summaryrefslogtreecommitdiffstats
path: root/src/responder
Commit message (Collapse)AuthorAgeFilesLines
...
* Add pre-auth requestSumit Bose2015-05-081-0/+7
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam: handle 2FA authentication token in the responderSumit Bose2015-05-081-0/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: check for overrides before calling backendSumit Bose2015-05-061-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the flag that the input data in a user or group lookup request might be an override value is only set if no cached entry was found. If the cached entry of an object with overrides is expired and a request with the override value as input is processed the flag is not set and the backend might not be able to find the right entry on the server. Typically this should not happen because of mid-point refreshes. To reproduce this create a FreeIPA user and override the login name for a specific view. On a client which has this view applied call getent passwd overridename sss_cache -E getent passwd overridename The second getent command will still show the right output but in the logs a [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 0 error message: Account info lookup failed message can be found for the second request. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* autofs: fix 'Cannot allocate memory' with FQDNsAron Parsons2015-04-301-9/+0
| | | | | | https://fedorahosted.org/sssd/ticket/2643 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: Use negcache for getbysid requestsJakub Hrozek2015-04-241-0/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Option filter_users had no effect for retrieving sudo rulesAdam Tkac2015-04-143-0/+39
| | | | | | | | | Previously sssd_sudo always obtained sudo rules for user from LDAP even when user was enlisted in filter_users. Resolves https://fedorahosted.org/sssd/ticket/2625 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Reset negcache after checking domainsJakub Hrozek2015-04-091-0/+24
| | | | | | | | The NSS responder periodically re-checks subdomains. We need to reset the negative cache each time the check finishes to allow the negative cache to contain entries from different domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-099-15/+45
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Add sss_ncache_reset_repopulate_permanentJakub Hrozek2015-04-092-0/+20
| | | | | | | This new function resets the negative cache and then re-adds the permanent entries. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Silence critical error from filter_users when default_domain_suffix ↵Jakub Hrozek2015-04-091-3/+15
| | | | | | | | | | | | | | | is set When default_domain_suffix is used and filter_users is set (at least root is always, by default), SSSD tried to add the negcache entry to the default domain. But since the default domain is not known after start up, adding the entries fail with a verbose error message. This patch handles EAGAIN returned from the parsing function while setting negcache entries gracefully and also makes the debug message in parsing function more precise. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Fix sss_ncache_reset_permanentJakub Hrozek2015-04-091-1/+1
| | | | | | | There was an off-by-one error in sss_ncache_reset_permanent that prevented the reset from working. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SSH: Ignore the default_domain_suffixJakub Hrozek2015-04-011-1/+1
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2609 In a trust setup, hosts are normally only stored on the IPA server. The default_domain_suffix option is only recommended for the IPA-AD trust scenario as well. Therefore we should ignore this option in the SSH provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com>
* PAC: Remove unused functionLukas Slebodnik2015-03-311-35/+0
| | | | | | The last usage of function dom_sid_in_domain was removed as a part of chages in ticket "Enhance PAC responder for AD users" 92af6f25864b5c389b57d0f659686801b45ca58c
* Fix a few typos in commentsPavel Reichl2015-03-261-4/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-179-15/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* responder_cache: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | | | There is a warning with gcc-5.0 and enabled optimization. Warning is not visible with "-O0". CC src/responder/common/responder_cache_req.o src/responder/common/responder_cache_req.c: In function ‘cache_req_next_domain’: src/responder/common/responder_cache_req.c:296:160: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] src/responder/common/responder_cache_req.c:277:13: note: ‘ret’ was declared here errno_t ret; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_initgr_check_timeout: add debug outputSumit Bose2015-03-131-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use the logon_name as the key for the PAM initgr cacheSumit Bose2015-03-131-13/+3
| | | | | | | | | | | | | Currently the name member of the pam_data struct is used as a key but it can change during a request. Especially for sub-domain users the name is changed from the short to the fully-qualified version before the cache entry is created. As a result the cache searches are always done with the short name while the entry was written with the fully-qualified name. The logon_name member of the pam_data struct contains the name which was send by the PAM client and is never changed during the request. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: return ERR_INTERNAL if more than one entry is foundPavel Březina2015-03-131-1/+1
| | | | | | | This means that the db is not in the expected format thus we should make the error more visible. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: parse input name if neededPavel Březina2015-03-133-25/+119
| | | | | | | | The input name is now parse automatically by cache_req if none particullar domain is specified. The parsed named is returned from _recv as an output parameter. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by idPavel Březina2015-03-132-0/+58
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove default branch from switchesPavel Březina2015-03-131-20/+4
| | | | | | | | | | | | Originaly, the cache_req used enum sss_dp_acct_type to indicate request type but not all types were implemented. Thus we used default branch to indicate unimplemented request type. Now when we switched to a custom enum type we can get rid of the default branch so the compiler can check if all switches contains all values. This proved to be useful during development of new request types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by namePavel Březina2015-03-132-0/+56
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for user by uidPavel Březina2015-03-133-9/+117
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: preparations for different input typePavel Březina2015-03-133-100/+310
| | | | | | | | | Currently cache_req takes only user name as an input parameter. However, this is not enough since we will need also UID and GID in the future. This patch creates a structure to hold input parameters so it can be simply extended to support other input types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-121-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: check return value of confdb_get_stringPavel Reichl2015-02-271-0/+6
| | | | | | Coverity found this neglect. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: print the pam status as string, tooJakub Hrozek2015-02-252-4/+7
| | | | | | | | On several places, let's add a pam_strerror() call so that it's easier to debug user problems. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
* PAM: warn all services about account expirationPavel Reichl2015-02-231-2/+17
| | | | | | | | | | if pam_verbose is above one then output warning about account expiration for all services. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: new option pam_account_expired_messagePavel Reichl2015-02-231-4/+10
| | | | | | | | | | This option sets string to be printed when authenticating using SSH keys and account is expired. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: do not reject abruptlyPavel Reichl2015-02-231-0/+53
| | | | | | | | | If account has expired then pass message. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* RESPONDERS: Warn to syslog about colliding objectsLukas Slebodnik2015-02-182-0/+18
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2203 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sbus: add constant to represent subtreePavel Březina2015-02-172-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: simplify object path constant namesPavel Březina2015-02-176-17/+15
| | | | | | | | | | | | | | | | | | | | The number of interfaces will grow and in order to keep names of object path constant consistent it means that also their names will grow. The new naming schema is: /org/freedesktop/sssd/infopipe -> IFP_PATH_ / -> _ everything uppercase Example: /org/freedesktop/sssd/infopipe/Components/Responders -> IFP_PATH_COMPONENTS_RESPONDERS If the path contains a _TREE suffix, it represents the whole subtree. For example: IFP_PATH_DOMAINS_TREE is /org/freedesktop/sssd/infopipe/Domains/* Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus codegen: do not prefix getters with iface namePavel Březina2015-02-173-57/+57
| | | | | | | | | | | | | | | | | | Prefixing getters with C name of the interface is just redundant since it is the same as the name of the structure that contains those fields. The following structure: struct test_pilot { $type test_pilot_get_name; } changes to: struct test_pilot { $type get_name; } Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: unify generated interfaces namesPavel Březina2015-02-178-214/+213
| | | | | | | | | | | | | | | Number of interfaces will grow. It is mandatory to unify names of generated structures and methods to simplify coding and debugging. The C name is created from D-Bus lowercased interface name using the following rewrite rules: org.freedesktop.sssd.infopipe -> iface_ifp . -> _ Example: org.freedesktop.sssd.infopipe.Domains -> iface_ifp_domains Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: move interface definitions from ifpsrv.c into separate filePavel Březina2015-02-173-76/+112
| | | | | | | Number of IFP interfaces will grown up rapidly in the future. It is not convenient to keep it inside ifpsrv.c. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: use hard coded getters instead of generatedPavel Březina2015-02-171-420/+23
| | | | | | | | | | | | | | | Properties are single value of a small number of predefined D-Bus types. There is no need to generate them with codegen. Actually, the source generator for property getters is already quite mess with branching for array, strings and object paths. Adding any more complex type in the future (such as dictionary) would require even more branching or creating a separate path for it. Hard coding the getters will simplify creating new ones for more complex types. This patch also reduces lots of code duplication and creates a simple function for GetAll. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* fill_id() fix LE/BE issue with wrong data typeSumit Bose2015-01-301-4/+6
| | | | | | Related to https://fedorahosted.org/sssd/ticket/1588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* add missing '\n' in debug messagesPavel Reichl2015-01-271-9/+10
| | | | | | Also reformat debug strings not to exceed 80 columns long lines. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ifp: fix potential memory leak in check_and_get_component_from_path()Pavel Březina2015-01-231-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: add sbus_opath_get_object_name()Pavel Březina2015-01-232-22/+13
| | | | | | | This function assumes that the last component of the object path is an object name. It will return the part unescaped. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: move common opath functions from ifp to sbus codePavel Březina2015-01-234-206/+14
| | | | | | | These functions are quite general thus they may be part of sbus interface. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: unify naming of handler data variablePavel Březina2015-01-231-26/+26
| | | | | | | | | We used three different names to express handler data: - pvt - instace_data - handler_data Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: add object path to sbus requestPavel Březina2015-01-232-14/+8
| | | | | | | | | Object path is heavily used in implementation of methods from interfaces that are supported on whole subtrees. Although it can be obtained from a D-Bus message, it is nice to have it accessible directly. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: use 'path/*' to represent a D-Bus fallbackPavel Březina2015-01-232-2/+2
| | | | | | | | | | | | | | | | | | | | | Use 'path/*' instead of 'path*' since it better describes what we are actually doing i.e. registering a message handler for a subtree. Although D-Bus fallback will invoke a message handler for both 'path' and 'path/subtree' object paths it does not make usually sence to support the same interfaces for both parent and it children. This commit also renames related functions to better describe what are they doing. Note: the tilda in comments is used to suppress -Wcomment warning Preparation for: https://fedorahosted.org/sssd/ticket/2339 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: add new iface via sbus_conn_register_iface()Pavel Březina2015-01-232-19/+4
| | | | | | | | | | | | | | | | | | | Rename sbus_conn_add_interface() to sbus_conn_register_iface() and remove sbus_new_interface() calls since it is just one more unnecessary call outside the sbus code. The function sbus_new_interface() is made static and used directly in sbus_conn_register_iface(). The name was chosen to better describe what the function is doing. That it registers an interface on a given object path. The same interface can be used with different paths so it is not really about adding an interface. Preparation for: https://fedorahosted.org/sssd/ticket/2339 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: fix SID lookupsSumit Bose2015-01-231-1/+9
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: Add original DN and memberOf to origbyname requestSumit Bose2015-01-201-0/+4
| | | | | | | | | IPA HBAC evaluation relies on the original values for DN and memberOf attributes. Resolves https://fedorahosted.org/sssd/ticket/2560 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: refactor fill_orig()Sumit Bose2015-01-201-67/+66
| | | | | | The two loops in fill_orig were almost identical. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-10 19:41:38 +0000