summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-2117-24/+24
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Test offline netgroups resolutionJakub Hrozek2016-09-211-2/+27
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Fix offline resolution of netgroupsJakub Hrozek2016-09-211-0/+9
| | | | | | | | | | | If talking to the Data Provider failed, we never re-tried looking into the cache. We should consult the cache on DP failures and return cached results, if possible. Resolves: https://fedorahosted.org/sssd/ticket/3123 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AUTOFS: Fix offline resolution of autofs mapsJakub Hrozek2016-09-211-4/+12
| | | | | | | | | | | If talking to the Data Provider failed, we never re-tried looking into the cache. We should consult the cache on DP failures and return cached results, if possible. Resolves: https://fedorahosted.org/sssd/ticket/3080 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Add integration tests for the sssd-secretsJakub Hrozek2016-09-205-0/+309
| | | | | | | | | | | Implements a simple HTTP client and uses it to talk to the sssd-secrets responder. Only the local provider is tested at the moment. Resolves: https://fedorahosted.org/sssd/ticket/3054 Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAKEFILE: Fixing CFLAGS in some testsPetr Čech2016-09-191-0/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Fixing of 'const' warnings in sbus testsPetr Čech2016-09-192-8/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: call free only when memory is expected to be allocatedSumit Bose2016-09-191-1/+2
| | | | | | Reborted by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Don't remove a container when it has childrenFabiano Fidêncio2016-09-161-2/+31
| | | | | | | | | | | | | | | | | | Let's return and log an error in case the container to be removed has children. The approach taken introduced at least one new search in every delete operation. As far as I understand searching in the BASE scope is quite cheap and that's the reason I decided to just do the search in the ONELEVEL scope when the requested to be deleted dn is for sure a container. Resolves: https://fedorahosted.org/sssd/ticket/3167 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: check PKCS11_LOGIN_TOKEN_NAMESumit Bose2016-09-161-0/+65
| | | | | | | | | Check if PKCS11_LOGIN_TOKEN_NAME is set and prompt the user if the matching Smartcard is not inserted. Related to https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: return a fully-qualified nameSumit Bose2016-09-162-19/+17
| | | | | | Related to https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: only set PKCS11_LOGIN_TOKEN_NAME if gdm-smartcard is usedSumit Bose2016-09-162-25/+97
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: sssd-sudo manual update IPA native LDAP tree supportJustin Stephenson2016-09-161-3/+6
| | | | | | | | | | Update sssd-sudo man page to reflect native IPA sudo support Resolves: https://fedorahosted.org/sssd/ticket/3145 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Return partial results from adminlimit exceededJakub Hrozek2016-09-141-1/+2
| | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3185 Since commit c420ce830ac0b0b288a2a887ec2cfce5c748018c we try to move to the next server on any error on the connection, which in case there is only one server sends SSSD offline. It's more graceful to try to process the results, same as we already do with sizelimit exceeded. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Search by the right type when checking containersFabiano Fidêncio2016-09-131-1/+2
| | | | | | | | | | | | | | | We've been searching for the wrong type ("simple") in local_db_check_containers(), which always gives us a NULL result. Let's introduce the new LOCAL_CONTAINER_FILTER and do the search for the right type ("container") from now on. Resolves: https://fedorahosted.org/sssd/ticket/3137 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-136-2/+42
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Fix settig paging attribute in sdap_get_generic_ext_sendLukas Slebodnik2016-09-131-3/+3
| | | | | | | | | We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: Return ERR_NETWORK_IO on clock skewJakub Hrozek2016-09-131-0/+2
| | | | | | | | | | | Adds two more return codes to the list of codes we translate to ERR_NETWORK_IO. Resolves: https://fedorahosted.org/sssd/ticket/3174 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: sss_groupshow with MPGMichal Židek2016-09-131-0/+22
| | | | | | | | | Regression test for ticket #3184 Resolves: https://fedorahosted.org/sssd/ticket/3184 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: sss_groupshow fails to show MPGMichal Židek2016-09-131-2/+10
| | | | | | | | | | | The MPG search uses it's own search function that used sysdb operation with shortname, but it expects internal fqname. Resolves: https://fedorahosted.org/sssd/ticket/3184 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TEST: Add regression test for ticket #3179Michal Židek2016-09-131-12/+114
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3179 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TOOLS: sss_override without name overrideMichal Židek2016-09-131-10/+14
| | | | | | | | | | sss_override failed to export user/group overrides if user had no overrides for name. Resolves: https://fedorahosted.org/sssd/ticket/3179 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Add disable_netlink optionJustin Stephenson2016-09-127-4/+42
| | | | | | | | | | | | Adding a new monitor boolean option to disable netlink support. This will give users more control over sssd state changes without having to modify systemd unit files. Resolves: https://fedorahosted.org/sssd/ticket/3142 Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Remove --disable-netlink command-line optionJustin Stephenson2016-09-122-24/+20
| | | | | | | | Removing monitor command-line option, to be superceded by sssd.conf option Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Send the output username, not internal fqname to krb5_childJakub Hrozek2016-09-084-11/+30
| | | | | | | | | | | | | | | | | | krb5_child calls krb5_kuserok() during the access phase which checks if a particular user is allowed to authenticate as a particular principal. We used to pass the internal fqname to krb5_kuserok() which broke the functionality and all users were denied access. This patch changes that to send the 'output' username to krb5_child, because that's the username the system receives through getpwnam() or getpwuid() anyway. The patch also adds a new structure member fo the krb5child_req structure to avoid reusing the pd->user variable but have an explicit one that serves as the input for the child process. Resolves: https://fedorahosted.org/sssd/ticket/3172 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add FQDN variants for some testsMichal Židek2016-09-071-0/+83
| | | | | | Adds FQDN variants of some already existing tests. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: sss_mc_refresh_nested_group short/fqname usageMichal Židek2016-09-071-19/+47
| | | | | | | | | | | We use shortname to refresh memory cache, but in case of nested groups, we used internal_fqname to refresh parent groups. We also wrongly used the shortname for sysdb_search operation. Which caused error message to be printed when sss_usermod -a or sss_groupmod -a where called. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Test for sss_user/groupmod -aMichal Židek2016-09-071-0/+36
| | | | | | | | | Regression tests for ticket #3178. Resolves: https://fedorahosted.org/sssd/ticket/3178 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: use internal fqdn for DNMichal Židek2016-09-071-1/+10
| | | | | | | | | Use internal fqdn when creating sysdb group dn. Resolves: https://fedorahosted.org/sssd/ticket/3178 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: sss_groupadd/groupshow regressionsMichal Židek2016-09-071-0/+26
| | | | | | | | | | Adds regression CI test for ticket #3173 and #3175. Resolves: https://fedorahosted.org/sssd/ticket/3173 https://fedorahosted.org/sssd/ticket/3175 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: sss_groupshow did not workMichal Židek2016-09-071-2/+11
| | | | | | | | | | | | sss_groupshow used shortname to search in sysdb database. We have to u e sysdb_fqname (aka internal_fqname) format for all sysdb oprations. Resolves: https://fedorahosted.org/sssd/ticket/3175 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: Fix a typo in groupadd()Jakub Hrozek2016-09-071-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3173 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Suppress warning from clang static analyserLukas Slebodnik2016-09-021-1/+1
| | | | | | | | | | | | scan-build wrongly assumes that output variable "version" is not initialized if function sysdb_cache_connect returns ERR_SYSDB_VERSION_TOO_OLD or ERR_SYSDB_VERSION_TOO_NEW The reality is that output variable "version" is initialized especially for these two case. Initialisation to NULL suppresses these false positive reports. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Removing of unused parameterPetr Čech2016-09-011-3/+1
| | | | | | | | | | | There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_initgr_nested_get_membership_diff: use fully-qualified namesSumit Bose2016-09-011-1/+1
| | | | | | | | | | | | I think this is a leftover from the change to use fully-qualified names in sysdb. To verify this you can create a nested group in IPA. Without this patch the id command will only show the groups the user is a direct member of. With the patch the indirect groups memberships should be shown as well. https://fedorahosted.org/sssd/ticket/3163 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document the ldap_user_primary_group optionJakub Hrozek2016-09-011-0/+15
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DEBUG: Apend line feed to messages from libsemanageLukas Slebodnik2016-09-011-1/+2
| | | | | | | It wasn't simple to read log files from libsemanage because they were on single line. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Fix error handling in sysdb_get_user_members_recursivelyLukas Slebodnik2016-08-312-1/+7
| | | | | | We ignored failures from sysdb_search_entry Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove leftovers from kill_serviceFabiano Fidêncio2016-08-314-16/+0
| | | | | | | | | | | | | | | Seems that wen I sent the v2 of ac35fe74 I attached the wrong pacth that ended up being pushed. The patch was incomplete as there are still some leftovers. The .po and sssd-docs.pot were not touched as I do believe they are autogenerated from Zanata. Related: https://fedorahosted.org/sssd/ticket/3052 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove leftovers from diag_cmdFabiano Fidêncio2016-08-314-12/+0
| | | | | | | | | | | | Seems that when I sent the v2 of 7579cf99 I attached the wrong patch that ended up being pushed. That patch was incomplete as there are still some leftovers. Related: https://fedorahosted.org/sssd/ticket/3051 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* netlink: Don't define USE_GNUJakub Hrozek2016-08-301-1/+2
| | | | | | | | | | | Applications should never #define USE_GNU themselves, but rather _GNU_SOURCE. This patch removes USE_GNU and replaces it with including config.h which has _GNU_SOURCE defined if applicable for that platform See for example: https://gcc.gnu.org/ml/fortran/2005-10/msg00365.html Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* dyndns: fix typo and unify ipa with ad debug message when offPavel Březina2016-08-302-2/+2
| | | | | Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Make reading the config options more uniformJakub Hrozek2016-08-301-1/+1
| | | | | | | | One of confdb_get_ calls in sec_get_config() used a variable referenced from rctx, the other used a hardcoded string. Use one of them on both places instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SECRETS: Make internal function staticJakub Hrozek2016-08-301-1/+2
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PROXY: Use right name in ldap filterLukas Slebodnik2016-08-301-3/+8
| | | | | | | | | | | | We used internal fq name in ldap filter with id_provider proxy to files and auth provider ldap [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com]. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* WATCHDOG: define and use _MAX_TICKS as 3Jakub Hrozek2016-08-301-3/+3
| | | | | | | Instead of using the number 3 directly, let's introduce and use WATCHDOG_MAX_TICKS. Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove the no longer used kill_service commandJakub Hrozek2016-08-303-175/+0
| | | | | | | | | | After introducing the watchdog, the force_timeout option is no longer used. Resolves: https://fedorahosted.org/sssd/ticket/3052 Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove the no longer used diag_cmd commandJakub Hrozek2016-08-302-164/+0
| | | | | | | | | | | After introducing the watchdog, the diag_cmd is longer used and makes no sense trying to make it usable by watchdog as the result of "pstack %p" seems next to useless in this context. Related: https://fedorahosted.org/sssd/ticket/3051 Reviewed-by: Petr Čech <pcech@redhat.com>
* BUILD: Remove leftover after sysdb refactoringLukas Slebodnik2016-08-291-1/+0
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Fix typo in intgcheck-run ruleFabiano Fidêncio2016-08-291-1/+1
| | | | | | | | During the review process "intgcheck-build" ended up being merged to the "intgcheck-prepare" rule. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-18 13:14:08 +0000