summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Rename group.c and passwd.c for clarityStephen Gallagher2010-10-132-0/+0
| | | | | Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_"
* netgroup testsStephen Gallagher2010-10-131-0/+516
|
* Netgroups sysdb APIStephen Gallagher2010-10-134-2/+802
|
* Require explicit setting of callback context for check_cacheStephen Gallagher2010-10-131-7/+13
| | | | | Previously, it was implicitly using the nss_dom_ctx, but there are situations where we would want to send a different private context
* Store entry_cache_timeout in sss_domain_info objectStephen Gallagher2010-10-132-0/+9
| | | | | | This is useful so that the NSS responder can identify an domain's entry timeout for expiring the memory cache for a lookup such as with netgroups.
* Add utility function sss_strnlen()Stephen Gallagher2010-10-132-0/+34
| | | | This is useful for guaranteeing the size of an input buffer.
* Initialize kerberos service for GSSAPIJakub Hrozek2010-10-139-5/+302
|
* Make ldap_child report kerberos return code to parentJakub Hrozek2010-10-134-13/+31
|
* Report Kerberos error code from ldap_child_get_tgt_syncJakub Hrozek2010-10-131-23/+16
|
* Add KDC to the list of LDAP optionsJakub Hrozek2010-10-135-1/+22
|
* Raise the required version of libdhashSumit Bose2010-10-131-1/+1
| | | | | libdhash version 0.4.2 is required because older versions cannot update hash entries.
* Return all group members from getgr(nam|gid)Ralf Haferkamp2010-10-131-12/+374
| | | | | | | getgrnam()/getgrgid() should return all group members instead of only those which have already been cached (in sysdb). To achieve this every member that is currently not in the cache is looked up via LDAP and saved to the cache.
* Shortcut for save_group() to accept sysdb DNs as member attributesRalf Haferkamp2010-10-131-4/+19
| | | | | | Addtional parameter "populate_members" for save_group() and save_groups() to indicate that the "member" attribute of the groups is populated with sysdb DNs of the members (instead of LDAP DNs).
* Rename index to idxSumit Bose2010-10-131-4/+4
| | | | This patch suppresses a 'shadows a global declaration' warning.
* Add a missing include fileSumit Bose2010-10-131-0/+1
| | | | | strcasecmp() is defined in strings.h which might not be included under certain conditions.
* Use POPT_TABLEEND to close option tableSumit Bose2010-10-137-8/+8
|
* Man pages should mention supported providersJan Zeleny2010-10-134-13/+28
| | | | | | | Each back end can support id, auth or access provider, but each back end supports different subset of these. Man pages should describe which providers are supported by each back end. Ticket: #615
* Add common hash table setupStephen Gallagher2010-10-082-0/+58
| | | | | sss_hash_create() produces a dhash table living in the talloc hierarchy.
* Disable events on ldap fd when offline.Jan Zeleny2010-10-081-2/+4
| | | | | | | | | Erase events on LDAP socket when backend is offline and an event appears on the socket. Normally this would lead to infinite loop, because event is present on the fd, but instead of being processed, an error log is written and the program continues to wait for the event. Ticket: #599
* Return offline instead of errorStephen Gallagher2010-10-041-1/+2
| | | | | | | | When the failover code returns that there are no available servers while we are marked offline, we were returning an error to the PAM authentication code. Instead, we should return success with a result value of SDAP_UNAVAIL so that the PAM responder will mark the domain offline and attempt offline authentication.
* Suppress some 'unchecked return value' warningsSumit Bose2010-09-281-6/+13
|
* Suppress some 'may be used uninitialized' warningsSumit Bose2010-09-284-9/+15
| | | | | Additionally the handling of errno and the errno_t return value of functions is fixed in krb5_common.c.
* Use new MIT krb5 API for better password expiration warningsSumit Bose2010-09-234-3/+79
|
* Save all data to sysdb in one transactionSumit Bose2010-09-231-222/+131
|
* Handle host objects like other objectsSumit Bose2010-09-232-129/+183
|
* Initialize debug_level to zero in crypto testsStephen Gallagher2010-09-221-1/+1
|
* Request the correct attribute nameJakub Hrozek2010-09-221-1/+1
|
* Fix sysdb_attrs_to_listJakub Hrozek2010-09-221-2/+2
|
* Fix sysdb_group_dn_nameJakub Hrozek2010-09-222-1/+43
|
* Initgroups on a non-cached user should go to the data providerStephen Gallagher2010-09-222-2/+13
| | | | | | | We were accidentally returning an error when sysdb_getpwnam() returned zero results internally in sysdb_initgroups(). The correct behavior here is to return EOK and a result object with zero entries.
* Fix missing variable substitution in DEBUG messageStephen Gallagher2010-09-221-2/+2
|
* Request all group attributes during initgroups processingStephen Gallagher2010-09-222-5/+7
| | | | | | | We tried to be too clever and only requested the name of the group, but we require the objectClass to validate the results. https://fedorahosted.org/sssd/ticket/622
* Check if control is supported before using it.Simo Sorce2010-09-154-14/+39
|
* Add parameter to skip cleanup in sysdb testJakub Hrozek2010-09-151-1/+4
| | | | This might be useful for examining the test database manually with LDB tools
* Use a different min_id for local domainJakub Hrozek2010-09-152-1/+17
| | | | | When we changed the default min_id to be 1, we forgot about the local domain. It makes sense to keep the minimum id larger there.
* Define objectclass with a constantJakub Hrozek2010-09-152-3/+4
| | | | Use a #define instead of hardcoded string
* Revert "Make ldap bind asynchronous"Jakub Hrozek2010-09-157-1219/+167
| | | | This reverts 56d8d19ac9d857580a233d8264e851883b883c67
* Store rootdse supported features in sdap_handlerSumit Bose2010-09-157-63/+112
|
* Fix parameter order when initializing decryptionJakub Hrozek2010-09-151-1/+1
|
* Handle multiple simultaneous enumeration requestsStephen Gallagher2010-09-082-289/+717
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, if a second enumeration request arrived while one was already being processed, each process would receive only a subset of the total number of available users or groups. This is because we were maintaining the response object as a global value in the NSS responder. The second request would come in, see that the data set was already populated, and start reading from wherever the cursor was currently pointed. With this patch, we now move the cursor to the client context instead of the global NSS context. Additionally, this patch completely rewrites the approach to enumerations in the tevent_req style. This makes it much easier to follow in the code. In order to ensure that a slow or malicious client cannot hold onto a reference for the setent result object indefinitely, we set an expiration on the object. We use the enum_cache_timeout here, since that is an appropriate value. If the timeout fires during the normal operation of the get*ent() loop of a client program, we will save the current values of the read index so that we can resume as soon as the object has been refreshed by an implicit setent call. Instead of deleting the enumeration result object immediately after the last in-progress client has read it, we'll keep the object around for the lifetime of enum_cache_timeout. This way, additional clients making enumeration requests can still access the results in-memory.
* Fix assorted minor bugs in sss_ toolsJakub Hrozek2010-09-089-47/+37
| | | | Fixes: #585
* Dead assignments cleanup in various places in SSSDJan Zeleny2010-09-085-6/+8
| | | | | | Three assignments deleted, two return code inspection added. Also found and fixed one critical bug caused by dead assignment. Ticket: #590
* Dead assignments cleanup in memberof moduleJan Zeleny2010-09-081-6/+3
| | | | | | Some assignments deleted, two return value inspections were added. Ticket: #589
* Dead assignments cleanup in NSS responderJan Zeleny2010-09-082-7/+7
| | | | | | Various dead assignments were deleted, some return value inspections were added. Ticket: #588
* Dead assignments cleanup in providers codeJan Zeleny2010-09-086-20/+9
| | | | | | | Dead assignments were deleted. Also prototype of function sdap_access_decide_offline() has been changed, since its return code was never used. Ticket: #586
* Deobfuscate password in back endsJakub Hrozek2010-09-082-8/+62
| | | | | | When obfuscated password is used in config file, the LDAP backend converts it back to clear text and uses it to authenticate to the server.
* sss_obfuscate toolJakub Hrozek2010-09-082-0/+194
| | | | A tool to add obfuscated passwords into the SSSD config file
* Python bindings for obfuscationJakub Hrozek2010-09-081-3/+180
|
* Password obfuscation utility functionsJakub Hrozek2010-09-084-0/+649
| | | | | | | Adds two utility functions to obfuscate a password and inverse to extract the cleartext password back. So far, only NSS-based implementation is provided.
* Add safe copy/move macros for uint16_tJakub Hrozek2010-09-081-1/+11
|
generated by cgit (git 2.34.1) at 2024-05-10 09:11:08 +0000