summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* GPO: fail if there is problem with storing gpo into sysdbLukas Slebodnik2014-10-131-0/+14
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: UPN as a template expansion for homedir mappingsPavel Reichl2014-10-125-0/+21
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2340 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: check that connection is open before bindPavel Reichl2014-10-121-10/+103
| | | | | | | | | | | | | | | | Tivoli server does not return an empty response when being asked for the rootDSE data but an error. In this case the rootDSE lookup in SSSD will terminate the connection to the server and return a error. But since errors except timeouts are ignored SSSD will try to continue with the bind, but since the connection is already terminated this will fail as well. And this will terminate the whole operation. Make sure the connection is open before performing bind operation. Resolves: https://fedorahosted.org/sssd/ticket/2435 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: move deciding of tls usage into new functionPavel Reichl2014-10-121-20/+37
| | | | | | | Separate code for deciding tls usage from sdap_cli_connect_send() to new function decide_tls_usage(). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Fix error handling after talloc_ber_flattenLukas Slebodnik2014-10-121-2/+1
| | | | | | | The function talloc_ber_flatten can return EFAULT, ENOMEM, EOK. But it was tested for -1. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: Check return value of function hash_entriesLukas Slebodnik2014-10-121-0/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: test return value of sysdb_search_servicesLukas Slebodnik2014-10-121-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Fix warning Value stored to is never readLukas Slebodnik2014-10-121-1/+0
| | | | | | | | | | If function sdap_idmap_sid_to_unix return error code ENOTSUP then error message will be printed: "Skipping buit-in object" Processing of sids will continue an variable ret will be overridden with return code from function sdap_idmap_sid_to_unix, therefore storing EOK to variable is useless. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: Fix warning Value stored to is never readLukas Slebodnik2014-10-121-2/+0
| | | | | | | dinfo->sysdb was stored to variable sysdb two times. The first time on line 132 and second time after testing for subdomain on line 143. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add a test to change user IDsJakub Hrozek2014-10-105-0/+222
| | | | | | | Adds a unit test using the nss_wrapper and uid_wrapper libraries that exercises the ability to become another user. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Detect nss_wrapper and uid_wrapper during configureJakub Hrozek2014-10-101-0/+31
| | | | | | | | Unit testing the utilities to become another user requires the use of the cwrap libraries. This patch augments our build system with macros to detect the nss_wrapper and and uid_wrapper libraries. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-103-9/+9
| | | | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Remove useless memory contextsJakub Hrozek2014-10-101-12/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Suppress warning maybe-uninitializedLukas Slebodnik2014-10-091-7/+9
| | | | | | | | | | | | | | | | | | There is a warning with some version of gcc (4.9.1, 4.4.7). In my opinion, variable "a" should be initialized every time if "maps" is not NULL. src/providers/ldap/sdap.c: In function 'sdap_parse_entry': src/providers/ldap/sdap.c:481:56: warning: 'a' may be used uninitialized in this function [-Wmaybe-uninitialized] for (ai = a; ai < attrs_num; ai++) { ^ src/providers/ldap/sdap.c:307:9: note: 'a' was declared here int a, i, ret, ai; ^ CCLD libsss_ldap_common.la Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-096-39/+39
| | | | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: add test for sysdb_get_user_attr with subdomain userPavel Březina2014-10-091-0/+54
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb_get_user_attr: use fqn for subdomain usersPavel Březina2014-10-091-2/+11
| | | | | | | | Name of subdomain users is stored with domain part in the sysdb. We need to use fully qualified names for those user so we can look them up. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Build the sss_rpcidmapd man page conditionallyJakub Hrozek2014-10-091-1/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Print a type as hexadecimal number in debug message.Lukas Slebodnik2014-10-091-1/+1
| | | | | | | | | | | | | | | | | | | | All request from nss responder, start in domain log with debug message in function be_get_account_info e.g. [be_get_account_info] (0x0100): Got request for [4099][1][name=user1] [be_get_account_info] (0x0100): Got request for [4098][1][name=group1] [be_get_account_info] (0x0100): Got request for [4097][1][name=user1] The 1st number is type, which is defined as hexadecimal nuber in header file src/providers/data_provider.h #define BE_REQ_USER 0x0001 #define BE_REQ_GROUP 0x0002 #define BE_REQ_INITGROUPS 0x0003 ... This patch changes formatting from decimal representation to hexadecimal; so you needn't convert it in head while analysing log files. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: move sysdb_get_real_name() from sysdb.c to sysdb_search.cJakub Hrozek2014-10-064-53/+104
| | | | | | | | | | | The sysdb.c should be reserved for utility and setup functions. Search functions belong to sysdb_search.c Keeping functions in specialized modules helps to maintain nice dependencies and in overall makes unit testing easier. Moreover, the function was not unit tested, which needed fixing. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Make internal functions staticJakub Hrozek2014-10-062-16/+13
| | | | | | | Several functions in the monitor.c file were not marked as static even though they were only used inside monitor.c Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: remove unused talloc contextsLukas Slebodnik2014-10-031-11/+8
| | | | | | | Talloc context was not used in functions ad_gpo_parse_gpo_child_response ad_gpo_process_cse_recv, ad_gpo_store_policy_settings. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* GPO: Use argument ndg_flags instead of constantLukas Slebodnik2014-10-031-6/+6
| | | | | | | | | | | | Some internal gpo functions [1] were called just once and with constant NDR_SCALARS as 2nd argument(ndr_flags), but 2nd argument was not used in these functions[1]. They used constant NDR_SCALARS. [1] ndr_pull_security_ace_flags, ndr_pull_security_ace_type, ndr_pull_security_ace_object_flags, ndr_pull_security_acl_revision, ndr_pull_security_descriptor_revision, ndr_pull_security_descriptor_type Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD-GPO resolve conflicting policy settings correctlyYassir Elley2014-10-024-555/+743
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD GPO: Fix incorrect return of EACCESStephen Gallagher2014-10-021-2/+2
| | | | | | | | | | | | In the access providers, we expect to receive ERR_ACCESS_DENIED when access is denied, but we were returning EACCES here. The effect was the same, except that it presented ultimately as a system error instead of a proper denial. Related: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document the domains option of pam_sssJakub Hrozek2014-10-011-0/+27
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam: sub-domain authentication fixSumit Bose2014-10-011-1/+11
| | | | | | | | | | With a recent patch sysdb_getpwnam() was replaced by sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave differently with respect to sub-domain users. As a consequence the PAM responder was not able to resolve users from sub-domains. This patch reverts this change and uses sysdb_getpwnam() again. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* sssd.api.conf: Declare case_sensitive as stringMichal Zidek2014-10-011-1/+1
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2452 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: add support for new extdom plugin versionSumit Bose2014-09-301-87/+802
| | | | | | | | | | | | | | | | | | | Initially the extdom plugin was only used to translate SIDs of AD user and groups to names or POSIX IDs. On IPA clients group memberships were resolved with the help of the PAC in the Kerberos ticket which required that the user has logged in at least once. Home directory and the login shell were auto generated. The new version of the extdom plugin can return the complete list of group memberships of a user and the list of all members of a group. Additionally the gecos field, home directory and login shell are returned together with an optional list of key-value pairs for arbitrary data which is written unmodified to the cache. Fixes https://fedorahosted.org/sssd/ticket/2159 and https://fedorahosted.org/sssd/ticket/2041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-294-3/+79
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-299-3/+299
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Add a missing break statement to the GPO codeJakub Hrozek2014-09-291-1/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD GPO: Fix incorrect sAMAccountName selectionStephen Gallagher2014-09-291-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: make get_primary() a public callStephen Gallagher2014-09-292-3/+13
| | | | | | | This patch changes get_primary() into sss_krb5_get_primary() so it can be used by the AD provider to get the sAMAccountName from the hostname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-294-4/+4
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* TESTS: Add a unit test for matching the secondary objectclassJakub Hrozek2014-09-251-0/+37
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not change SSSD domains in get_domains_headStephen Gallagher2014-09-241-3/+0
| | | | | | | | | | When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain.
* tests: Add a test for storing custom attrs with automatic IDJakub Hrozek2014-09-181-0/+51
| | | | Reviewed-by: Daniel Gollub <dgollub@brocade.com>
* MAN: AD is allowed value of subdomains_providerJakub Hrozek2014-09-181-0/+9
| | | | | | https://fedorahosted.org/sssd/ticket/2442 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* TESTS: Add a case-insensitive group search sysdb testJakub Hrozek2014-09-171-8/+25
| | | | | | | A recent fix enabled searching for groups by name in a case-insensitive domain. This patch adds a unit test to check that behaviour. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: sysdb_search_group_by_name should work like sysdb_search_user_by_nameSumit Bose2014-09-171-43/+42
| | | | | | | | | | | | Currently sysdb_search_group_by_name uses an optimization which might fail in case-insensitive environments. The DN of the group object is generated with the help of the given name. Since the DN is case-sensitive a group lookup will fail if different cases are used. sysdb_search_user_by_name already handles case-insensitive searches well and sysdb_search_group_by_name should use the same scheme. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Write additional attrs in sysdb_add_userDaniel Gollub2014-09-171-1/+2
| | | | | | | | In the uid=0 case (to obtain new free id) only uidNumber and gidNumber attributes got written, but not the additonal provided attributes like alias or others. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free retrieved sid in test_getsidbynameNikolai Kondrashov2014-09-161-1/+5
| | | | | | Free sid retrieved with sss_nss_getsidbyname in test_getsidbyname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free link paths in symlink testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | | Free malloc'd symlink paths in test_symlink and test_follow_symlink tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free compiled regexes in krb5_utils-testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | Free compiled regular expressions after use in krb5_utils-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free hbac_infoNikolai Kondrashov2014-09-161-9/+41
| | | | | | Free hbac_info structs after use in ipa_hbac-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-09-161-3/+4
| | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-23 20:48:29 +0000