summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* TESTS: Add a case-insensitive group search sysdb testJakub Hrozek2014-09-171-8/+25
| | | | | | | A recent fix enabled searching for groups by name in a case-insensitive domain. This patch adds a unit test to check that behaviour. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: sysdb_search_group_by_name should work like sysdb_search_user_by_nameSumit Bose2014-09-171-43/+42
| | | | | | | | | | | | Currently sysdb_search_group_by_name uses an optimization which might fail in case-insensitive environments. The DN of the group object is generated with the help of the given name. Since the DN is case-sensitive a group lookup will fail if different cases are used. sysdb_search_user_by_name already handles case-insensitive searches well and sysdb_search_group_by_name should use the same scheme. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Write additional attrs in sysdb_add_userDaniel Gollub2014-09-171-1/+2
| | | | | | | | In the uid=0 case (to obtain new free id) only uidNumber and gidNumber attributes got written, but not the additonal provided attributes like alias or others. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free retrieved sid in test_getsidbynameNikolai Kondrashov2014-09-161-1/+5
| | | | | | Free sid retrieved with sss_nss_getsidbyname in test_getsidbyname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free link paths in symlink testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | | Free malloc'd symlink paths in test_symlink and test_follow_symlink tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free compiled regexes in krb5_utils-testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | Free compiled regular expressions after use in krb5_utils-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free hbac_infoNikolai Kondrashov2014-09-161-9/+41
| | | | | | Free hbac_info structs after use in ipa_hbac-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-09-161-3/+4
| | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-157-29/+117
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add alternative objectClass to group attribute mapsMichal Zidek2014-09-154-1/+7
| | | | | | | | | | | | | In IPA we sometimes need to use posixGroup and sometimes groupOfNames objectclass to query the groups. This patch adds the possibility to specify alternative objectclass in group maps. By default it is only set for IPA. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Always free talloc_reqJakub Hrozek2014-09-101-2/+1
| | | | | | | | On failure, the subreq wasn't freed, which was not a big deal given the parent request would free the subreq anyway, but it's better to follow the usual pattern. Reviewed-by: Simo Sorce <simo@redhat.com>
* Updating translations for the 1.12.1 releasesssd-1_12_1Jakub Hrozek2014-09-0816-12884/+24359
|
* LDAP: Check return valueJakub Hrozek2014-09-081-0/+6
| | | | | | Reported by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: delete stale GPOsYassir Elley2014-09-083-0/+134
| | | | | | https://fedorahosted.org/sssd/ticket/2431 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Add sss_rpcidmapd.5.xml to the list of translatable man pagesJakub Hrozek2014-09-081-0/+1
|
* libwbclient: avoid collision with Samba versionSumit Bose2014-09-083-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* dlopen test: only test libwbclient when it is buildSumit Bose2014-09-081-0/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add a unit test for dereference parsingJakub Hrozek2014-09-081-1/+169
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-082-4/+11
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IFP: Suppress 'git diff' noiseMichal Zidek2014-09-081-159/+159
| | | | | | | | | | | | This patch suppresses the 'git diff' noise after ifp_iface_generated.c is generated. It simply changes the file to the same form it is being automatically generated so that 'git diff' only shows changes in the code and not the differently generated ifp_iface_generated.c file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: process non-posix nested groups using tokenGroupsPavel Reichl2014-09-081-8/+1
| | | | | | | | | | When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-09-082-2/+2
| | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD-GPO: processing changes for gpo_map_* optionsYassir Elley2014-09-085-23/+460
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: config changes for gpo_map_* optionsYassir Elley2014-09-085-1/+362
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: man pageNoam Meltzer2014-09-083-1/+139
| | | | | | | | changes from previous patch: * fixed idmapd.conf example (sss plugin name) * squahsed the rpm spec into one commit Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add user lookup and session dependencies to systemd service file.Ian Lee2014-09-081-0/+3
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1088619 Before permitting user sessions sssd should be running. This also correctly orders shutdown of sssd after the user sessions. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pysss: test return value of realloc.Lukas Slebodnik2014-09-051-1/+5
| | | | | | | | | | It is not very likely that realloc will return NULL, but it's better to be defensive. src/python/pysss.c:774: var_assigned: Assigning: "groups" = null return value from "realloc". src/python/pysss.c:788: dereference: Dereferencing a null pointer "groups". Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Use right domain for group members with fq namesLukas Slebodnik2014-09-052-2/+3
| | | | | | | | | | | | | | | | | | | If we query group from subdomain it can contain users from different domains. All members from subdomain have fully qualified name, but member from main domain aren't. In function fill_members, we extracted name and domain with function fill_members. Later, we called function sss_fqname the first time with queried group domain and the second time with parsed domain. It caused following error in nss responder: [fill_members] (0x0040): Failed to generate a fully qualified name for member [user2_dom1@sssdad_tree.com] of group [group2_dom2@sssdad_tree.com]! Skipping The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain and name of subdomain had the same length, Therefore there was not problem in function fill_members with calling sss_fqname with different domains. This patch also changes name of subdomain to prevent such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* refcount-tests: Do not force to run test in CK_FORK modeLukas Slebodnik2014-09-051-1/+0
| | | | | | | | | | | | | | | | | | There was an access to uninitialised data in old version of libcheck when tests were executed in fork mode. ==2842== Syscall param timer_create(evp) points to uninitialised byte(s) ==2842== at 0x977FE72: timer_create@@GLIBC_2.3.3 (timer_create.c:82) ==2842== by 0x4E3647B: srunner_run (in /usr/lib64/libcheck.so.0.0.0) ==2842== by 0x401616: main (refcount-tests.c:233) ==2842== Address 0xffefff460 is on thread 1's stack This bug is already fixed in check-0.9.14, but we want to execute tests with valgrind on older platforms. The refcount test had hardcoded CK_FORK in source code and therefore it could not be overwritten with environment variable, which we use in CI script. Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* LDAP: Don't reuse a single tevent callback for multiple requestsJakub Hrozek2014-09-051-27/+53
| | | | | | | | | | | | | | | | | | | | Several requests (deref, ASQ and SD) were using the same tevent callback. This worked fine for quite some time, because the callback only used the tevent_req variables. However, a recent patch changed the shared sdap_get_generic_done so that it also longer uses the 'state' variable. At that point, all requsts that re-used the sdap_get_generic_done request started failing becaus the type of the state variable was different. This patch makes sure the callbacks only manipulate their own data types. Moreover, sdap_get_generic_ext_done() was renamed because it's not really a tevent callback. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSS_CACHE: Allow sss_cache tool to flush SSH hosts cacheWilliam B2014-09-0511-18/+204
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2358 Signed-off-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: SSS_LDB_SEARCH - macro around ldb_searchPavel Reichl2014-09-054-80/+36
| | | | | | | | | | | | | This patch amends previous patch 5153e8b9793dea1e212ca08af0f77ea1d023cbb7. Macro SSS_LDB_SEARCH is used instead of using fuction sss_ldb_search as a wrapper around ldb_search which could lead to premature expansion of variadic parameters. Part of solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AUTOCONF: Update detection of libnfsidmapLukas Slebodnik2014-09-022-17/+20
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* AD: Ignore all errors if gpo is in permissive mode.Lukas Slebodnik2014-09-021-1/+18
| | | | | | | | | | | | | | | This patch prevents problems with user authentication if gpo is misconfigurated. [ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy target. [sdap_id_op_destroy] (0x4000): releasing operation connection [ad_gpo_access_done] (0x0040): GPO-based access control failed. [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No such file or directory) [Internal Error (System error)] [be_pam_handler_callback] (0x0100): Sending result [4][sssdad.com] [be_pam_handler_callback] (0x0100): Sent result [4][sssdad.com] Reviewed-by: Yassir Elley <yelley@redhat.com>
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-023-8/+20
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* libwbclient: make build optionalSumit Bose2014-09-021-0/+16
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Doxygen: replace <pre> with markdown tableSumit Bose2014-09-021-18/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: add to build systemNoam Meltzer2014-09-022-0/+47
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NFSv4 client: (private) headers from libnfsidmapNoam Meltzer2014-09-021-0/+78
| | | | | | | | | | | | The private headers are needed in order to: nfsidmap_internal.h: * definition of struct trans_func * prototype for logger function cfg.h + queue.h: * prototype(s) for accessing rpc.idmpad configuration file Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NEW CLIENT: plugin for NFSv4 rpc.idmapdNoam Meltzer2014-09-021-0/+571
| | | | | | | | Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* LDAP: Set umask before calling mkstempJakub Hrozek2014-09-021-0/+3
| | | | | | | | | Even though we only call mkstemp to generate a random filename, it's a good practice to set and re-set umask before and after calling mkstemp. Silences a warning from Coverity static analyzer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Implement MIT Kerberos localauth pluginSumit Bose2014-09-021-1/+158
| | | | | | | | | | | | | | | | | The MIT Kerberos localauth pluing interface defines two different calls. The first checks if a given Kerberos principal relates to a given name of a local user (userok). The implementation lets SSSD resolve the principal and the user name and if the returned user entries both have the same UID success is returned. The second translates a given Kerberos principal to a local user name (a2l). Here SSSD is only called once to resolve the principal and the user name is returned. Resolves https://fedorahosted.org/sssd/ticket/1835 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add conditional build for MIT Kerberos localauth pluginSumit Bose2014-09-023-0/+47
| | | | | | | | This patch adds everything what is needed to build the MIT Kerberos localauth plugin if the used version of MIT Kerberos supports it. It does not implement the plugin. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add unit tests for the GPO interfaceJakub Hrozek2014-09-011-0/+100
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Replace space: add some checksSumit Bose2014-09-014-7/+33
| | | | | | | | | | | | | | | | | | | | | | | This patch adds some additional checks if the option for replacing spaces in user and group names is used. When replacing space with the replacement character it is checked if the name already contains the replacement character. If it does the unmodified name is returned because in this case a revers operation would not be possible. For the reverse operation is it checked if the input contains both a space and the replacement character. If this is true the unmodified name is returned as well, because we have to assume that it is the original name because otherwise it wouldn't contain both characters. Additionally a shortcut if the replacement characters is a space and tests for the new checks are added. The man page is updated accordingly. Related to https://fedorahosted.org/sssd/ticket/1854 and https://fedorahosted.org/sssd/ticket/2397 . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Fix a conversion of seconds to hoursLukas Slebodnik2014-09-011-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2423 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-014-23/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* NSS: check_cache() add extra optionSumit Bose2014-09-013-10/+12
| | | | | This patch adds a new parameter to check_cache() to allow to set the extra value which is send to the backend during lookup requests.
generated by cgit (git 2.34.1) at 2024-11-20 16:34:06 +0000