it is not really necessary. This patch does not change the protocol itself, that should be done on the earliest possible occasion. Part of https://fedorahosted.org/sssd/ticket/1616
* sudo: support users from subdomainsPavel Březina2012-11-144-60/+214
| | | | https://fedorahosted.org/sssd/ticket/1616
* use tmp_ctx in sudosrv_get_sudorules_from_cache()Pavel Březina2012-11-141-8/+20
|
* sudo: fix missing parameter in two debug messagesPavel Březina2012-11-141-3/+3
|
* Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek2012-11-121-17/+12
|
* Store the original group DN in the subdomain user objectSumit Bose2012-11-101-26/+58
| | | | | | | | | | | For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
* Get lists of GIDs to be added and deleted and use themSumit Bose2012-11-101-3/+89
| | | | | | | Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
* Add pac_user_get_grp_info() to read current group membershipsSumit Bose2012-11-101-0/+106
| | | | | | | | | | | | To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
* Add diff_gid_lists() with testSumit Bose2012-11-102-0/+172
| | | | | | | | This patch adds a new call which compares a list of current GIDs with a list of new GIDs and return a list of GIDs which are currently missing and must be added and another list of GIDs which are not used anymore and must be deleted. The method is the same as used by diff_string_lists().
* sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina2012-11-081-1/+2
| | | | | | | If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
* sss_cache: Remove fastcache even if sssd is not running.Michal Zidek2012-11-061-3/+23
| | | | https://fedorahosted.org/sssd/ticket/1584
* PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek2012-11-011-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
* Free the internal DP requestJakub Hrozek2012-10-291-0/+8
|
* pac responder: add user principal and name alias to cached user objectSumit Bose2012-10-263-4/+46
| | | | | | | The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
* pac responder: use only lower case user nameSumit Bose2012-10-262-5/+15
| | | | | Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
* pac responder: fix copy-and-paste errorSumit Bose2012-10-261-7/+0
| | | | This error prevent proper id-mapping in the PAC responder.
* Fix two errors in the nss responderSumit Bose2012-10-231-1/+3
| | | | | | | | | One is a copy-and-paste error which was introduce by 1774ee9a61b9d691dadd1a0538f32bcdcc84f72f. The second fixes a missing explicit setting of the return value. In the case where we want fully qualified names ret contains the number of characters from the last snprintf() which is almost ever not 0.
* Allow setting the default_shell option per-domain as wellJakub Hrozek2012-10-181-1/+3
| | | | https://fedorahosted.org/sssd/ticket/1583
* Check for subdomains if getpwuid or getgrgid are the first requestsSumit Bose2012-10-121-0/+72
| | | | Fixes https://fedorahosted.org/sssd/ticket/1561
* Save time of last get_domains requestSumit Bose2012-10-121-0/+16
|
* Fix memory hierarchy in subdomains discoveryJakub Hrozek2012-10-111-116/+160
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1571 The patch changes the subdomains discovery to use the tevent_req style. Previously, the code violated several rules which made the code very unreadable and led to memory hierarchy issues and use-after-free errors.
* nss_cmd_retpwent(): do not go into infinite loop if n < 0Pavel Březina2012-10-111-0/+8
| | | | https://fedorahosted.org/sssd/ticket/1551
* do not call dp callbacks when responder is shutting downPavel Březina2012-10-113-0/+25
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
* Fix typosYuri Chornoivan2012-10-092-2/+2
|
* Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek2012-10-091-1/+2
|
* SSH: Expire hosts in known_hostsJan Cholasta2012-10-053-1/+21
|
* SSH: Refactor sysdb and related codeJan Cholasta2012-10-052-73/+52
|
* Fix few coding style issuesPavel Březina2012-10-021-1/+1
|
* Use flat name for master domain as wellSumit Bose2012-10-012-1/+18
|
* Add new option default_domain_suffixSumit Bose2012-10-0110-24/+65
|
generated by cgit (git 2.34.1) at 2024-05-06 02:39:40 +0000