summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* selinux: Disconnect before closing the handleJakub Hrozek2015-04-141-3/+10
| | | | | | | | | | | | libsemanage documentation says: ~~~~ be sure that a semanage_disconnect() was previously called if the handle was connected. ~~~~ Otherwise we get a memory leak. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Option filter_users had no effect for retrieving sudo rulesAdam Tkac2015-04-143-0/+39
| | | | | | | | | Previously sssd_sudo always obtained sudo rules for user from LDAP even when user was enlisted in filter_users. Resolves https://fedorahosted.org/sssd/ticket/2625 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sysdb-tests: test return value before output argumentsLukas Slebodnik2015-04-141-0/+1
| | | | | | Output arguments needn't be initialized if function failed. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb-tests: Add missing assertionsLukas Slebodnik2015-04-141-0/+3
| | | | | | | | The return valuee of functions test_remove_group_member sysdb_attrs_add_time_t were ignored and therefore this part of code was not tested. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* simple_access-tests: Simplify assertionLukas Slebodnik2015-04-141-3/+1
| | | | | | The second argument of function check_access_list should not be an empty list. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Filter ad groups in initgroupsLukas Slebodnik2015-04-141-0/+12
| | | | | | | | | | Function sdap_add_incomplete_groups stored domain local groups from subdomain as POSIX group, which should not be done. Resolves: https://fedorahosted.org/sssd/ticket/2614 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Extract filtering AD group to functionLukas Slebodnik2015-04-144-47/+99
| | | | | | Patch remove code duplication. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Do not set gid 0 twiceLukas Slebodnik2015-04-141-7/+0
| | | | | | | | | | | | | | | | | | | | | The gid o was added to sysdb attrs directly in sdap_save_group for 1st time and for second time in the function sdap_store_group_with_gid, which was called every time from function sdap_save_group [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists](20)[attribute 'gidNumber': value #1 on 'name=domainlocalgroup1_dom2-493341@sssdad_tree.com,cn=groups,cn=sssdad_tree.com,cn=sysdb' provided more than once] [sysdb_set_entry_attr] (0x0040): Error: 17 (File exists) [sysdb_store_group] (0x1000): sysdb_set_group_attr failed. [sysdb_store_group] (0x0400): Error: 17 (File exists) [sdap_store_group_with_gid] (0x0040): Could not store group domainlocalgroup1_dom2-493341@sssdad_tree.com [sdap_save_group] (0x0080): Could not store group with GID: [File exists] [sdap_save_group] (0x0080): Failed to save group [domainlocalgroup1_dom2-493341@sssdad_tree.com]: [File exists] [sdap_save_groups] (0x0040): Failed to store group 0. Ignoring. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nsupdate: Append -d/-D to nsupdate with a high debug levelJakub Hrozek2015-04-141-1/+17
| | | | | | https://fedorahosted.org/sssd/ticket/897 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* dyndns: Log nsupdate stderr with a high debug levelJakub Hrozek2015-04-141-0/+12
| | | | | | https://fedorahosted.org/sssd/ticket/2224 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* UTIL: Add a simple function to get the fd of debug_fileJakub Hrozek2015-04-142-0/+10
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sudo: sanitize filter valuesPavel Březina2015-04-131-2/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2613 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* MAN: Clarify how are GPO mappings called in GPO editorJakub Hrozek2015-04-101-3/+19
| | | | | | https://fedorahosted.org/sssd/ticket/2618 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Reset negcache after checking domainsJakub Hrozek2015-04-091-0/+24
| | | | | | | | The NSS responder periodically re-checks subdomains. We need to reset the negative cache each time the check finishes to allow the negative cache to contain entries from different domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-0910-15/+82
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Add sss_ncache_reset_repopulate_permanentJakub Hrozek2015-04-093-0/+113
| | | | | | | This new function resets the negative cache and then re-adds the permanent entries. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Silence critical error from filter_users when default_domain_suffix ↵Jakub Hrozek2015-04-093-8/+101
| | | | | | | | | | | | | | | is set When default_domain_suffix is used and filter_users is set (at least root is always, by default), SSSD tried to add the negcache entry to the default domain. But since the default domain is not known after start up, adding the entries fail with a verbose error message. This patch handles EAGAIN returned from the parsing function while setting negcache entries gracefully and also makes the debug message in parsing function more precise. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Fix sss_ncache_reset_permanentJakub Hrozek2015-04-092-1/+12
| | | | | | | There was an off-by-one error in sss_ncache_reset_permanent that prevented the reset from working. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Revert strcmp conditionJakub Hrozek2015-04-081-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Set sdap handle as explicitly connected in LDAP authJakub Hrozek2015-04-081-0/+12
| | | | | | | | | | | | | In case SSSD is set with id_provider=proxy and auth_provider=ldap, the LDAP provider is not used to retrieve the user info with the higher-level calls, but the lower-level connection establishment is used instead. In this case, we need to make sure to mark the connection as explicitly connected to be notified about results of looking up the DN. Resolves: https://fedorahosted.org/sssd/ticket/2620 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* util-tests: Initialize boolean variable to default valueLukas Slebodnik2015-04-081-1/+1
| | | | | | | | The boolean variable found_nss could be used uninitialized in test test_known_service if service "nss" would not be found. We would catch it with valgind. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* enumeration: fix talloc contextPavel Březina2015-04-082-2/+2
| | | | | | | | | | | | | | If for some reason ptask fails (e.g. timeout), req is talloc freed but because subreq is attached to ectx which is permanent it is finished anyway. Then a crash occures when we are trying to access callback data. The same happens in sdap_dom_enum_ex_send. Resolves: https://fedorahosted.org/sssd/ticket/2611 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CLIENT: Clear errno with enabled sss-default-nss-pluginLukas Slebodnik2015-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although errno was cleared in function sss_nss_make_request some sss glic functions set errno with value of output argument errnop. Reproducer: * sssd compiled with enabled option sss-default-nss-plugin * sss is the last value in group (/etc/nsswitch.conf) * sssd-client is installed but sssd is stopped. C-program: #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <grp.h> int main(int argc, char *argv[]) { struct group *p_group; setgrent(); while (1) { errno = 0; /* initialize for getgrent() */ p_group = getgrent(); if (p_group == NULL) { if (errno == 0) { break; /* end of groups */ } else { perror("getgrent"); printf("getgrent error %d \n", errno); endgrent(); exit(-2); } } printf("getgrent() OK group(%d) = %s \n", p_group->gr_gid, p_group->gr_name); } exit(0); } Resolves: https://fedorahosted.org/sssd/ticket/2619 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Unify prototype and definitionLukas Slebodnik2015-04-011-2/+3
| | | | | | | | | The prototype of function copy_keytab_into_memory does not match the definition. One of arguments differs in constant modifier. Patch also include header file to implementation module. If should avoid such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Check return value of ad_gpo_store_policy_settingsLukas Slebodnik2015-04-011-0/+6
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SSH: Ignore the default_domain_suffixJakub Hrozek2015-04-011-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2609 In a trust setup, hosts are normally only stored on the IPA server. The default_domain_suffix option is only recommended for the IPA-AD trust scenario as well. Therefore we should ignore this option in the SSH provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com>
* PAC: Remove unused functionLukas Slebodnik2015-03-311-35/+0
| | | | | | The last usage of function dom_sid_in_domain was removed as a part of chages in ticket "Enhance PAC responder for AD users" 92af6f25864b5c389b57d0f659686801b45ca58c
* test_resolv_fake: Fix alignment warningLukas Slebodnik2015-03-271-9/+10
| | | | | | | | | | | | src/tests/cmocka/test_resolv_fake.c:60:9: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'HEADER *' increases required alignment from 1 to 4 [-Werror,-Wcast-align] h = (HEADER *) hb; ^~~~~~~~~~~~~ 1 error generated. Reviewed-by: Michal Židek <mzidek@redhat.com>
* MAN: Update ppolicy descriptionPavel Reichl2015-03-271-4/+7
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2612 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* Fix a few typos in commentsPavel Reichl2015-03-262-5/+5
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: fix a typo in debug messagePavel Reichl2015-03-261-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_ldap_auth: Use right assertion for integer comparisonLukas Slebodnik2015-03-261-6/+6
| | | | | | | The macro assert_int_equal prints value of integers if they are not equal. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* test_expire: Use right assertion macro for standard functionsLukas Slebodnik2015-03-261-2/+3
| | | | | | | | | | | | | | Documentation to macro assert_return_code says: Assert that the return_code is greater than or equal to 0. The function prints an error message to standard error and terminates the test by calling fail() if the return code is smaller than 0. If the function you check sets an errno if it fails you can pass it to the function and it will be printed as part of the error message. So in case of error we will see more verbose message. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam_client: fix casting to const pointerLukas Slebodnik2015-03-261-7/+8
| | | | | | | | | | src/sss_client/pam_sss.c:1461:73: error: cast from 'int **' to 'const void **' must have all intermediate pointers const qualified to be safe [-Werror,-Wcast-qual] pam_get_data(pamh, "pam_sss:password_expired_flag", (const void **) &exp_data); ^ Reviewed-by: Sumit Bose <sbose@redhat.com>
* MAN: Clarify debug_level a bitJakub Hrozek2015-03-241-0/+19
| | | | | | | | | Some users are confused about placement of the debug_level directive or the location of the log files. Clarify both in the man page. Also add a pointer to sss_debuglevel. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Remove the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-2411-109/+19
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Since deny rules are no longer supported on the server, the client should no longer support them either. Remove the option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Deprecate the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-241-0/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Deny rules have not been supported by the IPA server since 2.1. We should deprecate the ipa_hbac_treat_deny_as option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Only treat malformed HBAC rules as fatal if deny rules are enabledJakub Hrozek2015-03-241-14/+54
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 If deny rules are not in effect, we can skip malformed HBAC rules because at worst we will deny access. If deny rules are in effect, we need to error out to be on the safe side and avoid skipping a deny rule. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Drop useless sysdb parameterJakub Hrozek2015-03-241-16/+10
| | | | | | | | https://fedorahosted.org/sssd/ticket/2603 It's better to dereference the domain structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use custom error codes when validating HBAC rulesJakub Hrozek2015-03-246-29/+33
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Instead of reusing EINVAL/ENOENT, use more descriptive error codes. This will be useful in the next patch where we act on certain codes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Resolv: re-read SRV query every time if its TTL is 0Jakub Hrozek2015-03-242-6/+27
| | | | | | | We should make sure the client re-checks the SRV query each request if the SRV query is 0. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* tests: Use cmocka-1.0+ API in test_sysdb_utilsJakub Hrozek2015-03-241-3/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ldap: refactor nds_check_expired to use util funcPavel Reichl2015-03-231-23/+6
| | | | | | Refactor nds_check_expired() to use utility function sss_utc_to_time_t(). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap: refactor check_pwexpire_kerberos to use util funcPavel Reichl2015-03-232-26/+8
| | | | | | | | | Refactor check_pwexpire_kerberos() to use utility function sss_utc_to_time_t(). Modify test to handle new error code ERR_TIMESPEC_NOT_SUPPORTED Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: test expirationPavel Reichl2015-03-235-1/+346
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* memberof: Do not create request with 0 attribute valuesLukas Slebodnik2015-03-231-0/+6
| | | | | | | | | | | | | | | [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Constraint violation](19) [attribute 'ghost': attribute on 'name=Escalation,cn=groups,cn=LDAP,cn=sysdb' specified, but with 0 values (illegal)] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [Constraint violation] [sysdb_set_entry_attr] (0x0040): Error: 14 (Bad address) [sdap_store_group_with_gid] (0x0040): Could not store group Escalation [sdap_save_group] (0x0080): Could not store group with GID: [Bad address] [sdap_save_group] (0x0080): Failed to save group [Escalation]: [Bad address] [sdap_save_groups] (0x0040): Failed to store group 1. Ignoring. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Decorate the sdap_op functions with DEBUG messagesJakub Hrozek2015-03-231-1/+9
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Make StartTLS bind configurable with ldap_opt_timeoutJakub Hrozek2015-03-232-4/+6
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/1501 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Make password change timeout configurable with ldap_opt_timeoutJakub Hrozek2015-03-234-6/+12
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/1501 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Make simple bind timeout configurableJakub Hrozek2015-03-235-9/+21
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1501 Reuse the value of sdap_opt_timeout to set a longer bind timeout for user authentication, ID connection authentication and authentication during IPA migration mode. Reviewed-by: Pavel Reichl <preichl@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 20:54:57 +0000