summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5/krb5_utils.h
Commit message (Collapse)AuthorAgeFilesLines
* krb5: new option krb5_map_userPavel Reichl2015-05-281-0/+5
| | | | | | | | | | New option `krb5_map_user` providing mapping of ID provider names to Kerberos principals. Resolves: https://fedorahosted.org/sssd/ticket/2509 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Move checking for illegal RE to krb5_utils.cJakub Hrozek2014-11-181-2/+2
| | | | | | | | | | | | Otherwise we would have to link krb5_child with pcre and transfer the regex, which would be cumbersome. Check for illegal patterns when expanding the template instead. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move ccache-related functions to krb5_ccache.cJakub Hrozek2014-11-181-15/+0
| | | | | | | | | | | | | Add a new module krb5_ccache.c that contains all ccache-related operations. The only user of this module shall be krb5_child.c as the other modules will run unprivileged and accessing the ccache requires either privileges of root or the ccache owner. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-101-8/+0
| | | | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: Remove ability to create public directoriesSimo Sorce2013-10-071-3/+3
| | | | | | | | | Setting up public directories is the job of the admin, and current sssd syntax can't express the actual intention of the admin with regrads to which parts of the path should be public or private. Resolves: https://fedorahosted.org/sssd/ticket/2071
* KRB: Remove unused memory contextLukas Slebodnik2013-09-121-1/+1
| | | | mem_ctx was unused in function get_domain_or_subdomain
* krb5: Remove unused ccache backend infrastructureSimo Sorce2013-09-091-17/+0
| | | | | | | | Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Unify function to create ccache filesSimo Sorce2013-09-091-12/+2
| | | | | | | | | | | Only 2 types (FILE and DIR) need to precreate files or directories on the file system, and the 2 functions were basically identical. Consolidate all in one common function and use that function directly where needed instead of using indirection. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use new function to validate ccachesSimo Sorce2013-09-091-4/+2
| | | | | | | | | | This function replaces and combines check_for_valid_tgt() and type specific functions that checked for ccache existence by using generic krb5 cache function and executing them as the target user (implicitly validate the target use rcan properly access the ccache). Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: move template check to initializzationSimo Sorce2013-09-091-1/+1
| | | | | | | | | | | | The randomized template check realy only makes sense for the FILE ccache which is the only one that normally needs to use randomizing chars. Also it is better to warn the admin early rather than to warn 'when it is too late'. So move the check at initialization time when we determine what the template actually is. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Move determination of user being activeSimo Sorce2013-09-091-2/+1
| | | | | | | | The way a user is checked for being active does not depend on the ccache type so move that check out of the ccache specific functions. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Replace type-specific ccache/principal checkSimo Sorce2013-09-091-4/+2
| | | | | | | | | Instead of having duplicate functions that are type custom use a signle common function that also performs access to the cache as the user owner, implicitly validating correctness of ownership. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use krb5_cc_destroy to remove old ccachesSimo Sorce2013-09-091-2/+0
| | | | | | | | | This completely replaces the per-ccache-type custom code to remove old cacches and instead uses libkrb5 base doperations (krb5_cc_destroy) and operating as the user owner. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add helper to destroy ccache as userSimo Sorce2013-09-091-0/+2
| | | | | | | | | | | This function safely destroy a ccache given a cache name and user crdentials. It becomes the user so no possible races can compromise the system, then uses libkrb5 functions to properly destroy a ccache, independently of the cache type. Finally restores the original credentials after closing the ccache handlers. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add calls to change and restore credentialsSimo Sorce2013-09-091-0/+6
| | | | | | | | In some cases we want to temporarily assume user credentials but allow the process to regain back the original credentials (normally regaining uid 0). Related: https://fedorahosted.org/sssd/ticket/2061
* KRB5: Add support for KEYRING cache typeStephen Gallagher2013-08-271-0/+2
| | | | https://fedorahosted.org/sssd/ticket/2036
* KRB5: Add new #define for collection cache typesStephen Gallagher2013-08-221-2/+2
| | | | | | Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
* KRB5: guess UPN for subdomain usersJakub Hrozek2013-06-271-1/+1
|
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-191-2/+2
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Add domain argument to sysdb_get_user_attr()Simo Sorce2013-01-151-0/+1
|
* krb5_auth: update with correct UPN if neededSumit Bose2012-10-261-0/+4
| | | | | | | | | The Active Directory KDC handles request case in-sensitive and it might not always to possible to guess the UPN with the correct case. We check if the returned principal has a different case then the one used in the request and updates the principal if needed. This will help using calls from the Kerberos client libraries later on which would otherwise fail because the principal is handled case sensitive by those libraries.
* Add new call find_or_guess_upn()Sumit Bose2012-10-261-0/+5
| | | | | | | | | With the current approach the upn was either a pointer to a const string in a ldb_message or a string created with the help of talloc. This new function always makes it a talloc'ed value. Additionally krb5_get_simple_upn() is enhanced to handle sub-domains as well.
* krb5_auth_send: check for sub-domainsSumit Bose2012-10-261-0/+3
| | | | | | If there is an authentication request for a user from a sub-domain a temporary sysdb context is generated to allow lookups in the corresponding sub-tree in the cache.
* Log possibly non-randomizable ccache file templateOndrej Kos2012-10-041-1/+2
| | | | | | | fixes https://fedorahosted.org/sssd/ticket/1533 ccache file template is now checked for appended XXXXXX for use with mkstemp. When those characters are not present, warning is written to log.
* KRB5: Auto-detect DIR cache support in configureStephen Gallagher2012-06-151-4/+11
| | | | | | We can't support the DIR cache features in systems with kerberos libraries older than 1.10. Make sure we don't build it on those systems.
* Add support for storing credential caches in the DIR: back endJakub Hrozek2012-06-141-0/+7
| | | | https://fedorahosted.org/sssd/ticket/974
* Add a credential cache back end structureJakub Hrozek2012-06-141-4/+29
| | | | | | To be able to add support for new credential cache types easily, this patch creates a new structure sss_krb5_cc_be that defines common operations with a credential cache, such as create, check if used or remove.
* Honor case sensitive flag when creating the ccname templateJakub Hrozek2011-12-211-1/+1
|
* Check ccache file for renewable TGTs at startupSumit Bose2011-02-221-0/+3
|
* Add expandable sequences to krb5_ccachedirSumit Bose2010-03-111-1/+5
| | | | | | | As with krb5_ccname_template sequences like %u can be used in the krb5_ccachedir parameter which are expanded at runtime. If the directory does not exist, it will be created. Depending on the used sequences it is created as a public or private directory.
* Rename server/ directory to src/Stephen Gallagher2010-02-181-0/+39
Also update BUILD.txt
generated by cgit (git 2.34.1) at 2025-08-29 04:51:42 +0000