summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Every time use permissive control in function memberof_mod.Lukas Slebodnik2013-07-171-0/+7
| | | | | | | | | | | Storing cyclic groups into sysdb can cause adding ghost members, which has already been stored. Function ldb_modify will fail with error [Attribute or value exists]. With permisive control, duplicated attributes will be skipped as if it was never added. https://fedorahosted.org/sssd/ticket/1846
* print hint about password complexity when new password is rejectedPavel Březina2013-07-172-1/+15
| | | | https://fedorahosted.org/sssd/ticket/1827
* LDAP: When resolving a SID, search for groups first, then usersJakub Hrozek2013-07-171-19/+18
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1997 Most of the time, the SIDs are resolved as a call coming from the PAC responder during initgroups. In that case at least, it makes sense to search for group matching that SID first, then users. We may consider making this behaviour configurable ie for the server mode where typically the users should be queried first.
* remove unused variablePavel Březina2013-07-161-4/+0
|
* Remove unused function parameterLukas Slebodnik2013-07-161-3/+1
|
* Use conditional build for retrieving ccache.Lukas Slebodnik2013-07-154-88/+78
| | | | | | | | Some krb5 functions needn't be available for retrieving ccache with principal. Therefore ifdef is used to solve this situation with older version of libkrb5. There were two functions with similar functionality in krb5_child and krb5_utils. They were merged to one universal function, which was moved to file src/util/sss_krb5.c
* Missing space in debug messageMichal Zidek2013-07-151-2/+2
|
* Return right directory name for dircacheLukas Slebodnik2013-07-111-6/+10
| | | | | | | Dircache can be either file or directory. Wrong value was used when dircache was itself directory. https://fedorahosted.org/sssd/ticket/2002
* Always set port status to neutral when resetting service.Michal Zidek2013-07-111-1/+2
| | | | | | | | We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
* KRB5_CHILD: Fix handling of get_password return codeOndrej Kos2013-07-101-4/+10
| | | | The switch statement was dead code due to missing case/default.
* sss_cache: Add option to invalidate all entriesMichal Zidek2013-07-102-0/+24
| | | | | | Option -E/--everething was added to invalide all types of entries. https://fedorahosted.org/sssd/ticket/1988
* Do not copy special files when creating homedirOndrej Kos2013-07-093-73/+10
| | | | | | https://fedorahosted.org/sssd/ticket/1778 When trying to copy special file, only message is logged now.
* DB: sysdb_search_user_by_name: search by both name and aliasJakub Hrozek2013-07-092-6/+36
|
* BUILD: Use pkg-config to detect cmockaLukas Slebodnik2013-07-021-19/+18
|
* ldap: only update shadowLastChange when password change is successfulJim Collins2013-07-011-1/+2
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
* Updating translations for the 1.11 beta1 releasesssd-1_11_0_beta1sssd-1_10_90Jakub Hrozek2013-06-2815-3715/+4331
|
* IPA: Look up AD users directly if IPA server mode is onJakub Hrozek2013-06-286-6/+168
| | | | | | | | https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
* IPA: Create and remove AD id_ctx for subdomains discovered in server modeJakub Hrozek2013-06-281-0/+182
| | | | | | | | | When IPA server mode is on, then this patch will create an ad_id_ctx for each subdomain discovered in IPA provider. The ID context is needed to perform direct lookups using the AD provider. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek2013-06-283-65/+78
| | | | | | | | Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Initialize server mode ctx if server mode is onJakub Hrozek2013-06-284-0/+62
| | | | | | | | | | This patch introduces a new structure that holds information about a subdomain and its ad_id_ctx. This structure will be used only in server mode to make it possible to search subdomains with a particular ad_id_ctx. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* AD: initialize failover with custom realm, domain and failover serviceJakub Hrozek2013-06-283-28/+41
| | | | | | | | | | This is needed so we can initialize failover using IPA realm and on-the-fly discovered DNS domain. The subdomains discovered on-thefly will use the subdomain name for realm, domain and failover service to avoid conflicts. Subtaks of: https://fedorahosted.org/sssd/ticket/1962
* AD: decouple ad_id_ctx initializationJakub Hrozek2013-06-283-102/+285
| | | | | | | | | The IPA subdomain code will perform lookups on its own in the server mode. For this, the AD provider must offer a way to initialize the ad_id_ctx for external consumers. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* LDAP: Add utility function sdap_copy_mapJakub Hrozek2013-06-282-0/+45
| | | | | | | | | The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* IPA: Add a server mode optionJakub Hrozek2013-06-284-0/+22
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1993 SSSD needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, is introduced which defaults to false but is set to true during ipa-server-install or during updates of the FreeIPA server if it is not already set.
* Read mpg state for subdomains from cacheSumit Bose2013-06-284-11/+30
| | | | | The mpg flag will be read from the cache for subdomains and the domain object will be created accordingly.
* Save mpg state for subdomainsSumit Bose2013-06-285-13/+54
| | | | | | The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
* IPA: read ranges before subdomainsSumit Bose2013-06-281-29/+27
| | | | | | | Since FreIPA will start to support external mapping for trusted domains as well the range type for the domain must be know before the domain object is created. The reason is that external mapping will not use magic private groups (mpg) while algorithmic mapping will use them.
* Replace new_subdomain() with find_subdomain_by_name()Sumit Bose2013-06-285-16/+11
| | | | | | new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
* Add support for new ipaRangeType attributeSumit Bose2013-06-285-6/+54
| | | | | | | | | Recent versions of FreeIPA support a range type attribute to allow different type of ranges for sub/trusted-domains. If the attribute is available it will be used, if not the right value is determined with the help of the other idrange attributes. Fixes https://fedorahosted.org/sssd/ticket/1961
* Add ipa_idmap_init()Sumit Bose2013-06-283-1/+275
| | | | | | Use the sdap_idmap context for the IPA provider as well. https://fedorahosted.org/sssd/ticket/1961
* Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose2013-06-285-14/+38
| | | | | | | | | | Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
* Add sdap_idmap_domain_has_algorithmic_mapping()Sumit Bose2013-06-282-0/+62
| | | | | | | This patch implements a wrapper for sss_idmap_domain_has_algorithmic_mapping() for the sdap ID mapping. Fixes https://fedorahosted.org/sssd/ticket/1960
* Allow different methods to find new domains for idmappingSumit Bose2013-06-282-3/+24
| | | | | | | | | | | | | | | | | Currently the range management code is in the generic LDAP provider and can be used by the LDAP and AD provider. New ranges are allocated with the help of a hash value of the domain SID. If the IPA provider cannot find a range for a given domain it cannot allocate a new range on its own but has to look up the idrange objects on the FreeIPA server and use them accordingly. To allow the LDAP, AD and IPA provider to use as much common code as possible a plugin interface, similar to the one used to find the DNS site, to find a missing range would be useful. The default plugin will be used by the LDAP and the AD provider and the IPA provider will implement a plugin to read the data from the server. Fixes https://fedorahosted.org/sssd/ticket/1961
* SDAP IDMAP: Add configured domain to idmap contextSumit Bose2013-06-281-0/+70
| | | | | | To allow libsss_idmap to manage all id-ranges the id-ranges of the domains configured in sssd.conf which are currently unmanaged must be added to libsss_idmap.
* Add now options ldap_min_id and ldap_max_idSumit Bose2013-06-287-0/+33
| | | | | | | Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
* Add cmocka based tests for libsss_idmapSumit Bose2013-06-281-0/+421
| | | | | This patch implements some unit tests for the recent enhancements to libsss_idmap.
* idmap: add sss_idmap_domain_has_algorithmic_mappingSumit Bose2013-06-282-0/+55
| | | | | | | | | | With this call it can be checked if for a given domain algorithmic mapping is available or if the ID must be read from an external source. The default if an error occurs or no matching range was found is false, i.e external mapping, to meet the requirements for simple LDAP based domains where only external mapping is available. Fixes https://fedorahosted.org/sssd/ticket/1960
* idmap: add calls to check if ID mapping conforms to rangesSumit Bose2013-06-282-0/+186
| | | | | | | When ID are mapped externally it must be checked if the extern ID falls into the right configured range to avoid ID conflicts. Fixes https://fedorahosted.org/sssd/ticket/1960
* idmap: allow NULL domain sid for external mappingsSumit Bose2013-06-281-32/+44
| | | | | | | | | | Since it is planned that the LDAP based ID providers (LDAP, AD, IPA) will always use libsss_idmap to map ID or get information about how to map it, it must be possible to add domains to libsss_idmap which do not have a SID or where is SID is not known when external mapping is used. Algorithmic mapping always requires a domain SID. Fixes https://fedorahosted.org/sssd/ticket/1960
* idmap: add option to indicate external_mappingSumit Bose2013-06-282-4/+43
| | | | | | | | | | The idea is that ranges for IDs from AD can be used in libsss_idmap as well, but whenever a mapping is requested for this range a specific error code IDMAP_EXTERNAL is returned to tell SSSD to do an AD lookup. This way SSSD does not need to inspect the ranges itself but all is done inside if libsss_idmap. Fixes https://fedorahosted.org/sssd/ticket/1960
* idmap: add optional unique range idSumit Bose2013-06-282-1/+17
| | | | | | | | To be able to detect configuration changes in idranges managed by FreeIPA an identifier should be stored on the client together with the other idrange related data. Fixes https://fedorahosted.org/sssd/ticket/1979
* idmap: allow first RID to be setSumit Bose2013-06-282-20/+109
| | | | | | | | | | | | Currently libss_idmap implicitly assumes that the RID 0 is always mapped to the first ID of the given range. This is not the case anymore when multiple ranges are used e.g. for trusted domains in FreeIPA. A new call sss_idmap_add_domain_ex() was added which can take the first RID as an argument. This new call will get more options with other patches hence I didn't change the library version with this patch. Fixes https://fedorahosted.org/sssd/ticket/1938
* Update the translations for the 1.10.0 releaseJakub Hrozek2013-06-2715-520/+287
|
* Do not call sss_cmd_done in function check_cache.Lukas Slebodnik2013-06-271-6/+0
| | | | | | | | Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done was called. Inside of function sss_cmd_done memory was freed, but this freed memory was used in caller functions, therefore sssd crashed. https://fedorahosted.org/sssd/ticket/1980
* Handle too many results from getnetgr.Lukas Slebodnik2013-06-271-1/+13
|
* SSH: Update known_hosts file after unsuccessful requests as well.Jan Cholasta2013-06-271-20/+36
| | | | https://fedorahosted.org/sssd/ticket/1949
* SSH: When host is removed from LDAP, remove it from the cache as wellJan Cholasta2013-06-271-1/+8
| | | | https://fedorahosted.org/sssd/ticket/1949
* Add missing argument to DEBUG messageLukas Slebodnik2013-06-271-1/+1
|
* Fix compilation warningJakub Hrozek2013-06-271-1/+1
|
* AD: Write out domain-realm mappingsJakub Hrozek2013-06-277-189/+197
| | | | | This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
generated by cgit (git 2.34.1) at 2024-06-08 02:58:43 +0000