summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* IFP: fix typo in option name in man pagesifp-typoPavel Březina2017-08-252-2/+2
|
* libwbclient: Fix warning statement with no effectLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | src/sss_client/libwbclient/wbc_pam_sssd.c: In function ‘wbcAuthenticateUserEx’: src/sss_client/libwbclient/wbc_pam_sssd.c:52:5: error: statement with no effect [-Werror=unused-value] WBC_ERR_WINBIND_NOT_AVAILABLE; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/sss_client/libwbclient/wbc_pam_sssd.c:53:1: error: control reaches end of non-void function [-Werror=return-type] } ^ Related to: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient: Change return code for wbcAuthenticateUserExLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Samba-4.6 change behaviour of few functions New version of code make sure session info for user is stored in cache. It is a performance optimisation to prevent contacting KDC for each session. More details in samba bug https://bugzilla.samba.org/show_bug.cgi?id=11259 Old return code WBC_SSSD_NOT_IMPLEMENTED was translated to NT_STATUS_LOGON_FAILURE which caused many failures. [2017/08/21 11:34:15.044321, 5, pid=27742, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2017/08/21 11:34:15.044330, 5, pid=27742, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:640(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2017/08/21 11:34:15.044349, 4, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2017/08/21 11:34:15.044360, 1, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego) Failed to generate session_info (user and group token) for session setup: NT_STATUS_LOGON_FAILURE Resolves: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* sudo: add a threshold option to reduce size of rules refresh filterPavel Březina2017-08-188-5/+56
| | | | | | | | | | | | | If a large number of rules is expired at one time the ldap filter may become too large to be processed by server. This commits adds a new option "sudo_threshold" to sudo responder. If the threshold is exceeded a full refreshed is done instead of rules refresh. Resolves: https://pagure.io/SSSD/sssd/issue/3478 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* intg: Increase startup timeouts for kcm and secretsLukas Slebodnik2017-08-182-2/+2
| | | | | | | | | | | | | | | | | | | | | | | In cwrap environment, we start sssd_kcm and sssd_secrets ourself and not by systemd socket activation. Our approach is to wait a second in a loop till socket is available. However sometimes 1 second is not enough. Patch increases wait timeout from 1 second to 10 and it seems to be enough even when processes were executed with valgrind. Traceback (most recent call last): File "src/tests/intg/test_secrets.py", line 419, in setup_for_cli_timeout_test return create_sssd_secrets_fixture(request) File "src/tests/intg/test_secrets.py", line 82, in create_sssd_secrets_fixture assert os.path.exists(sock_path) AssertionError: assert False + where False = <function exists at 0x7f6c1cf520c8>('/tmp/sssd-intg.cdv0namx/var/run/secrets.socket') + where <function exists at 0x7f6c1cf520c8> = <module 'posixpath' from '/usr/lib64/python2.7/posixpath.pyc'>.exists + where <module 'posixpath' from '/usr/lib64/python2.7/posixpath.pyc'> = os.path Resolves: https://pagure.io/SSSD/sssd/issue/3481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: require http-parser only on rhel7.4Lukas Slebodnik2017-08-161-1/+1
| | | | | | It was removed from epel Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Fix minor typos in docsYuri Chornoivan2017-08-165-19/+19
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3456 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Fix minor typosYuri Chornoivan2017-08-162-3/+3
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3456 Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Set udp_preference_limit=0 in krb5 snippetPetr Čech2017-08-145-22/+51
| | | | | | | | | | | | | We add udp_preference_limit = 0 to krb5 snippet if ad provider is used. This option enable TCP connection before UDP, when sending a message to the KDC. Resolves: https://pagure.io/SSSD/sssd/issue/3254 Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* intg: Disable add_remove testsLukas Slebodnik2017-08-141-5/+5
| | | | | | | | | | | | | add_remove fails quite often in enumeration test. The reason of failures is not obvious and will take some time to investigate it. Failures blocks testing of other patches therefore its better to disable tests. (pytest run functions/methods which start with "test") Temporary workaround for: https://pagure.io/SSSD/sssd/issue/3463 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* SHARED: Return warning back about minimal header filesLukas Slebodnik2017-08-033-9/+24
| | | | | | | | | | The warning still make a sense and should be there. Patch also fixes header guards due t changed location. Related to: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Do not fail when a GHOST group is not foundPetr Čech2017-08-031-6/+1
| | | | | | | | | | | Usually is okay that there are no ghost attributes for a group as it basically just means that the group either has no members or all members have been previously fully resolved. Resolves: https://pagure.io/SSSD/sssd/issue/3315 Reviewed-by: Michal Židek <mzidek@redhat.com>
* libwbclient-sssd: update interface to version 0.14Sumit Bose2017-08-033-4/+12
| | | | | | The main change is a new member of the wbcAuthErrorInfo struct. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Moving headers used by both server and client to special folderAmitKumar2017-08-0318-36/+21
| | | | | | | | | | | | | | | | | | | These are the header files which are used by both client and server: src/util/io.h src/util/murmurhash3.h src/util/util_safealign.h This patch is about moving these header files to special folder (src/shared). It will be easier to identify these headers when looking for them in the src tree. util_safalign.h is renamed as safalign.h because util_ namespace is appropriate when this file belonged to the util's folder which is no longer the case. Resolves: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* INTG: Add --with-session-recording=/bin/false to intgcheck's configureFabiano Fidêncio2017-08-032-1/+1
| | | | | | | | | | | | Let's ensure that running `make intgcheck-*` doesn't fail when done locally. As --with-session-recording=/bin/false is now set in the Makefile.am, there's no need to set it in contrib/ci/configure.sh. Thus, the option has been removed from there. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CACHE_REQ: Fix warning may be used uninitializedFabiano Fidêncio2017-07-311-0/+2
| | | | | | | Setting ret as EOK in case everything goes well. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* MAN: Don't tell the user to autostart sssd-kcm.service; it's socket-enabledJakub Hrozek2017-07-271-2/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SPEC: Use language file for sssd-kcmLukas Slebodnik2017-07-271-1/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MAN: Describe session recording configurationNikolai Kondrashov2017-07-276-1/+268
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* INTG: Add session recording testsNikolai Kondrashov2017-07-274-14/+979
| | | | | | | Add basic tests for all base combinations of session recording configuration options. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: Export original shell to tlog-rec-sessionNikolai Kondrashov2017-07-271-0/+96
| | | | | | | | | Add exporting of original user shell (as returned by NSS) as an environment variable for use by tlog-rec-session, when session recording is enabled for the user. This lets tlog-rec-session start the actual user shell, after tlog-rec-session is started in its place. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Substitute session recording shellNikolai Kondrashov2017-07-271-1/+47
| | | | | | | | | Substitute the configured session recording shell when unconditional session recording is enabled (scope = all), or when selective session recording is enabled (scope = some), and the user has the sessionRecording attribute set to true. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Pull sessionRecording attrs from initgrNikolai Kondrashov2017-07-275-6/+383
| | | | | | | | | | | | After entires are retrieved by cache_req for user info requests (except initgr), overlay them with sessionRecording attribute retrieved from an initgr request made additionally for each entry. Do not do additional initgr requests with selective session recording enabled, if we don't have any group names to match against in session recording configuration. Only do user name matches instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Overlay sessionRecording attribute on initgrNikolai Kondrashov2017-07-271-34/+231
| | | | | | | | Add sessionRecording attribute to user entries on initgr request in data provider, specifying if the user name or groups match the ones with session recording enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Update viewname for all providersPavel Březina2017-07-271-0/+6
| | | | | | | | Call sysdb_master_domain_update for backend domain upon initialization to make view information available for later use by session recording code, which will need to access overridden user and group names. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Load override_space into be_ctxNikolai Kondrashov2017-07-272-0/+23
| | | | | | | | Add loading and storing the override_space configuration option to data provider. That will be needed for formatting output user and group names for matching against session recording configuration. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Add sessionRecording attribute macroNikolai Kondrashov2017-07-271-0/+2
| | | | | | | | Add a macro for sessionRecording attribute to sysdb.h. To be used for storing a boolean attribute signifying if session recording is enabled for the user. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add session recording conf loadingNikolai Kondrashov2017-07-273-0/+12
| | | | | | | | Add session recording configuration loading to the data provider initialization. To be used for matching users and groups with session recording enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Add session recording conf loadingNikolai Kondrashov2017-07-274-0/+17
| | | | | | | | Add session recording configuration loading to the common responder initialization. To be used for substituting the user shell when session recording is enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add session recording conf management moduleNikolai Kondrashov2017-07-273-0/+190
| | | | | | | Add an util module for loading session recording configuration. To be used by responders and data provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Support configuring session recording shellNikolai Kondrashov2017-07-272-0/+17
| | | | | | | Add support for specifying the shell used for recording user sessions, at configure time. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFIG: Add session_recording sectionNikolai Kondrashov2017-07-274-2/+26
| | | | | | | | | | | | Add information on "session_recording" config section, having three options: "scope", "users", and "groups". The section is intended for disabling session recording ("scope = none", default), enabling session recording for all users ("scope = all"), and enabling it for some specific users and/or groups ("scope = some", "users = <users>", "groups = <groups>"). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Move nss_get_shell_override to responder utilsNikolai Kondrashov2017-07-273-84/+89
| | | | | | | | | Move nss_get_shell_override to common responder utils and rename it to sss_resp_get_shell_override to make it available to other responders. In particular let PAM responder use it to provide original shell when it is overriden for session recording. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Move shell options to common responderNikolai Kondrashov2017-07-275-126/+128
| | | | | | | | | Move all the shell-related options from the NSS responder context to the common responder context, so they can be used by other responders for retrieving original user shell, when it is overrided for session recording. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Propagate num_results to cache_req_stateNikolai Kondrashov2017-07-271-2/+7
| | | | | | | | The num_results field in struct cache_req_state was only set in case of well-known objects, set it also for the regular results for uniformity, and for later use by session recording code. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Fix minor typosYuri Chornoivan2017-07-266-9/+9
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3456 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Updating the version for the 1.15.4 releaseJakub Hrozek2017-07-251-1/+1
| | | | Reviewed-by: N/A
* Updating translations for the 1.15.3 releaseJakub Hrozek2017-07-2542-21668/+72218
| | | | Reviewed-by: N/A
* Remove the locale tag from zanata.xmlJakub Hrozek2017-07-251-95/+0
| | | | | | | | | | | This prevents error messages like: [!] Locale mappings are now handled using locale aliases on the server, so locale mappings in the project config file (zanata.xml) are now deprecated. Please add a locale alias in the project language settings to replace each locale mapping in zanata.xml, then remove the <locales> section from zanata.xml See also: http://docs.zanata.org/en/release/client/configuration/ Reviewed-by: N/A
* KCM: Fix Description of sssd-kcm.socketJakub Hrozek2017-07-251-1/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* KCM: Modify krb5 snippet file kcm_default_ccacheLukas Slebodnik2017-07-253-11/+11
| | | | | | | | | | | | | | | The file kcm_default_ccache must enable KCM ccache by default without any modification of the file. /etc/krb5.conf.d/ is fedora/el7 specific and it is not allowed to enable or start systemd services in scriptlets. It would result in broken krb5 configuration. Therefore krb5 configuration snippet was moved from /etc/krb5.conf.d/ -> /usr/share/sssd-kcm. And each downstream distribution should enable systemd services + change krb5 configuration in it's own way. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad_account_can_shortcut: shortcut if ID is unknownSumit Bose2017-07-251-0/+2
| | | | | | | | | | | | | If sss_idmap_unix_to_sid() returns an error we can assume that the given POSIX ID is not from the current domain and can be skipped. This is e.g. the case in the IPA provider if a POSIX ID used in the IPA domain is checked in a trusted id-mapped AD domain before the IPA domain is checked. Resolves https://pagure.io/SSSD/sssd/issue/3452 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Return invalid credentials internally when attempting to renew an ↵Jakub Hrozek2017-07-241-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | expired TGT Since 1.14.2 and in particular commit d3348f49260998880bb7cd3b2fb72d562b1b7a64 we return ERR_NETWORK_IO for any krb5_child operations that receive KRB5KRB_AP_ERR_TKT_EXPIRED from libkrb5. However, when the action that krb5_child performs is ticket renewal and the ticket is totally expired, this can send the SSSD into offline mode. Instead, this patch converts the KRB5KRB_AP_ERR_TKT_EXPIRED code into sssd-internal ERR_CREDS_EXPIRED which map_krb5_error() won't map anymore. The effect on the deamon is that just the single renewal fails, but the failover code is not called and therefore sssd doesn't switch into offline mode. Resolves: https://pagure.io/SSSD/sssd/issue/3406 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Tested-by: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
* CRYPTO: Do not call NSS_Shutdown after every operationJakub Hrozek2017-07-242-4/+0
| | | | | | | | | | | | | | Calling setup and teardown on every encryption cases issues like the one described in https://bugzilla.redhat.com/show_bug.cgi?id=1456151 eventually. Similarly to other crypto functions, don't tear down NSS by calling NSS_Shutdown. Let the OS reclaim the resources. Resolves: https://pagure.io/SSSD/sssd/issue/3424 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: temporary increase hardcoded buffersLukas Slebodnik2017-07-242-2/+2
| | | | | | | Temporary workaround: https://pagure.io/SSSD/sssd/issue/3386 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* idmap_error_string: add missing descriptionsSumit Bose2017-07-244-2/+33
| | | | | | | | | Related to https://pagure.io/SSSD/sssd/issue/1960 Related to https://pagure.io/SSSD/sssd/issue/1938 Related to https://pagure.io/SSSD/sssd/issue/1844 Related to https://pagure.io/SSSD/sssd/issue/1593 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Revert "LDAP: Fix nesting level comparison"Lukas Slebodnik2017-07-241-1/+1
| | | | | | | | | | This reverts commit 925a14d50edf0e3b800ce659b10b771ae1cde293. It broke a test for enumerate nested groups if they are part of non POSIX groups https://pagure.io/SSSD/sssd/issue/2406 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document that client_idle_timeout can't be shorter than 10 secondsJakub Hrozek2017-07-211-1/+3
| | | | | | | | To ensure the client timeout is not too low and clients do not reconnect too often, the client_idle_timeout is forced to be 10 seconds minimum. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Integration test for idle timeoutJakub Hrozek2017-07-211-13/+62
| | | | | | | | | | | | | | | | | The secrets responder test was chosen even though the bug was in the generic responder code b/c it runs a single responder process, so it's trivial to read the PID of the responder under test. Changes subprocess.call() for os.execv() so that the setup function can return the secret responder PID right away. The client timeout in the test has to be at least 10 seconds because internally, the responders don't allow a shorter timeout. Regression test for https://pagure.io/SSSD/sssd/issue/3448 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* RESPONDERS: Fix terminating idle connectionsJakub Hrozek2017-07-211-5/+11
| | | | | | | | | | | | | | | | | | | | | The client_idle_handler() function tried to schedule another tevent timer to check for idle client connections in case the current connection was still valid, but in doing so, it also stored the current time into the last_request_time field of the client context. This kept the connection always alive, because the last_request_time could then never be older than the timeout. This patch changes the setup_client_idle_timer() function to only do what the synopsis says and set the idle timer. The caller (usually the function that accepts the connection) is supposed to store the request time itself. Resolves: https://pagure.io/SSSD/sssd/issue/3448 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-04 07:01:05 +0000