summaryrefslogtreecommitdiffstats
path: root/src/config
Commit message (Collapse)AuthorAgeFilesLines
* SECRETS: Add a configurable limit of secrets that can be storedFabiano Fidêncio2016-10-053-0/+3
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3169 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Add a configurable depth limit for nested containersFabiano Fidêncio2016-10-033-0/+3
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3168 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: Add secrets provider optionsFabiano Fidêncio2016-10-033-2/+27
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/3207 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: List allowed secrets responder optionsJakub Hrozek2016-10-031-0/+27
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3207 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: Add secrets responder to the allowed sectionsFabiano Fidêncio2016-10-031-0/+1
| | | | | | | | | | | | | | | | | The regular expression used is quite specific for the two cases we support: - [secrets] - [secrets/users/$uid] It could be done a bit more generic, but the way it's right now it can easily catch errors like: [secrets/usrs/$uid] or [secrets/]. Related: https://fedorahosted.org/sssd/ticket/3207 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSDConfig: Do not fail with nonexisting domains/servicesLukas Slebodnik2016-09-223-2/+48
| | | | | | | | | | dict.keys() returns iterator in python3 and not list Chaging data in dictionary while using iterator fails with "RuntimeError: dictionary changed size during iteration" https://fedorahosted.org/sssd/ticket/3107 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-133-0/+5
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Add disable_netlink optionJustin Stephenson2016-09-124-1/+5
| | | | | | | | | | | | Adding a new monitor boolean option to disable netlink support. This will give users more control over sssd state changes without having to modify systemd unit files. Resolves: https://fedorahosted.org/sssd/ticket/3142 Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Remove leftovers from kill_serviceFabiano Fidêncio2016-08-314-16/+0
| | | | | | | | | | | | | | | Seems that wen I sent the v2 of ac35fe74 I attached the wrong pacth that ended up being pushed. The patch was incomplete as there are still some leftovers. The .po and sssd-docs.pot were not touched as I do believe they are autogenerated from Zanata. Related: https://fedorahosted.org/sssd/ticket/3052 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* MONITOR: Remove leftovers from diag_cmdFabiano Fidêncio2016-08-314-12/+0
| | | | | | | | | | | | Seems that when I sent the v2 of 7579cf99 I attached the wrong patch that ended up being pushed. That patch was incomplete as there are still some leftovers. Related: https://fedorahosted.org/sssd/ticket/3051 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Petr Čech <pcech@redhat.com>
* CONFIG: session_provider does not exist anymoreJakub Hrozek2016-08-234-5/+0
| | | | | | | | | The session_provider used to exist a long time ago when we used to set the SELinux context from it, but the provider had been removed for a long time. We just forgot to remove the value from the config API and the validator. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: selinux_provider is a valid provider typeJakub Hrozek2016-08-234-0/+5
| | | | | | | We should not warn about it in the validator and should allow selinux_provider from the config API. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* AD_PROVIDER: Add ad_enabled_domains optionPetr Cech2016-08-173-0/+3
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIG: re_expression is an allowed option for all domainsJakub Hrozek2016-08-124-0/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIG: full_name_format is an allowed option for all domainsJakub Hrozek2016-08-124-0/+5
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config_schema: Add ldap_user_email to schemaLukas Slebodnik2016-08-101-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* LDAP: new attribute option ldap_user_emailSumit Bose2016-07-294-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* config: Add config_file_version to schemaMichal Židek2016-07-123-0/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: Allow timeout for all sevicesMichal Židek2016-07-122-1/+8
| | | | | | | | | | Allow option "timeout" for all sevices. Also remove unused macro CONFDB_SERVICE_TIMEOUT. Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: Fix user_attributesMichal Židek2016-07-123-2/+3
| | | | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/3068 Option user_attributes is also available in NSS responder, but not in PAC responder. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config: override_space is monitor's optionMichal Židek2016-07-124-4/+5
| | | | | | | | | | We read override_space from [sssd] not [nss] section. Resolves: https://fedorahosted.org/sssd/ticket/3068 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Monitor: Remove ping infrastructureSimo Sorce2016-06-291-1/+1
| | | | | | | | | | | Now thast services use an internal watchdog we do not need pings anymore, this will cut down the chatter and allow more flexible process management, for example socket activation and exit-on-idle. Resolves: https://fedorahosted.org/sssd/ticket/2921 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Prepare ini schema with rules for validationLukas Slebodnik2016-06-271-0/+615
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2028 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DEBUG: Add `debug` alias for debug_levelStephen Gallagher2016-06-163-0/+6
| | | | | | | | | | | | | Our users constantly make the mistake of typing `debug = 9` in the sssd.conf instead of `debug_level = 9` as would be correct. This happens frequently-enough that we should just alias it rather than continue to have people make mistakes. Resolves: https://fedorahosted.org/sssd/ticket/2999 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Petr Cech <pcech@redhat.com>
* RESPONDERS: Negative caching of local usersPetr Cech2016-06-102-0/+2
| | | | | | | | | | | This patch adds new option 'neg_cache_locals_timeout' into section of NSS responder. It allows negative caching of local groups and users. Default value is 0 which means no caching. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* p11: add missing man page entry and config APISumit Bose2016-06-092-0/+4
| | | | | | | The pam_cert_auth and pam_cert_db_path option where missing in the config API and had no man page entries. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAC: only save PAC blob into the cacheSumit Bose2016-04-132-0/+2
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2158 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-091-0/+1
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-244-0/+4
| | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Pass account lockout status and display messagePavel Reichl2016-02-172-0/+2
| | | | | | | | | Tested against Windows Server 2012. Resolves: https://fedorahosted.org/sssd/ticket/2839 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IDMAP: Add support for automatic adding of rangesPavel Reichl2016-01-204-0/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: add task to renew the machine account password if neededSumit Bose2016-01-192-0/+4
| | | | | | | | | | | | | | | | | | AD expects its clients to renew the machine account password on a regular basis, be default every 30 days. Even if a client does not renew the password it might not cause issues because AD does not enforce the renewal. But the password age might be used to identify unused machine accounts in large environments which might get disabled or deleted automatically. With this patch SSSD calls an external program to check the age of the machine account password and renew it if needed. Currently 'adcli' is used as external program which is able to renew the password since version 0.8.0. Resolves https://fedorahosted.org/sssd/ticket/1041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmd mappingPavel Březina2016-01-191-0/+4
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmdgrp mappingPavel Březina2016-01-191-0/+5
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudorule mappingPavel Březina2016-01-191-0/+20
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Add autofs providerJakub Hrozek2015-11-262-1/+11
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1632 Adds the possibility to configure: autofs_provider = ad The AD autofs provider uses the rfc2307 (nis*) attribute maps. This is different (at the moment) from using autofs_provider=ldap with ldap_schema=ad. Reviewed-by: Ondrej Valousek <ondrejv2@fedoraproject.org> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* p11: enable ocsp checksSumit Bose2015-11-263-1/+4
| | | | | | | | | | | This patch enables the Online Certificate Status Protocol in NSS and adds an option to disable it if needed. To make further tuning of certificate verification more easy it is not an option on its own but an option to the new certificate_verification configuration option. Resolves https://fedorahosted.org/sssd/ticket/2812 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSD: Add a new option diag_cmdJakub Hrozek2015-11-133-0/+3
| | | | | | | | | | | | | | | | | | | | This option is an optional one that is run when a sbus ping times out and before a SIGKILL signal is sent. It is undocumented by default. diag_cmd (string): A command that should be run for diagnostic purpose when an sbus timeout fails. The option value may contain %p which would be expanded for the process ID of the process that timed out Example: pstack %p This setting would print the stackstrace of the service whose ping timed out. Default: not set. Reviewed-by: Petr Cech <pcech@redhat.com>
* SSSDConfigTest: Test real config without config_file_versionLukas Slebodnik2015-10-192-0/+107
| | | | | | | | | src/config/testconfigs/sssd-valid.conf explicitly contains config_file_version. Recently we changed the default value to 2 and therefore it needn't be listed in configuration file. This patch test real sssd.conf without config_file_version. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSDConfigTest: Try load saved configLukas Slebodnik2015-10-191-1/+11
| | | | | | | | | | Python module SSSDConfig should be able to save configuration file and later load the same configuration file without problem. Unit test for: https://fedorahosted.org/sssd/ticket/2837 Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSDConfig: Do not raise exception if config_file_version is missingMichal Židek2015-10-192-9/+4
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2837 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Make p11_child timeout configurableMichal Židek2015-09-232-0/+2
| | | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2773 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CONFDB: Assume config file version 2 if missingMichal Židek2015-09-033-15/+4
| | | | | | | | | | Default to config file version 2 if the version is not specified explicitly. Ticket: https://fedorahosted.org/sssd/ticket/2688 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DYNDNS: Add a new option dyndns_serverJakub Hrozek2015-08-143-0/+4
| | | | | | | | | | | Some environments use a different DNS server than identity server. For these environments, it would be useful to be able to override the DNS server used to perform DNS updates. This patch adds a new option dyndns_server that, if set, would be used to hardcode a DNS server address into the nsupdate message. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sudo: use "higher value wins" when ordering rulesPavel Březina2015-08-142-0/+2
| | | | | | | | | | | | This commit changes the default ordering logic (lower value wins) to a correct one that is used by native ldap support. It also adds a new option sudo_inverse_order to switch to the original SSSD (incorrect) behaviour if needed. Resolves: https://fedorahosted.org/sssd/ticket/2682 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSDConfig: Return correct types in python3Lukas Slebodnik2015-08-042-2/+4
| | | | | | | | | | In Python 3, dict.keys() returns a view rather than a list. Since dict keys aren't in any particular order, indexing them doesn't make sense. Resolves: https://fedorahosted.org/sssd/ticket/2699 Reviewed-by: Christian Heimes <cheimes@redhat.com>
* ssh: generate public keys from certificateSumit Bose2015-07-312-0/+2
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2711 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Add the wildcard_limit optionJakub Hrozek2015-07-154-0/+4
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds a new wildcard_limit option that is set by default to 1000 (one page). This option limits the number of entries that can by default be returned by a wildcard search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: authenticate agains cachePavel Reichl2015-07-063-2/+6
| | | | | | | | | | | Enable authenticating users from cache even when SSSD is in online mode. Introduce new option `cached_auth_timeout`. Resolves: https://fedorahosted.org/sssd/ticket/1807 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 05:29:31 +0000