summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* p4tokenOndrej Kos2013-08-291-0/+4
| | | | | | | E xplanation R esolves: h ttps://fedorahosted.org/sssd/ticket/XXXX
* p3Ondrej Kos2013-08-281-21/+11
| | | | | | | Explanation Resolves: https://fedorahosted.org/sssd/ticket/XXXX
* p2Ondrej Kos2013-08-281-11/+27
| | | | | | | Explanation Resolves: https://fedorahosted.org/sssd/ticket/XXXX
* p1Ondrej Kos2013-08-281-4/+2
| | | | | | | Explanation Resolves: https://fedorahosted.org/sssd/ticket/XXXX
* DB: Add user/group lookup by SIDOndrej Kos2013-08-283-23/+156
|
* BUILD: Remove unnecessary patch and configure optsSimo Sorce2013-08-283-31/+0
| | | | | | | | | Now that we use the libkrb5 defaults for the default ccname template we do not need the patch that changes the man pages defaults nor the configure options to change sssd defaults anymore. Related: https://fedorahosted.org/sssd/ticket/2036
* krb5: Fetch ccname template from krb5.confStephen Gallagher2013-08-2810-16/+182
| | | | | | | | | | | | | In order to use the same defaults in all system daemons that needs to know how to generate or search for ccaches we introduce ode here to take advantage of the new option called default_ccache_name provided by libkrb5. If set this variable we establish the same default for all programs that surce it out of krb5.conf therefore providing a consistent experience across the system. Related: https://fedorahosted.org/sssd/ticket/2036
* krb5_common: Refactor to use a talloc temp contextSimo Sorce2013-08-281-12/+28
| | | | | | | | In preparation for handling some more allocations in the following patches and fixes a curent memleak on the opts struct. Related: https://fedorahosted.org/sssd/ticket/2036
* BUILD: Ignore translations when building RPMsStephen Gallagher2013-08-271-0/+6
| | | | | | | When we're running 'make rpms' for development purposes, the nested call to 'make distdir' ends up forcing an update of the translation pot files. With this patch, we'll automatically ignore them during (S)RPM actions.
* KRB5: Add support for KEYRING cache typeStephen Gallagher2013-08-277-6/+245
| | | | https://fedorahosted.org/sssd/ticket/2036
* KRB5: Remove unnecessary call to become_user()Stephen Gallagher2013-08-271-6/+0
| | | | | | | | By the time that the create_ccache_in_dir() routine is called, we are already guaranteed to have dropped privileges. This has either happened because we dropped them before the exec() in the normal operation case or because we dropped them explicitly after we completed the TGT validation step if that or FAST is configured.
* KRB5: Add low-level debugging to sss_get_ccache_name_for_principalStephen Gallagher2013-08-271-0/+6
|
* sudo: do not strdup usn on ENOENTsid2Pavel Březina2013-08-261-1/+1
| | | | | | If USN attribute is not present, we call strdup on uninitialized variable. This may cause segfault, or if we are lucky and usn is NULL it will return ENOMEM.
* sudo: do not fail to store the rule if we can't read usnPavel Březina2013-08-261-3/+4
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2052
* PAC: Skip SIDs that cannot be resolved to domainJakub Hrozek2013-08-261-2/+4
|
* PAC: use SID instead of GID to search for groupsSumit Bose2013-08-261-48/+41
| | | | | | | With the support of POSIX IDs managed on the AD side we may find non-POSIX groups, i.e. groups which do not have a GID assigned in AD, in the PAC. Since in this case all cached groups have a SDI attribute it is more reliable to search the groups by SID instead of GID.
* PAC: do not fail if a single group cannot be added/removedSumit Bose2013-08-261-18/+31
| | | | | When processing a list of groups we try to process as much as possible only not stop on the first error.
* PAC: read user DN instead of constructing itSumit Bose2013-08-261-5/+17
| | | | | | To avoid issues with case-sensitivity it is more reliable to search the user entry in the cache and use the returned DN instead of constructing it.
* PAC: handle non-POSIX groups in cacheSumit Bose2013-08-262-11/+9
| | | | | Since the DN of the group is used to remove a membership it is not necessary to check if the GID is valid.
* PAC: do not create users with missing GIDSumit Bose2013-08-261-0/+14
| | | | | If the user entry does not exist in the cache and a primary GID cannot be found it does not make sense to create a user entry.
* PAC: if user entry already exists keep itSumit Bose2013-08-263-86/+10
| | | | | | | | | | | | | | | | | Currently the PAC responder deletes a user entry and recreates it if some attributes seems to be different. Two of the attributes where the home directory and the shell of the user. Those two attributes are not available from the PAC but where generates by the PAC responder. The corresponding ID provider might have better means to determine those attributes, e.g. read them from LDAP, so we shouldn't change them here. The third attribute is the user name. Since the PAC responder does lookups only based on the UID we can wait until the ID provider updates the entry. Fixes https://fedorahosted.org/sssd/ticket/1996
* DP: Notify propperly when removing PAC responderOndrej Kos2013-08-242-1/+5
| | | | | Adds pac_cli be_client structure pointer, to indetify and log the PAC responder termination correctly.
* MAN: AD provider only supports trusted domains from the same forestJakub Hrozek2013-08-241-0/+5
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2044
* check_cc_validity: make sure _valid is always setSumit Bose2013-08-241-5/+7
| | | | | In the KRB5_FCC_NOFILE code path _valid is not set leading to 'may be used uninitialized' compiler warnings.
* pam: Bad debug message format and parameter.Michal Zidek2013-08-221-1/+2
|
* Fix memory leak insss_krb5_get_error_messageLukas Slebodnik2013-08-221-0/+1
| | | | warning reported by cppcheck
* Use brackets around macros.Lukas Slebodnik2013-08-222-8/+8
| | | | warnings reported by cppcheck.
* Remove include recursionLukas Slebodnik2013-08-222-3/+0
| | | | | | | | | | | | | | | warning reported by coverity include_recursion: #include file "src/providers/dp_backend.h" includes itself: dp_backend.h -> dp_refresh.h -> dp_backend.h (other events go to each file) primary_file: During compilation of file 'src/krb5_plugin/sssd_krb5_locator_plugin.c include_recursion: #include file "src/providers/dp_backend.h" includes itself: dp_backend.h -> dp_refresh.h -> dp_ptask.h -> dp_backend.h (other events go to each file) primary_file: During compilation of file 'src/krb5_plugin/sssd_krb5_locator_plugin.c'
* proxy: Allow initgroup to return NOTFOUNDSimo Sorce2013-08-221-0/+16
| | | | | | | | | When the user is only member of its own primary group, initgroups_dyn may return NOTFOUND as, at least for the 'files' nss provider the code skips the passed in group. Resolves: https://fedorahosted.org/sssd/ticket/2051
* mmap_cache: Use sss_atomic_write_s instead of write.Michal Zidek2013-08-221-2/+11
| | | | | | | | Use sss_atomic_write_s() instead of write() in sss_mc_save_corrupted(). Also unlink() the file if no data were written. It is better to use sss_atomic_write_s instead of write
* KRB5: Only set active and valid on successStephen Gallagher2013-08-221-6/+5
| | | | | | | | The FILE cache only sets the return values of _active and _bool if the entire function succeeds. The DIR cache was setting it even on failure. This patch makes both consistent. This will benefit static analysis tools which would be able to detect if the variable is ever used uninitialized anywhere.
* KRB5: Refactor cc_*_check_existingStephen Gallagher2013-08-221-61/+59
| | | | | | | | | | | | | | There was duplicated code in cc_file_check_existing() and in cc_dir_check_existing(). I pulled them into the same function. There are two changes made to the original code here: 1) Fixes a use-after-free bug in cc_file_check_existing(). In the original code, we called krb5_free_context() and then used that context immediately after that in krb5_cc_close(). This patch corrects the ordering 2) The krb5_cc_resolve() call handles KRB5_FCC_NOFILE for all cache types. Previously, this was only handled for DIR caches.
* KRB5: Add new #define for collection cache typesStephen Gallagher2013-08-228-35/+35
| | | | | | Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
* gitignore: Add Eclipse project files to ignore listStephen Gallagher2013-08-221-0/+3
|
* BUILD: Fix contrib build macros to display warningsStephen Gallagher2013-08-221-6/+6
| | | | | | There was an inconsistency with how the warnings were specified and how they were consumed by the macros. The result was that warnings were hidden.
* sysdb_add_incomplete_group: store SID string is availableSumit Bose2013-08-195-14/+72
| | | | | | During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
* save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose2013-08-191-0/+16
| | | | | For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
* sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose2013-08-191-4/+14
| | | | | For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
* mmap_cache: Store corrupted mmap cache before resetMichal Zidek2013-08-191-0/+66
| | | | | This patch adds function to store corrupted mmap cache file to disk for further analysis.
* sudo: continue if we are unable to resolve fqdnPavel Březina2013-08-191-1/+0
| | | | https://fedorahosted.org/sssd/ticket/2043
* mmap_cache: Use better checks for corrupted mc in responderMichal Zidek2013-08-192-5/+53
| | | | | We introduced new way to check integrity of memcache in the client code. We should use similiar checks in the responder.
* mmap_cache: Off by one error.Michal Zidek2013-08-194-14/+17
| | | | | Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
* mmap_cache: Remove triple checks in client code.Michal Zidek2013-08-192-40/+20
| | | | | We had pattern in client code with 3 conditions that can be replaced with one.
* mmap_cache: Check data->name value in client codeMichal Zidek2013-08-192-0/+37
| | | | | | | | data->name value must be checked to prevent segfaults in case of corrupted memory cache. resolves: https://fedorahosted.org/sssd/ticket/2018
* KRB5: Do not log to syslog on each loginJakub Hrozek2013-08-191-1/+3
|
* KRB5: Formatting changesJakub Hrozek2013-08-191-4/+4
|
* fill_initgr: add original primary GID if availableSumit Bose2013-08-192-0/+28
| | | | | | | | | | | | | In some cases when MPG domains are used the information about the original primary group of a user cannot be determined by looking at the explicit group memberships. In those cases the GID related to the original primary group is stored in a special attribute of the user object. This patch adds the GID of the original primary group when available and needed. Fixes https://fedorahosted.org/sssd/ticket/2027
* sdap_save_user: save original primary GID of subdomain usersSumit Bose2013-08-192-11/+23
| | | | | | | | | | | | | | If ID mapping is enabled we use magic private groups (MPG) for subdomains, i.e. the UID and the primary GID of the user will have the same numerical value. As a consequence the information about the original primary group might get lost because neither in AD domains nor on a typical UNIX system the user is an explicit member of it's primary group. With this patch the mapped GID or the original primary group is saved in the cached user object under a new attribute. Fixes https://fedorahosted.org/sssd/ticket/2027
* sdap_get_initgr_done: use the right SID to get a GIDSumit Bose2013-08-191-1/+2
|
* ipa_s2n_get_user_done: make sure ALIAS name is lower caseSumit Bose2013-08-191-2/+18
| | | | Fixes https://fedorahosted.org/sssd/ticket/1630
generated by cgit (git 2.34.1) at 2024-05-03 10:15:52 +0000