summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* IPA: try to resolve nested groups as poxix groupPavel Reichl2014-08-191-5/+201
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-08-191-3/+72
| | | | | | | | | | | | | | If an object can't be resolved as a posix group we then try to resolve it as a non-posix (without the gid attribute) nested group and store it as a group stub into the sysdb. The purpose is to be able to resolve nested posix groups which are members of non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: new attribute map for non-posix groupsPavel Reichl2014-08-196-5/+46
| | | | | | | | | Create new set of attributes to be used when processing non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* SYSDB: Clarify sss_ldb_modify_permissive returns ldb error codeJakub Hrozek2014-08-191-0/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Revert "SDAP: Deref needn't be treated as critical"Lukas Slebodnik2014-08-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fc8d98c9f0bb26de7be732c3e542b85c8abdba53. The reason why the control was marked critical is that we expect to get it back on reply, or it should fail. We should rather leave the criticality bit and handle the error (by downgrading to not use deref controls) if the server fails. In other words, we should not workaround bugs in any LDAP server. If server claim it support deref control, it should work with critical flag. sh-4.2$ ldapsearch -LLL -h 172.17.0.9 -x -b "" -s base supportedControl dn: supportedControl: 1.3.6.1.4.1.4203.666.5.16 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 sh-4.2$ grep "1.3.6.1.4.1.4203.666.5.16" /usr/include/ldap.h #define LDAP_CONTROL_X_DEREF "1.3.6.1.4.1.4203.666.5.16" sh-4.2$ ldapsearch -x -LLL -h 172.17.0.9 -b 'dc=example,dc=com' \ -E '!deref=member:cn,uid' \ cn=ref_grp1 cn,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: handle searches by SID in apply_subdomain_homedirJakub Hrozek2014-08-191-4/+9
| | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2391 apply_subdomain_homedir() didn't handle the situation where an entity that doesn't match was requested from the cache. For user and group lookups this wasn't a problem because the negative match was caught sooner. But SID lookups can match either user or group. When a group SID was requested, the preceding LDAP request matched the SID and stored the group in the cache. Then apply_subdomain_homedir() only tried to search user by SID, didn't find the entry and accessed a NULL pointer. A simple reproducer is: $ python >>> import pysss_nss_idmap >>> pysss_nss_idmap.getnamebysid(group_sid) The group_sid can be anything, including Domain Users (XXX-513) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: work with correct D-Bus iteratorPavel Březina2014-08-191-3/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_get_account_info change level of debug messageMichal Zidek2014-08-191-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: don't log error on access deniedPavel Reichl2014-08-171-1/+6
| | | | | | Don't log error if access is denied in function sdap_access_done(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: refactor sdap_access_filter_donePavel Reichl2014-08-171-18/+37
| | | | | | | | | | | | As preparation for ticket #2364 move code from sdap_access_filter_done() into sdap_access_done() to make its reuse possible and thus avoid code duplication. Rename check_next_rule() to sdap_access_check_next_rule(). Update definition order of tevent-using functions by time of execution. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: nitpicks in sdap_access_filter_get_access_donePavel Reichl2014-08-171-7/+5
| | | | | | Fixed typo and replaced duplicated string by macro definition. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: refactor sdap_access_filter_sendPavel Reichl2014-08-171-16/+30
| | | | | | | | | As preparation for ticket #2364 separate code for parsing user basedn to a new function sdap_get_basedn_user_entry(). We actually do not need to call strdup on basedn, instead we can just point to address in user_entry as it's allocated on parent memory context. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: split sdap_access_filter_get_access_donePavel Reichl2014-08-171-20/+39
| | | | | | | As a preparation for ticket #2364 separate code for storing user bool values into sysdb to a new function sdap_save_user_cache_bool(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BE: Handle SIGUSR2Jakub Hrozek2014-08-132-4/+28
| | | | | | | | | It was possible to send SIGUSR1 and to both sssd and sssd_be processes, but only possible to send SIGUSR2 to sssd. This patches fixes the dichotomy by making the sssd_be process handle SIGUSR2 as well. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
* TESTS: Add unit tests for the replace-space functionalityJakub Hrozek2014-08-131-0/+225
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SUDO: Use the override_space optionJakub Hrozek2014-08-132-2/+8
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 With this path, a user whose name is "space user" would match a sudo rule while using the override_default_space option. Please note that the option is only a client-side override, so the sudoUser attribute must contain the space in order to match the original name. In other words, when substituting space ( ) for underscore (_), this attribute would match: sudoUser: space user this would not: sudoUser: space_user Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Use the override_space optionJakub Hrozek2014-08-131-2/+51
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 The input of the InfoPipe responder substitutes the configured character for space and the GetUserAttrs and GetUserGroups functions substitute space for the configured character in their output. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Use the override_space optionJakub Hrozek2014-08-131-0/+8
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 When using the override_default_space option, this patch allows to log in using both the original name (space user) as well as the normalized name (space_user). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Make the space override responder-agnosticJakub Hrozek2014-08-138-32/+59
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 In order to make the override_space option usable by other responders, we need to move the override_space option to the generic responder structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Only replace space with the specified substitutionJakub Hrozek2014-08-1311-218/+110
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 - make sss_replace_whitespaces only replace space (' ') not any whitespace - make sss_replace_whitespaces only replace a single char, not the whole string - rename CONFDB_NSS_OVERRIDE_DEFAULT_WHITESPACE to CONFDB_NSS_OVERRIDE_DEFAULT_SPACE - rename the override_default_whitespace option to override_space - rename sss_replace_whitespaces() to sss_replace_space() - rename sss_reverse_replace_whitespaces() to sss_reverse_replace_space() - rename nctx->override_default_wsp_str to nctx->override_space - make the return value of sss_replace_space non-const to avoid freeing the result without compilation warnings Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: ad_gpo changes for offline gpo supportYassir Elley2014-08-131-23/+149
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: sysdb_gpo changes for offline gpo supportYassir Elley2014-08-132-2/+63
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Ignore default_domain for netgroupsJakub Hrozek2014-08-121-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2400 Netgroups often have members that will not process correctly when we require a fully-qualified name. This patch simply ignores the default_domain setting for netgroup lookups - we ignore FQDN only domains for netgroup lookups since 1933ff17513da1d979dd22776a03478341ef5e6b anyway. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: offline_timeoutMichal Zidek2014-08-121-4/+22
| | | | | | | | Amend the man page to reflect current behaviour. https://fedorahosted.org/sssd/ticket/2401 Reviewed-by: Dan Lavu <dlavu@redhat.com>
* TESTS: Check if option maps have the right number of membersJakub Hrozek2014-08-121-0/+84
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP SUDO: sudo provider doesn't fetch 'EntryUSN'Michal Šrubař2014-08-111-0/+1
| | | | | | | | | | The EntryUSN is not fetched by the sudo LDAP provider when it downloads the rules because sudorule_map is missing this attribute. We forgot to add the SDAP_AT_SUDO_RUNAS into sdap_sudorule_attrs when we added support for sudoRunAs. Related to: https://fedorahosted.org/sssd/ticket/2212
* IFP: Fix lookups with fully-qualified namesJakub Hrozek2014-08-111-2/+2
| | | | | | | | | | | | | The Data Provider lookup code user the original input string as the lookup key instead of the parsed name component. For example, for an input joe@mydomain, the backend would have searched for: (&(cn=joe@mydomain)(objectclass=user)) This patch fixes the lookup to use the parsed name. https://fedorahosted.org/sssd/ticket/2402 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* build: Don't install ad and ipa man pages unnecessarilyNikolai Kondrashov2014-08-101-1/+5
| | | | | | | Don't install sssd-ipa and sssd-ad man pages if corresponding providers weren't built (i.e. --without-samba was specified to configure). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Deref needn't be treated as criticalLukas Slebodnik2014-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The command line utility ldapsearch does not set option LDAP_CONTROL_X_DEREF as critical. sssd performes similar ldap search as following command: sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \ -b 'cn=ref_grp1,ou=qagroup,dc=example,dc=com' -E '!deref=member:objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid' \ objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context The most important is "exclamation mark" before extensions. It indicates criticality. This caused problem when openldap server was older openldap-2.4.23-34.el6. Dereference is performed successfully if extension is not critical: -E 'deref=member:objectClass ... Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad initgroups: continue if resolved SID is still missingPavel Březina2014-08-091-6/+13
| | | | | | https://fedorahosted.org/sssd/ticket/2389 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: krb5_pac_verify failures should not be fatalJakub Hrozek2014-08-061-1/+10
| | | | | | | | | As noted in the MIT KRB5 documentation, some servers send PAC with no checksum, therefire the PAC validation should not be fatal, instead, we should treat a failure from krb5_pac_verify as if there was no PAC at all. Reported on sssd-devel by Thomas Sondergaard
* UTIL: remove get_username_from_uidJakub Hrozek2014-08-062-14/+0
| | | | | | The function was unused since 2009 and moreover it was synchronous. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Avoid undefined ret valueJakub Hrozek2014-08-061-1/+1
| | | | | | | | | | If the LDAP schema was set to a different value than AD and ID mapping was enabled, the value of ret was not defined. Make sure we define ret for the condition below with the default for ID mapping which is 'no GID' Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Dump LDAP server IP address with a high DEBUG levelJakub Hrozek2014-08-051-0/+36
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Print referrals for debugging purposesJakub Hrozek2014-08-051-1/+10
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD-GPO: add ad_gpo_cache_timeout optionYassir Elley2014-07-3110-107/+259
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: set port status to not working if previous srv lookup failedPavel Březina2014-07-311-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The meta server status consists of two parts: A) port status - managed by failover mechanism B) SRV lookup status - managed by SRV resolver Both parts are resetted to "neutral" after some time, having B timeout greater than A timeout. We were hitting the following issue: 1. SRV lookup fails (DNS is not reachable), this will set A to "not working and B to "resolve error". Then the next server is tried but fails as well. 2. If SSSD tries to go back online the failover will set A to "neutral" and it will try to resolve SRV again. But B status is still set to "resolve error" since we haven't reached the timeout yet and SRV resolution fails immediately. But the next server is not tried since the port status (A) remains "neutral". This patch sets the port status to "not working" making the failover to continue with the next server as expected. https://fedorahosted.org/sssd/ticket/2390 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Exit offline mode only if server is available.Michal Zidek2014-07-312-17/+52
| | | | | | | | | | | | | | | | | | | | | This patch adds periodic check to test if backend can exit offline mode and only marks backend as not offline if server for the service is available. Prior to this patch we marked backend as not offline if the offline_timeout was reached without checking for the server availability and when the next request failed again we switched back to the offline mode. This caused significant slowdowns in some edge cases. Fixes: https://fedorahosted.org/sssd/ticket/2355 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Add backoff feature to the ptask api.Michal Zidek2014-07-315-3/+37
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Allow adding random_offset to scheduled execution timeMichal Zidek2014-07-315-5/+22
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AD-GPO: only download policy files if gpo version changesYassir Elley2014-07-302-197/+560
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: add sysdb_gpo support for caching gpo versionYassir Elley2014-07-302-0/+290
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Move libini_config 1.1.0 check to libini_config.m4Nikolai Kondrashov2014-07-292-2/+16
| | | | | | | | | Move the check for libini_config >= 1.1.0 from samba.m4 to libini_config.m4 to have them all in one place, simplifying maintenance. Set boolean variables for every detected version and use one of them in samba.m4 instead. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Reverse order of libini_config checksNikolai Kondrashov2014-07-292-26/+24
| | | | | | | | | | | | Check for lowest versions of libini_config first, instead of the highest ones in libini_config.m4. Define HAVE_LIBINI_CONFIG_V* for lower versions when higher versions are present. Simplify preprocessor branching in sss_ini.c accordingly. This prepares libini_config.m4 for addition of a check for one more version of libini_config. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Distinguish libnl version checksNikolai Kondrashov2014-07-291-2/+7
| | | | | | | | | | Use separate shell variable name prefixes for checks of separate libnl versions, as repeated invocations of PKG_CHECK_MODULES with the same prefix are not generally supposed to have an effect. This prevents bugs similar to https://fedorahosted.org/sssd/ticket/2388 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Distinguish libini_config version checksNikolai Kondrashov2014-07-292-3/+7
| | | | | | | | | | | | | | | | | | Use separate shell variable name prefixes for checks of separate libini_config versions, as repeated invocations of PKG_CHECK_MODULES with the same prefix are not generally supposed to have an effect. Otherwise only the checks before and including the first one defining both *_CFLAGS and *_LIBS variables will be done and all that follow will assume success. This happens on RHEL6.5, where both "pkg-config --cflags" and "pkg-config --libs" for ini_config produce non-empty output and successful check for v0.6.1 results in incorrectly successful check for v1.1.0. Resolves: https://fedorahosted.org/sssd/ticket/2388 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Mention required libini_config versionNikolai Kondrashov2014-07-291-6/+6
| | | | | | | Specify minimum required libini_config version in a message in samba.m4 explaining the need for the library. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: Remove substitution of *_OBJ variablesNikolai Kondrashov2014-07-2912-15/+0
| | | | | | | Remove substitution of *_OBJ variables (e.g. POPT_OBJ or PCRE_OBJ) from configure scripts as they don't seem to be set or used by anything. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: replace asterisk with escape sequence in host filterPavel Březina2014-07-291-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2377 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove unused function confdb_set_boolMichal Zidek2014-07-292-80/+0
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-09 22:27:24 +0000