summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa
Commit message (Collapse)AuthorAgeFilesLines
...
* Introduce be_req_terminate() helperSimo Sorce2013-01-214-34/+24
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove domain from be_req structureSimo Sorce2013-01-214-60/+45
|
* Pass domain not be_req to access check functionsSimo Sorce2013-01-211-1/+1
|
* Do not pass NULL to ipa_subdomain_retrieve()Simo Sorce2013-01-211-18/+20
|
* Move hbac_ctx_is_offline()Simo Sorce2013-01-212-7/+6
|
* Remove hbac_ctx_sdap_id_[ctx|op]()Simo Sorce2013-01-212-18/+6
|
* Remove hbac_ctx_ev()Simo Sorce2013-01-212-10/+3
|
* Remove hbac_ctx_be()Simo Sorce2013-01-213-12/+4
|
* Remove hbac_ctx_sysdb()Simo Sorce2013-01-212-12/+4
|
* Remove sysdb argument from hbac_get_cached_rules()Simo Sorce2013-01-213-9/+6
|
* Remove sysdb arg from [ipa_]hbac_sysdb_save()Simo Sorce2013-01-213-36/+25
| | | | Also make ipa_hbac_save_list() static
* Remove sysdb arg from ipa_hbac_service_info_send()Simo Sorce2013-01-213-5/+0
|
* Remove sysdb arg from hbac_*host_attrs_to_rule()Simo Sorce2013-01-213-11/+4
|
* Remove sysdb arg from hbac_service_attrs_to_rule()Simo Sorce2013-01-213-5/+2
|
* Remove sysdb argument from hbac_user_attrs_to_rule()Simo Sorce2013-01-213-6/+4
|
* Remove unused structureSimo Sorce2013-01-211-6/+0
|
* Remove sysdb argument from ipa_host_info_send()Simo Sorce2013-01-215-9/+3
|
* Remove sysdb as a be request structure memberSimo Sorce2013-01-213-7/+7
| | | | The sysdb context is already available through the 'domain' context.
* Remove sysdb as a be context structure memberSimo Sorce2013-01-215-13/+13
| | | | The sysdb context is already available through the 'domain' structure.
* Add domain to some subdomain functionsSimo Sorce2013-01-151-2/+7
|
* Add domain arguments to sysdb ssh functionsSimo Sorce2013-01-151-1/+2
|
* Add domain argument to sysdb selinux functionsSimo Sorce2013-01-153-4/+9
|
* Add domain arg to sysdb_search/delete_netgroup()Simo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_search_groups()Simo Sorce2013-01-151-1/+1
|
* Add domain arg to sysdb_search_users()Simo Sorce2013-01-153-1/+5
|
* Add domain argument to sysdb_search_custom()Simo Sorce2013-01-157-8/+22
| | | | Also changes sysdb_search_custom_by_name()
* Add domain argument to sysdb_store_custom()Simo Sorce2013-01-151-1/+1
|
* Add domain argument to sysdb_store_group()Simo Sorce2013-01-151-3/+2
| | | | Also remove sysdb_store_domgroup()
* Add domain argument to sysdb_store_user()Simo Sorce2013-01-151-5/+4
| | | | Also remove sysdb_store_domuser()
* Add domain arguments to sysdb_add_inetgroup fns.Simo Sorce2013-01-151-1/+1
|
* Add domain to sysdb_search_user_by_name()Simo Sorce2013-01-153-4/+8
| | | | Also remove unused sysdb_search_domuser_by_name()
* Make sysdb_custom_subtree_dn() require a domain.Simo Sorce2013-01-152-2/+2
|
* Make sysdb_custom_dn() require a domain.Simo Sorce2013-01-152-5/+9
|
* Remove the sysdb_ctx_get_domain() function.Simo Sorce2013-01-151-1/+4
| | | | | We are deprecating sysdb->domain so kill the function that gives access to this member as we should stop relying on it being available (or correct).
* Change pam data auth tokens.Simo Sorce2013-01-101-5/+1
| | | | Use the new authtok abstraction and interfaces throught the code.
* IPA: Rename IPA_CONFIG_SELINUX_DEFAULT_MAPJakub Hrozek2013-01-083-4/+6
| | | | It is not a map, but a default context. The name should reflect that.
* SELINUX: Process maps even when offlineJakub Hrozek2013-01-081-226/+429
| | | | | Changes the ipa_get_selinux{send,recv} request so that it only delivers data and moves processing to the IPA selinux handler.
* SYSDB: Remove duplicate selinux definesJakub Hrozek2013-01-081-0/+1
|
* failover: Protect against empty host namesMichal Zidek2013-01-021-1/+1
| | | | | | | | | | Added new parameter to split_on_separator that allows to skip empty values. The whole function was rewritten. Unit test case was added to check the new implementation. https://fedorahosted.org/sssd/ticket/1484
* Use an entry type mask macro to filter entry typesSimo Sorce2012-12-042-3/+3
| | | | | Avoids hardcoding magic numbers everywhere and self documents why a mask is being applied.
* Streamline ipa_account_info handlerSimo Sorce2012-12-041-74/+55
| | | | | | | | | | In particular note that we merge ipa_account_info_netgroups_done() and ipa_account_info_users_done() into a single fucntion called ipa_account_info_done() that handles both cases We also remove the auxiliary function ipa_account_info_complete() that unnecessarily violates the tevent_req style and instead use a new function named ipa_account_info_error_text() to generate error text.
* Fix tevent_req style for get_netgroup in ipa_idSimo Sorce2012-12-041-80/+71
| | | | Also do not intermix two tevent_req sequences
* Fix ipa_subdomain_id names and tevent_req styleSimo Sorce2012-12-043-52/+36
|
* IPA: Handle bad results from c-ares lookupStephen Gallagher2012-12-021-1/+11
| | | | | | | | | In some situations, the c-ares lookup can return NULL instead of a list of addresses. In this situation, we need to avoid dereferencing NULL. This patch adds a log message and sets the count to zero so it is handled appropriately below.
* fix SIGSEGV in IPA provider when ldap_sasl_authid is not setPavel Březina2012-11-201-1/+1
| | | | | | | | https://fedorahosted.org/sssd/ticket/1657 IPA_HOSTNAME is not stored in ipa_opts->id options so it the option was always NULL here. This caused SIGSEGV when accessed by strchr() in subsequent function.
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-201-1/+0
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
* LDAP: Provide a common sdap_set_sasl_options init functionJakub Hrozek2012-11-191-47/+8
| | | | | The AD and IPA initialization functions shared the same code. This patch moves the code into a common initialization function.
* Do not save HBAC rules in subdomain subtreeSumit Bose2012-11-192-13/+16
| | | | | | | | | | | | | | Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the configured domain apply to all users it is sufficient to save them once in the subtree of the configured domain. Since most of the sysdb operations during a HBAC request are related to the HBAC rules and related data this patch does not change the default sysdb context but only create a special context to look up subdomain users.
* Refactor the way subdomain accounts are savedSimo Sorce2012-11-191-4/+50
| | | | | | | | | | | | | | | | | The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
* Run IPA subdomain provider if IPA ID provider is configuredSumit Bose2012-11-141-1/+67
| | | | | | | | | | | | | | | | | | | | | | | | To make configuration easier the IPA subdomain provider should be always loaded if the IPA ID provider is configured and the subdomain provider is not explicitly disabled. But to avoid the overhead of regular subdomain requests in setups where no subdomains are used the IPA subdomain provider should behave differently if configured explicit or implicit. If the IPA subdomain provider is configured explicitly, i.e. 'subdomains_provider = ipa' can be found in the domain section of sssd.conf subdomain request are always send to the server if needed. If it is configured implicitly and a request to the server fails with an indication that the server currently does not support subdomains at all, e.g. is not configured to handle trust relationships, a new request will be only send to the server after a long timeout or after a going-online event. To be able to make this distinction this patch save the configuration status to the subdomain context. Fixes https://fedorahosted.org/sssd/ticket/1613
generated by cgit (git 2.34.1) at 2025-09-30 00:21:14 +0000