summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* AD: Remember last site discovered in sysdbadsitePavel Březina2017-11-016-4/+26
| | | | | | | This can speed up sssd startup. Resolves: https://pagure.io/SSSD/sssd/issue/3265
* sysdb: add functions to get/set client sitePavel Březina2017-11-013-0/+146
|
* AD: Remember last site discoveredPavel Březina2017-11-011-1/+43
| | | | | | | | | | | | | | To discover Active Directory site for a client we must first contact any directory controller for an LDAP ping. This is done by searching domain-wide DNS tree which may however contain servers that are not reachable from current site and than we face long timeouts or failure. This patch makes sssd remember the last successfuly discovered site and use this for DNS search to lookup a site and forest again similar to what we do when ad_site option is set. Resolves: https://pagure.io/SSSD/sssd/issue/3265
* MAN: GPO Security Filtering limitationMichal Židek2017-10-271-0/+7
| | | | | | | | | | Note in the man pages that current version of SSSD does not support host entries in the 'Security filtering' list. Resolves: https://pagure.io/SSSD/sssd/issue/3444 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sudo: document background activityPavel Březina2017-10-261-0/+8
| | | | | | | | | | When we introduced socket activation, we changed the internall behaviour. Previously we disabled sudo if it was not listed in services, with socket activation we removed this feature. Some users were confused so this change documents current behaviour. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Copy the cr_domain list for each requestFabiano Fidêncio2017-10-263-2/+55
| | | | | | | | | | | Let's copy the cr_domain list for each request as this list may be free'd due to a refresh domains request. Resolves: https://pagure.io/SSSD/sssd/issue/3551 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Add integration tests for the auto_private_groups optionJakub Hrozek2017-10-262-3/+290
| | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/1872 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Prevent users and groups ID collision in MPG domains except for ↵Jakub Hrozek2017-10-261-3/+38
| | | | | | | | | | | | | | | | | | | id_provider=local This commit makes the check when adding an object in a MPG domain stricter in the sense that not only same names are allowed in a MPG domain, but also the same groups are not allowed either. This commit is a backwards-incompatible change, but one that is needed, otherwise requesting the duplicate group first and then requesting the user entry would yield two object when searching by GID. In order to keep backwards-compatibility, this uniqueness is NOT enforced with id_provider=local. This constraint can be removed in the future (or the local provider can be dropped altogether) Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* LDAP: Turn group request into user request for MPG domains if neededJakub Hrozek2017-10-261-39/+113
| | | | | | | | | | | | | If the primary group GID or the group name is requested before the user is, we need to also search the user space to save the user in the back end which then allows the responder to generate the group from the user entry. Related: https://pagure.io/SSSD/sssd/issue/1872 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SDAP: Allow the mpg flag for the main domainJakub Hrozek2017-10-261-8/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit allows saving the users in the MPG domain in the SDAP layer. The commit contains the following changes: - abstracts the change where if the primary GID exists in the original object, it is saved instead as the SYSDB_PRIMARY_GROUP_GIDNUM attribute, which will allow the original primary GID to be exposed as a secondary group - if the primary GID does not exist, no SYSDB_PRIMARY_GROUP_GIDNUM is added. This will allow to handle LDAP objects that only contain the UID but no GID. Since this is a new use-case, a test is added later - a branch that handles the above is added to sdap_save_user() also for joined domains that set the MPG flag. Previously, only subdomains were handled. - to allow passing GID=0 to the sysdb layer, the range check is relaxed. Related: https://pagure.io/SSSD/sssd/issue/1872 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Remove the obsolete option magic_private_groupsJakub Hrozek2017-10-261-1/+0
| | | | | | | | Since this confdb definition was completely unused across the codebase, this patch just removes the definition. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: Add a new option auto_private_groupsJakub Hrozek2017-10-267-2/+36
| | | | | | | | | | | | | | | | | | The auto_private_groups option is used to configure the domain->mpg flag which was already set automatically for subdomains, but for some time was not settable by the admin via the configuration file. The new option name, instead of the old magic_private_groups, was chosen purely because this name would hopefully be better understood by admins. The option doesn't do anything yet, it is just added to all the places a new option should be added to. Related: https://pagure.io/SSSD/sssd/issue/1872 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Fix minor spelling mistakesRené Genz2017-10-2531-46/+46
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3556 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document memcache_timeout=0 meaningMichal Židek2017-10-241-1/+8
| | | | | | | | | | | | | Document that by setting memcache_timeout to 0 the in-memoory cache will be disabled. Related: https://pagure.io/SSSD/sssd/issue/3496 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Specify memcache_timeout=0 semanticsMichal Židek2017-10-242-0/+65
| | | | | | | | | | | | | With this patch the memcache files will not be created when memcache_timeout is set to zero. Resolves: https://pagure.io/SSSD/sssd/issue/3496 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Move memcache setup to separate functionMichal Židek2017-10-241-40/+51
| | | | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/3496 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Fix typo in commentsLukas Slebodnik2017-10-241-2/+2
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Update the version number to track 1.16.1 developmentJakub Hrozek2017-10-201-1/+1
|
* Updating the version for the 1.16.0 releaseJakub Hrozek2017-10-201-1/+1
|
* Updating the translation for the 1.16.0 releaseJakub Hrozek2017-10-2042-35699/+51856
|
* Revert "IPA: Only generate kdcinfo files on clients"Lukas Slebodnik2017-10-192-18/+9
| | | | | | | | | | | | | | | This reverts commit a309525cc47da726461aec1f238165c17aade2a6. Even though original patch was correct it is better to revert it becuse otherwise we hit a bug in MIT krb5 when fallback to admin_server if kpasswd_server is not set does not work. And it would take some time to propagate krb5 fix to downstream distributions. https://bugzilla.redhat.com/show_bug.cgi?id=1498347 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* LDAP: Add support for rhost access controlAlexey Kamenskiy2017-10-1915-1/+367
| | | | | | | | This patch implements verification of pam_rhost against rules stored in LDAP entry of a user. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Add threshold for sudo searchesJustin Stephenson2017-10-195-10/+63
| | | | | | | | | | | | | | | Apply the sudo threshold to IPA provider sudo command and command group searches to prevent SSSD from creating large search filters. The IPA sudo threshold value will utilize the sudo responder sudo_threshold value. If the threshold is exceeded, a basic search filter will be used as a fallback to retrieve all IPA sudo commands or command groups. Resolves: https://pagure.io/SSSD/sssd/issue/3507 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_client: refactor internal timeout handlingSumit Bose2017-10-192-38/+74
| | | | | | | | | | | | | This patch adds a timeout option to the internal client calls so that the timeout is not hard-coded anymore in the low level poll() calls but can be set by the caller with sss_nss_make_request_timeout(). Since the old timeout value is not changed by this patch there is no functional change expected. Related to https://pagure.io/SSSD/sssd/issue/2478 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* DP: Log to syslog whether it's online or offlineFabiano Fidêncio2017-10-182-0/+14
| | | | | | | | | | | | Instead of requiring that admins enable and look at our logs, let's log to syslog what's the DP status. Resolves: https://pagure.io/SSSD/sssd/issue/3307 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Fix the output type used in dp_req_recv_ptr()Fabiano Fidêncio2017-10-181-5/+5
| | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/3307 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: sanitize name in override search filterSumit Bose2017-10-181-5/+13
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3545 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* intg: Add sanity tests for pysss_nss_idmapLukas Slebodnik2017-10-162-0/+270
| | | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Create FakeAD class based on openldapLukas Slebodnik2017-10-164-0/+936
| | | | | | | | | FakeAD is openldap with ldif schema which allows to load static data from real AD. Instance of class will also contain some predefined users/groups which can be used for basic sanity testing in sssd of AD features. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ds_openldap: Extract functionality to protected methodsLukas Slebodnik2017-10-161-23/+28
| | | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Prefer locally built python modulesLukas Slebodnik2017-10-162-0/+14
| | | | | | | | | | | | | | | | | | | | Patch prepends path to sssd python modules; so we will be able to import them without any issue and they will be preferred over system modules. sh$[/tmp/sssd-intg.3gb4hzpn/var/log/sssd] python2 Python 2.7.13 (default, Aug 16 2017, 12:56:26) [GCC 7.1.1 20170802 (Red Hat 7.1.1-7)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import SSSDConfig >>> print(SSSDConfig.__file__) /tmp/sssd-intg.3gb4hzpn/lib/python2.7/site-packages/SSSDConfig/__init__.pyc >>> import pyhbac >>> print(pyhbac.__file__) /tmp/sssd-intg.3gb4hzpn/lib64/python2.7/site-packages/pyhbac.so Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: prevent "TypeError: must be type, not classobj"Lukas Slebodnik2017-10-161-1/+1
| | | | | | | | | | | | | | | | http://stackoverflow.com/questions/9698614/super-raises-typeerror-must-be-type-not-classobj-for-new-style-class ========================== ERRORS =========================== _______ ERROR at setup of test_regression_ticket2163 ________ Traceback (most recent call last): File "src/tests/intg/test_pysss_nss_idmap.py", line 48, in ad_inst instance.teardown() File "src/tests/intg/ds_openldap.py", line 371, in teardown super(FakeAD, self).teardown() TypeError: super() argument 1 must be type, not classobj Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Let python paths be configurableLukas Slebodnik2017-10-162-0/+8
| | | | | | | | It will allow to prefer locally built python modules in integration tests. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Fix pep8 warnings in config.py templateLukas Slebodnik2017-10-161-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | intg/bld/src/tests/intg/config.py:5:7: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:6:11: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:7:15: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:8:12: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:9:10: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:10:8: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:11:9: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:12:13: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:13:9: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:14:12: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:15:11: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:16:13: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:17:12: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:18:13: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:20:11: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:21:7: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:22:11: E221 multiple spaces before operator intg/bld/src/tests/intg/config.py:23:7: E221 multiple spaces before operator pep8 will prevent reformatting in case of added new options e.g. 53a4219e2f51cd0443931aa931505bf0b4bf5a45 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: Hide option --debug in sssctlLukas Slebodnik2017-10-131-6/+2
| | | | | | | Related to old bug https://pagure.io/SSSD/sssd/issue/1224 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TOOLS: Print Better usage for sssctl debug-levelLukas Slebodnik2017-10-131-35/+7
| | | | | | | | | | | | | | There is missing command name in help sh# sssctl debug-level --help Usage: DEBUG_LEVEL_TO_SET -c, --config=STRING Specify a non-default config file Help options: -?, --help Show this help message --usage Display brief usage message Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TOOLS: Log redirection info for sss_debuglevel to stderrLukas Slebodnik2017-10-131-1/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sysdb: sanitize search filter inputSumit Bose2017-10-112-8/+42
| | | | | | | | | | This patch sanitizes the input for sysdb searches by UPN/email, SID and UUID. This security issue was assigned CVE-2017-12173 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Accept krb5 1.16 for building the PAC pluginSumit Bose2017-10-091-1/+2
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Avoid overwriting pam_status in _lookup_by_cert_done()Fabiano Fidêncio2017-10-091-1/+1
| | | | | | | | | | | In case add_pam_cert_response() failed pam_status has to be set to PAM_AUTHINFO_UNAVAIL. Although it's done properly in the code, pam_status was overwritten just after the if block with PAM_SUCCESS. The original faulty code was added as part of 32474fa2f0. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Don't use freed LDAPURLDesc if domain for AD DC cannot be foundJakub Hrozek2017-10-051-2/+5
| | | | | | | | | | | | If a referral returned during AD GPO processing cannot be assigned to a known domain, at the moment SSSD accesses memory that was freed previously with ldap_free_urldesc(). This patch moves the ldap_free_urldesc() call to both the error handler and the success branch after we are done working with the LDAPURLDesc instance. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KCM: Add some forgotten NULL checksJakub Hrozek2017-10-042-2/+28
| | | | | | | Several memory allocations across the KCM codebase did not check their result for NULL. This patch fixes that. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KCM: Use the right memory contextJakub Hrozek2017-10-041-6/+6
| | | | | | | | | | | | | Inside the tevent request, we should use 'state' as the intermediate memory context and steal the result up to 'mem_ctx' on success. 'mem_ctx' itself should only be used to create the tevent_req as the first thing during the request creation. However, this bug is not very severe as the mem_ctx was always the KCM operation memory context, so the memory was freed when the operation terminated. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KCM: Do not leak newly created ccache in case the name is malformedJakub Hrozek2017-10-041-7/+12
| | | | | | | | | This is not a big deal as the mem_ctx parameter of the operation is typically just a short-lived operation context. Nonetheless, it is best practice to not rely on how the memory context is set up in utility functions. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* python: Changing class declaration from old to new-style typeamitkuma2017-10-042-3/+3
| | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3517 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ldap: Change ldap_user_certificate to userCertificate;binaryamitkuma2017-10-043-10/+4
| | | | | | | | | | | IPA and AD providers default to userCertificate;binary for the ldap_user_certificate option. It will be good to default that value also for the generic LDAP provider. Resolves: https://pagure.io/SSSD/sssd/issue/3499 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Fix execution with dbus-1.11.18Lukas Slebodnik2017-10-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since dbus-1.11.18 DBUS_COOKIE_SHA1 respect $HOME variable and fallback to value returned from getpwnam only if env HOME does not exist. It caused problem for dbus communication between sssd processes because local user usually do not have directory $HOME/.dbus-keyrings/. And directory created in cwrap environment is problmatic [build@host ~]$ ls -ld ~/.dbus-keyrings/ drw-------. 2 build build 6 Oct 3 10:44 /home/build/.dbus-keyrings/ [buildhost ~]$ ls -lna ~/.dbus-keyrings/ ls: cannot access '/home/build/.dbus-keyrings/.': Permission denied ls: cannot access '/home/build/.dbus-keyrings/..': Permission denied total 0 d????????? ? ? ? ? ? . d????????? ? ? ? ? ? .. [build@host ~]$ touch ~/.dbus-keyrings/test touch: cannot touch '/home/build/.dbus-keyrings/test': Permission denied Other alternative would be to set env variable HOME to the same value as in fake passwd file: HOME=$(abs_builddir)/root Related dbus bug: https://bugs.freedesktop.org/show_bug.cgi?id=101960 Resolves: https://pagure.io/SSSD/sssd/issue/3531 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SSSCTL: Add cache-expire commandJustin Stephenson2017-09-253-0/+49
| | | | | | | | | Add sssctl cache-expire as a wrapper for the sss_cache utility to invalidate cached objects. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSCTL: Replace sss_debuglevel with shell wrapperJustin Stephenson2017-09-254-33/+22
| | | | | | | | | | | | | The sss_debuglevel binary is replaced by a shell wrapper calling sssctl debug-level as part of merging sss_debuglevel into sssctl. The wrapper will redirect sss_debuglevel to the sssctl debug-level command performing the same task. The sss_debuglevel(8) man page is updated to indicate that sss_debuglevel is deprecated and functionality exists now in sssctl. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSCTL: Move sss_debuglevel to sssctl debug-levelJustin Stephenson2017-09-259-341/+304
| | | | | | | | | | | | | | | | Move code from sss_debuglevel to sssctl_logs.c and add new debug-logs sssctl command to perform the same task of changing debug level dynamically. POPT_CONTEXT_KEEP_FIRST Flag added to poptGetContext call in sssctl_debug_level() to fix argument parsing. Resolves: https://pagure.io/SSSD/sssd/issue/3057 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-07 04:14:07 +0000