summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: imposing sizelimit=1 for single-entry searches breaks overlapping domainsJakub Hrozek2015-09-222-13/+0
| | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2723 In case there are overlapping sdap domains, a search for a single user might match and return multiple entries. For instance, with AD domains represented by search bases: DC=win,DC=trust,DC=test DC=child,DC=win,DC=trust,DC=test A search for user from win.trust.test would be based at: DC=win,DC=trust,DC=test but would match both search bases and return both users. Instead of performing complex filtering, just save both users. The responder would select the entry that matches the user's search. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_override: remove -d from manpagePavel Březina2015-09-211-1/+1
| | | | | | Short version of --debug is not acepted. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Do not allow the AD lookup code to set backend as offline in server modeJakub Hrozek2015-09-211-1/+7
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2637 In server mode, we should not allow the AD lookups to set the backend offline. Rather just let them report an error and deal with the error separately. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Set ignore_mark_offline=false when resolving AD root domainJakub Hrozek2015-09-211-23/+33
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2637 Avoid going offline in cases where SSSD is connected to a child domain but the root domain is not accessible. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Do not mark the whole back end as offline if subdomain lookup failsJakub Hrozek2015-09-211-14/+67
| | | | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 Rather mark the domain as inactive. It will be marked as active later, in the meantime the main domain can continue to work online and subdomain requests will be answered from cache. The lookup request itself just returns a special error code and lets the caller handle the error code as appropriate (normally by disabling the subdomain temporarily). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Offline operation with disabled domainJakub Hrozek2015-09-211-1/+11
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2637 If a subdomain is in the disabled state, switch krb5_child operation into offline mode. Similarly, instead of marking the whole back end as offline, mark just the domain as offline -- depending on the domain type, this would mark the whole back end or just inactivate subdomain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Only ignore errors from SDAP lookups if there's another connection to ↵Jakub Hrozek2015-09-211-0/+1
| | | | | | | | | | | | | | | | | fallback to Required for: https://fedorahosted.org/sssd/ticket/2637 The AD lookup code honors the ignore_mark_offline flag in the sense that if it's set, the sdap return code is not reported to the upper layer, but EOK is returned as request status and the sdap return code is returned separately. This patch modifies the behaviour further to only apply if there is another connection to fall back to. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Do not set is_offline if ignore_mark_offline is setJakub Hrozek2015-09-211-1/+1
| | | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 The caller of the sdap_id_op requests can set the ignore_mark_offline flag to avoid the sdap_id_op from marking the whole back end as offline. However, there was a small bug - the is_offline internal sdap_id_op flag was still being set. As a consequence, the error code from the connection was ignored and EAGAIN was always returned. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Provide a way to mark subdomain as disabled and auto-enable it later ↵Jakub Hrozek2015-09-213-9/+369
| | | | | | | | | | | | | | | | with offline_timeout https://fedorahosted.org/sssd/ticket/2637 Adds a new Data Provider function be_mark_dom_offline() that is a replacement for be_mark_offline(). When called, the function would either set the whole back end offline, just like be_mark_offline or just set the subdomain status to inactive. When a subdomain is inactive, there is a singleton timed task that would re-set the subdomin after offline_timeout seconds. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-2112-14/+60
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_ldap_id_cleanup: Fix coding style issuesLukas Slebodnik2015-09-181-9/+9
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Sanitize group dn before using in filterLukas Slebodnik2015-09-181-2/+16
| | | | | | | | | | Each string should be sanitized(rfc4515) before using ldbsearch. A group dn was not sanitized in the function cleanup_groups. Resolves: https://fedorahosted.org/sssd/ticket/2744 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Partially revert "LDAP: sanitize group name when used in filter"Lukas Slebodnik2015-09-181-83/+5
| | | | | | | This reverts commit e2e334b2f51118cb14c7391c4e4e44ff247ef638. + temporary disable unit test Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Revert "LDAP: end on ENOMEM"Lukas Slebodnik2015-09-181-1/+0
| | | | | | | This reverts commit f31a57321fc0a2390bb0d6030053c49787e5e587. It blocked reverting commit e2e334b2f51118cb14c7391c4e4e44ff247ef638. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_ad_common: Use unique directory for keytabsLukas Slebodnik2015-09-181-2/+15
| | | | | | | | | This patch also improved cleanup. The functions test_ad_create_2way_trust_options created keytab which was used by other following tests test_ldap_conn_list, test_conn_list. The keytab was not removed at the end of al tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_copy_keytab: Create keytabs in unique directoryLukas Slebodnik2015-09-181-2/+9
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_ipa_subdomains_server: Use unique dorectory for keytabsLukas Slebodnik2015-09-181-3/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2694 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Move test_dom_suite_setup to different moduleLukas Slebodnik2015-09-182-13/+12
| | | | | | | | | | | The function test_dom_suite_setup is a simple function which creates a directory which should be used for creating files. This function needn't be linked with libsss_util.so as other functions in common_dom.c This is a reason why it's better to move it to the file common.c so linker can optimize out other unnecessary module objects from static library libsss_test_common.a and test needn't be linked libsss_util.so. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Use unique name for TEST_PATHLukas Slebodnik2015-09-1819-19/+19
| | | | | | | | | | | | | | We had a cases in patch where two tests were using the same TEST_PATH and therefore they were stepping each other to the same files which caused failures. These failures are not easy to reproduce. This patch uses macro BASE_FILE_STEM for unique name. It should prevent copy&paste problem resulting to intermittent failures. @see also https://www.gnu.org/software/make/manual/html_node/Automatic-Variables.html Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: allow ghost members for LOCAL viewPavel Březina2015-09-182-17/+22
| | | | | | | | | | | LOCAL view does not allow the case when both ghost member and user override is created so it is safe to allow ghost members for this view. Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: fix two typos in debug messagesPavel Březina2015-09-181-2/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: do not require overrideDN in grous when LOCAL view is setPavel Březina2015-09-181-0/+6
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2790 Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Don't error out reading a minimal krb5.confJakub Hrozek2015-09-161-1/+4
| | | | | | | | With some setups, krb5.conf can be really minimal. In those cases, we should ignore PROF_NO_RELATION and PROF_NO_SECTION and just return "false" as in "no proxy" without a loud debug message. Reviewed-by: Petr Cech <pcech@redhat.com>
* sss_override: support fqn in override namePavel Březina2015-09-161-18/+93
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2782 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DATA_PROVIDER: BE_REQ as string in log messagePetr Cech2015-09-145-19/+114
| | | | | | | | | | | | | | | | | Add be_req2str() for translation BE_REQ to string. So we will have || Got request for [0x1001][FAST BE_REQ_USER][1][name=celestian] instead of || Got request for [0x1001][1][name=celestian] Function be_req2str() is used in data provider and in responder too. So this patch create new header file data_provider_req.h which delivers function be_req2str() and definitions of BE_REQ_*. Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* dyndns-tests: Simulate job in wrapped execvLukas Slebodnik2015-09-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function be_nsupdate_send fork a child for execution of the utility nsupdate. The child process builds nsupdate args in the function be_nsupdate_args and then execute the utility. Meanwhile the parent process register handlers for child and timeout for canceling the long lasting child. nsupdate_child_send -> child_handler_setup You can see in following log file that the wrapped version of execv function might be very fast and therefore parent can register handlers after finishing child. This is a reason why there is a child timeout. (10:18:48:556001 2015) [sssd] [be_nsupdate_args] (0x0200): nsupdate auth type: GSS-TSIG (10:18:48:556126 2015) [sssd] [__wrap_execv] (0x0200): nsupdate success test case (10:18:48:556200 2015) [sssd] [__wrap_execv] (0x1000): Child exiting with status 0 (10:18:48:557218 2015) [sssd] [child_handler_setup] (0x2000): Setting up signal handler up for pid [3957] (10:18:48:560987 2015) [sssd] [child_handler_setup] (0x2000): Signal handler set up for pid [3957] (10:18:50:608520 2015) [sssd] [nsupdate_child_timeout] (0x0020): Timeout reached for dynamic DNS update (10:18:50:681525 2015) [sssd] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158233]: Dynamic DNS update timed out (10:18:50:687031 2015) [sssd] [dyndns_test_ok] (0x1000): Child request returned [1432158233]: Unknown error 1432158233 The patch simulate a work in wrapped function with small delay. It should be enough time for the parent process to registering a child. Based on patch from Jurica Stanojkovic <jurica.stanojkovic@rt-rk.com> Thank you. Resolves: https://fedorahosted.org/sssd/ticket/2283 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: make sss_krb5_get_primary() privateSumit Bose2015-09-142-6/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: use SDAP_SASL_AUTHID as samAccountNameSumit Bose2015-09-141-3/+4
| | | | | | | | | | | | | | | The samAccountName for AD hosts is the hosts NetBIOS name with a trailing $. Since there is a size limit on NetBIOS names long DNS names must be truncated to find a matching entry in the AD LDAP tree. The NetBIOS name is already needed during kinit/SASL bind where the SDAP_SASL_AUTHID config option is used. Since the GPO lookup code is only reached after the SASL bind was successful we can safely assume that the name is correct and use it for the GPO lookup. Resolves https://fedorahosted.org/sssd/ticket/2692 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CI: Set env variable for all tabs in screenLukas Slebodnik2015-09-142-6/+37
| | | | | | | | | | | Previously, only one tab had configured all environment variables and current working directory was set to source directory. It's better to open shell in "chroot" directory for troubleshooting purposes. This patch also open pre-defined tabs with useful directories with sssd cache, sssd log files, "chroot" directory Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Remove unused functionJakub Hrozek2015-09-113-9/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: fix memory leakPavel Reichl2015-09-071-3/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2777 Reviewed-by: Michal Židek <mzidek@redhat.com>
* intg: Fix some PEP 8 violationsMichal Židek2015-09-037-0/+76
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CI: Add regression test for #2676Michal Židek2015-09-031-0/+61
| | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 Regression test for the above ticket. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* cleanup task: Expire all memberof targets when removing userMichal Židek2015-09-031-1/+52
| | | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 When user is removed from cache during cleanup task, mark all his memberof targets as expired to refresh member/ghost attributes on next request. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SYSDB: Add function to expire entryMichal Židek2015-09-033-1/+147
| | | | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2676 Added function to expire entry in sysdb using its DN. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* TESTS: Add trailing whitespace testNikolai Kondrashov2015-09-031-0/+32
| | | | | | | Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove trailing whitespacePavel Reichl2015-09-038-23/+22
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* CONFDB: Assume config file version 2 if missingMichal Židek2015-09-037-44/+29
| | | | | | | | | | Default to config file version 2 if the version is not specified explicitly. Ticket: https://fedorahosted.org/sssd/ticket/2688 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Use sss_unique_file and close fd on failureHEADmasterJakub Hrozek2015-09-011-16/+14
| | | | | | | | The GPO child didn't remove temporary file on failure and didn't close the fd on failure (the latter was not much of a problem for a short-lived child process). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* intg_tests: Add regression test for 2163Lukas Slebodnik2015-09-011-0/+40
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: send less logs to syslogPavel Reichl2015-09-011-0/+42
| | | | | | | | | Create new callback that handles logging messages in cyrus sasl library. Resolves: https://fedorahosted.org/sssd/ticket/2561 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sbus: Add a special error code for messages sent by the bus itselfJakub Hrozek2015-09-014-1/+10
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sbus: Initialize errno if constructing message fails and add debug messagesJakub Hrozek2015-09-011-0/+6
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Don't ignore backslash in usernames with ldap providerLukas Slebodnik2015-09-014-5/+17
| | | | | | | | | | The regression was caused by changing default domain regex for ldap provider in ticket #2717 Resolves: https://fedorahosted.org/sssd/ticket/2772 Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: end on ENOMEMPavel Reichl2015-08-311-0/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssd: incorrect checks on length values during packet decodingMichal Židek2015-08-317-22/+22
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1697 It is safer to isolate the checked (unknown/untrusted) value on the left hand side in the conditions to avoid overflows/underflows. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Function 2string for enum sss_cli_commandPetr Cech2015-08-316-54/+303
| | | | | | | | | | | | Improvement of debug messages. Instead of:"(0x0400): Running command [17]..." We could see:"(0x0400): Running command [17][SSS_NSS_GETPWNAM]..." (It's not used in sss_client. There are only hex numbers of commands.) Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Removing part of responder_cache_req-testsPetr Cech2015-08-311-211/+0
| | | | | | | | | | | | | | | | | | | | If you call cache_req_[user|group]_by_filter_send() it than later calls updated_[users|groups]_by_filter(), which adds filter that is called "recent". This filter causes that only [users|groups] added after the request started are returned. This patch removes tests which use cache_req_[user|group]_by_filter_send(), because the logic of those tests is corrupted. The tests create [users|groups] and after it, they call cache_req_[user|group]_by_filter_send(). So it is obvious that it is not in the right manner. Possible fix is rewrite the tests to create the entries in the callback. Works around: https://fedorahosted.org/sssd/ticket/2730 Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: fix fail in test_id_cleanup_exp_groupPavel Reichl2015-08-311-1/+1
| | | | | | | | | Test was named same as the folder containing its data. Resolves: https://fedorahosted.org/sssd/ticket/2768 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: ldap_id_cleanup timeoutsMichal Židek2015-08-311-4/+7
| | | | | | | | | The one second timeout interval was sometimes too short when the tests where running under Valgrind in the CI and the entries expired too soon. Reviewed-by: Petr Cech <pcech@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-28 10:07:12 +0000