summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* sudo: do not send domain name with usernamePavel Březina2012-11-145-22/+11
| | | | | | | | This caused troubles with subdomain users and it is not really necessary. This patch does not change the protocol itself, that should be done on the earliest possible occasion. Part of https://fedorahosted.org/sssd/ticket/1616
* sudo: support users from subdomainsPavel Březina2012-11-144-60/+214
| | | | https://fedorahosted.org/sssd/ticket/1616
* use tmp_ctx in sudosrv_get_sudorules_from_cache()Pavel Březina2012-11-141-8/+20
|
* sudo: fix missing parameter in two debug messagesPavel Březina2012-11-141-3/+3
|
* subdomains: check request type on one place onlyPavel Březina2012-11-141-6/+0
| | | | The check is now held only in ipa_get_subdomain_account_info_send().
* Run IPA subdomain provider if IPA ID provider is configuredSumit Bose2012-11-144-7/+101
| | | | | | | | | | | | | | | | | | | | | | | | To make configuration easier the IPA subdomain provider should be always loaded if the IPA ID provider is configured and the subdomain provider is not explicitly disabled. But to avoid the overhead of regular subdomain requests in setups where no subdomains are used the IPA subdomain provider should behave differently if configured explicit or implicit. If the IPA subdomain provider is configured explicitly, i.e. 'subdomains_provider = ipa' can be found in the domain section of sssd.conf subdomain request are always send to the server if needed. If it is configured implicitly and a request to the server fails with an indication that the server currently does not support subdomains at all, e.g. is not configured to handle trust relationships, a new request will be only send to the server after a long timeout or after a going-online event. To be able to make this distinction this patch save the configuration status to the subdomain context. Fixes https://fedorahosted.org/sssd/ticket/1613
* Always start PAC responder if IPA ID provider is configuredSumit Bose2012-11-143-0/+84
| | | | | | | | Since the PAC responder is used during the authentication of users from trusted realms it is started automatically if the IPA ID provider is configured for a domain to simplify the configuration. Fixes https://fedorahosted.org/sssd/ticket/1613
* Add string_in_list() and add_string_to_list() with testsSumit Bose2012-11-143-0/+152
| | | | | | | | string_in_list() and add_string_to_list() are two utilities for NULL terminated strings arrays. add_string_to_list() adds a new string to an existing list or creates a new one with the strings as only item if there is not list. string_in_list() checks if a given string is in the list. It can be used case sensitive or in-sensitive.
* Store the original group DN in the subdomain user objectSumit Bose2012-11-121-26/+58
| | | | | | | | | | | For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
* Get lists of GIDs to be added and deleted and use themSumit Bose2012-11-121-3/+89
| | | | | | | Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
* Add pac_user_get_grp_info() to read current group membershipsSumit Bose2012-11-122-0/+107
| | | | | | | | | | | | To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
* Add diff_gid_lists() with testSumit Bose2012-11-123-2/+279
| | | | | | | | This patch adds a new call which compares a list of current GIDs with a list of new GIDs and return a list of GIDs which are currently missing and must be added and another list of GIDs which are not used anymore and must be deleted. The method is the same as used by diff_string_lists().
* Do not remove a group if it has members from subdomainsSumit Bose2012-11-121-4/+15
| | | | | | | Currently it is only checked if an expired group still has members of the local domain. If not, the group is delete from the cache. With this patch the whole cache, i.e. including subdomains, is searched for members.
* Clarify debug message about initgroups and subdomainsSumit Bose2012-11-121-0/+7
| | | | | | | | | | | | | | | | The initgroups request is not handled by the IPA provider for subdomain users on purpose because the group membership information is not available on the IPA server but will be directly written to the cache when the PAC of the user is processed. The old generic debug message "Invalid sub-domain request type" might be misleading. This patch adds a specific message for the initgroups case "Initgroups requests are not handled by the IPA provider but are resolved by the responder directly from the cache." and increase the debug level so that typically this message is not shown anymore because it is expected behaviour. Fixes https://fedorahosted.org/sssd/ticket/1610
* sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina2012-11-121-1/+2
| | | | | | | If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
* util_lock.c: sss_br_lock_file accepted invalid parameter valueMichal Zidek2012-11-112-3/+7
| | | | | | Return EINVAL if number of tries is <= 0. Also the parameter retries was renamed to num_tries, so it is more obvious that it also includes the first try.
* SSSDConfig: Locate the force_timeout option in the correct sectionsStephen Gallagher2012-11-112-1/+4
|
* MAN: Specify the correct location for the force_timeout optionStephen Gallagher2012-11-111-16/+32
|
* Monitor: Better debugging for ping timeoutsStephen Gallagher2012-11-111-0/+8
|
* sss_cache: Remove fastcache even if sssd is not running.Michal Zidek2012-11-064-23/+175
| | | | https://fedorahosted.org/sssd/ticket/1584
* util: Added new file util_lock.cMichal Zidek2012-11-062-0/+87
|
* sss_cache: Multiple domains not handled properlyMichal Zidek2012-11-061-35/+37
| | | | | | | | | | When working with multiple domains and no matching objects for deletion were found in the first domain, the other domains were not searched at all. Also the ERROR message informing about object not found (the one printed for each domain) was changed to DEBUG message.
* create pid file immediately after fork againPavel Březina2012-11-061-25/+4
| | | | | | | | | | | | Related to https://fedorahosted.org/sssd/ticket/1357 We realized that sysv and systemd does not use pid file existence as a notification of finished initialization. Therefore, we create the pid file in server_setup() again. We are removing check_file() from monitor main(), it is handled by server_setup() during pid file creation. This check was previously included in e7dd2a5102ba6cfd28be6eccdd62768e9758d9f4.
* exit original process after sssd is initializedPavel Březina2012-11-063-2/+56
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1357 Neither systemd or our init script use pid file as a notification that sssd is finished initializing. They will continue starting up next service right after the original (not daemonized) sssd process is terminated. If any of the responders fail to start, we will never terminate the original process via signal and "service sssd start" will hang. Thus we take this as an error and terminate the daemon with a non-zero value. This will also terminate the original process and init script or systemd will print failure.
* make monitor_quit() usable outside signal handlerPavel Březina2012-11-061-14/+26
|
* fix indendation, coding style and debug levels in server.cPavel Březina2012-11-061-110/+114
|
* add SSSDBG_IMPORTANT_INFO macroPavel Březina2012-11-061-0/+1
| | | | | | | We currently have only SSSDBG_FATAL_FAILURE macro that corresponds to original debug level 0. But there are several level 0 messages that are not actually failures but an important information. We should use this new macro to represent them.
* LDAP: Fix off-by-one error when saving ghost usersJakub Hrozek2012-11-061-1/+1
| | | | | | | | The ldb_val's length parameter should not include the terminating NULL. This was causing funky behaviour as the users were saved as binary attributes. https://fedorahosted.org/sssd/ticket/1614
* PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek2012-11-051-0/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
* Monitor: read the correct SIGKILL timeout for providers, tooJakub Hrozek2012-11-051-33/+41
| | | | https://fedorahosted.org/sssd/ticket/1602
* authconfig: allow chpass_provider = proxyPavel Březina2012-11-052-1/+4
| | | | https://fedorahosted.org/sssd/ticket/1611
* Free the internal DP requestJakub Hrozek2012-11-051-0/+8
|
* Make sub-domains case-insensitiveSumit Bose2012-11-052-3/+24
| | | | | | | | | | Currently the only type of supported sub-domains are AD domains which are not case-sensitive. To make it easier for Windows user we make sub-domains case-insensitive as well which allows to write the username in any case at the login prompt. If support for other types of sub-domains is added it might be necessary to set the case-sensitive flag based on the domain type.
* sss_parse_name_for_domains: always return the canonical domain nameSumit Bose2012-11-051-2/+7
| | | | | | Domains may have a flat or short name to save some keystrokes when typing fully qualified user names. Internally sssd will always use the canonical name to allow consistent processing.
* krb5_auth: update with correct UPN if neededSumit Bose2012-11-053-0/+133
| | | | | | | | | The Active Directory KDC handles request case in-sensitive and it might not always to possible to guess the UPN with the correct case. We check if the returned principal has a different case then the one used in the request and updates the principal if needed. This will help using calls from the Kerberos client libraries later on which would otherwise fail because the principal is handled case sensitive by those libraries.
* Use find_or_guess_upn() where neededSumit Bose2012-11-056-36/+52
|
* Add new call find_or_guess_upn()Sumit Bose2012-11-054-8/+54
| | | | | | | | | With the current approach the upn was either a pointer to a const string in a ldb_message or a string created with the help of talloc. This new function always makes it a talloc'ed value. Additionally krb5_get_simple_upn() is enhanced to handle sub-domains as well.
* krb5_child: send back the client principalSumit Bose2012-11-054-5/+42
| | | | | | | | | | | | | In general Kerberos is case sensitive but the KDC of Active Directory typically handles request case in-sensitive. In the case where we guess a user principal by combining the user name and the realm and are not sure about the cases of the letters used in the user name we might get a valid ticket from the AD KDC but are not able to access it with the Kerberos client library because we assume a wrong case. The client principal in the returned credentials will always have the right cases. To be able to update the cache user principal name the krb5_child will return the principal for further processing.
* krb5_mod_ccname: replace wrong memory contextSumit Bose2012-11-051-1/+1
|
* krb5_child: send PAC to PAC responderSumit Bose2012-11-051-1/+139
| | | | | | If the authenticated user comes from a different realm the service ticket which was returned during the validation of the TGT is used to extract the PAC which is send to the pac responder for evaluation.
* krb5_auth: send different_realm flag to krb5_childSumit Bose2012-11-052-1/+8
| | | | | | | The different_realm flag which was set by the responder is send to the krb5_child so that it can act differently on users from other realms. To avoid code duplication and inconsistent behaviour the krb5_child will not set the flag on its own but use the one from the provider.
* krb5_auth: check if principal belongs to a different realmSumit Bose2012-11-055-0/+88
| | | | | | Add a flag if the principal used for authentication does not belong to our realm. This can be used to act differently for users from other realms.
* Add replacement for krb5_find_authdata()Sumit Bose2012-11-053-0/+20
| | | | | | | | | krb5_find_authdata() is only available in MIT Kerberos 1.10 or higher. To allow sssd to be compiled on platform with lower version of MIT Kerberos a replacement call is added. Please note that on those platform the replacement call will only return an error. If the krb5_find_authdata functionality is really needed on those platform it must be implemented by a different patch.
* check_ccache_files: search sub-domains as wellSumit Bose2012-11-051-4/+14
| | | | | If sssd is configured to renew Kerberos tickets automatically ticket of sub-domain uses should be renewed as well.
* sysdb: add sysdb_base_dn()Sumit Bose2012-11-052-0/+5
| | | | | Add a help function which returns the ldb_dn object for the base dn of the cache.
* krb5_auth_send: check for sub-domainsSumit Bose2012-11-054-11/+37
| | | | | | If there is an authentication request for a user from a sub-domain a temporary sysdb context is generated to allow lookups in the corresponding sub-tree in the cache.
* pac responder: add user principal and name alias to cached user objectSumit Bose2012-11-053-4/+46
| | | | | | | The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
* pac responder: use only lower case user nameSumit Bose2012-11-052-5/+15
| | | | | Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
* sysdb: look for ranges in the parent treeSumit Bose2012-11-051-1/+4
| | | | | | Make sure the right sub-tree in the cache is used to search for ranges. Sub-domain trees do not have range objects only the tree of the parent domain.
* pac responder: fix copy-and-paste errorSumit Bose2012-11-051-7/+0
| | | | This error prevent proper id-mapping in the PAC responder.
generated by cgit (git 2.34.1) at 2024-11-19 02:57:57 +0000