summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique matchSumit Bose2017-03-103-1/+22
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: allow muliple users mapped to a certificateSumit Bose2017-03-104-59/+166
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add FindByNameAndCertificateSumit Bose2017-03-106-0/+360
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ifp: add ListByCertificateSumit Bose2017-03-106-0/+165
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: allow multiple matches for searches by certificateSumit Bose2017-03-101-2/+2
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: allow multiple results for searches by certificateSumit Bose2017-03-102-7/+43
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util-test: Extend unit test for sss_filter_sanitize_exLukas Slebodnik2017-03-101-0/+18
| | | | | | | Related-to: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_utils: Add test coverage for %l in override_homedirLukas Slebodnik2017-03-101-2/+9
| | | | | | | Related-to: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Fix invalidating memory cache for subdomain usersJakub Hrozek2017-03-101-1/+3
| | | | | | | | get_next_domain() was called without any special flags, meaning it only iterates over main domains. We need to instead use the SSS_GND_DESCEND flag to make sure sudomains are taken into account, too. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Allow manual start for sssd-ifpJakub Hrozek2017-03-081-1/+0
| | | | | | | This change is needed so that the InfoPipe responder can be socket activated. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Fixed typo in debug outputThorsten Scherf2017-03-081-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_cache: User/groups invalidation in domain cachePetr Čech2017-03-085-8/+173
| | | | | | | | | | | | | | | | | | When a group/users are invalidated from sss_cache, the group/user information in domain and timestamps cache are inconsistent with regard to dataExpireTimestamp attribute. This patch fixes the problem by explicitly invalidating the domain cache's entry when the timestamp cache entry is invalidated by sss_cache call. There is one new function: * sysdb_invalidate_cache_entry() provided for this purpose and used only in sss_cache utility. Resolves: https://fedorahosted.org/sssd/ticket/3164 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Shutdown the responder in case it becomes idleFabiano Fidêncio2017-03-082-0/+6
| | | | | | | | | | | | | Similarly to what has been done for the other responders, let's shutdown the secrets responder in case it becomes idle. Resolves: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Wrap up the code to setup the idle timeoutFabiano Fidêncio2017-03-082-35/+54
| | | | | | | | | | | | | As secrets responder will make use of this very same code in the future, let's wrap it up into a new function in order to avoid code duplication. Related: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: use rctx as memory context during midpoint refreshPavel Březina2017-03-081-1/+1
| | | | | | | | Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: first letter of user name template for override_homedirIgnacio Reguero2017-03-072-0/+21
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_secrets: Fail in child if sssd_secrets cannot startLukas Slebodnik2017-03-071-12/+19
| | | | | | | | | | | | | | | If there is a problem to execute sssd_secrets then exception is raised. Test will not continue in parent process because it is waiting for socket for a second. The child process will continue in execution of tests because parent process will kill child in teardown after test execution. This patch makes starting of secret service more robust and immediately fail child process when there was a problem to start sssd_secrets. It also adds few assertions for ensuring that setup passed as it should. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Add dyndns_auth optionJustin Stephenson2017-03-072-0/+30
| | | | | | | Add the dyndns_auth option into the AD or IPA provider man pages for more configuration information of nsupdate behavior. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Sanitize newline and carriage return characters.Victor Tapia2017-03-071-0/+10
| | | | | | | | | | Introducing valid usernames with a trailing newline character triggers the removal of valid LDB cache entries. Resolves: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Updating the version for the 1.15.2 releaseJakub Hrozek2017-03-031-1/+1
|
* Updating translations for the 1.15.1 releasesssd-1_15_1Jakub Hrozek2017-03-0340-16323/+18634
|
* CACHE_REQ: Only search the given domain when looking up entries by UPNJakub Hrozek2017-03-031-2/+2
| | | | | | | | | | | | | | We were searching UPNs in the whole sysdb, which made cache_req think the result came in from the domain it was searching. The bug manifested when a user from a trusted domain was looked by UPN, then cache_req searched the main domain, the result from subdomain was considered as coming from the main domain and as a result, the getpwnam() output was not qualified. That is a problem, because PAM applications often sanitize the user with getpwnam, so effectively a login with UPN was shortened to just a shortname and failed. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-039-21/+32
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Improve debugging on smartcard creds forwardSumit Bose2017-03-031-0/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Adapt pam-srv-tests to deal with cache_req related changesFabiano Fidêncio2017-03-031-23/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to what happened for nss-srv-tests, there were a few kind of changes required to fix the tests breakage caused by the last commit. 1) For tests including no user, no changes was required. 2) As we call an equivalent to "get by name" command, a name is parsed with sss_parse_inp and the returned value is now mocked. 3) For the "cache_auth_success*" tests we set pam_test_ctx->tctx->done to false after adding the password to the cache, since the code now contains tevent calls and without it only the first request proceeds into tevent_loop in test_ev_loop(), as the first finished request sets done to true. 4) As the user certificate is added as a result of calling sss_dp_account_recv and the certificate value is read by the certificate lookup, we have to, in case a certificate lookup callback is set, call mock_account_recv() for the certificate before going through the mock_account_recv() for the initgroup. 5) If no logon name is given, then the user is looked by certificates first. Since there's a matching user, the upcoming lookup by name will find the user entry. However, since the looked ip data is up to date the dp response has to be mocked and the second argument of mock_input_pam_cert() cannot be NULL but must match the user name. 6) Add a new attribute to mock_input_pam_cert() that represents whether the backend is contacted only once. It's needed because in test_pam_cert_auth() the backend is contacted first to check whether it can handle smartcard authenticatiom, but before that there's a lookup. Since the first mocked reply already adds the certificate to the user entry, the lookup by certificate will already find the user in the cache and no second lookup is needed. Co-Author: Pavel Březina <pbrezina@redhat.com> Co-Author: Sumit Bose <sbose@redhat.com> Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Use cache_req to perform initgroups lookupsFabiano Fidêncio2017-03-033-389/+83
| | | | | | | | | | | | | | PAM responder has been already taking advantage of the cache_req interface, so this patch is just replacing some code that performs initgroups lookups by using cache_req to do so. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: Add cache_req_data_set_bypass_cache()Fabiano Fidêncio2017-03-034-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new cache_req_data method has been added because of the upcoming changes in the PAM responder. For deciding whether to contact the cache, or just query the data provider directly, PAM responder calls pam_initgr_check_timeout() which will return whether the cache entry may still be valid. The cache will be contacted only in case the cache entry is still valid, otherwise the data provider will be called. pam_initgr_check_timeout() basically checks whether the user (being looked up) is still a part of an in-memory hash table. Because the entry is a part of the hash table for really short period of time, and is automatically removed, the communication with the data provider is forced to happen quite often. As the follow-up changes should not modify this behaviour, this function was introduced so we can still call pam_initgr_check_timeout() and pass its result to the cache_req call that will perform the lookup. Related: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Store UPN suffixes when creating a new subdomainJakub Hrozek2017-03-025-7/+17
| | | | | | | | | We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSTEMD: Force responders to refuse manual startFabiano Fidêncio2017-03-027-0/+7
| | | | | | | | | | | | | | As the responders will either be explicitly started by the monitor or {dbus,socket}-activated, let's force them to refuse manual start, being a little bit restricter on our side. Resolves: https://pagure.io/SSSD/sssd/issue/3300 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSTEMD: Don't mix up responders' socket and monitor activationFabiano Fidêncio2017-03-0210-0/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | Let's ensure that in case a responder is explicitly configured in the sssd.conf its socket won't even start. The patchset introduces a new binary that will be distributed and will be called before starting the responders' sockets, ensuring the sockets will only start in case the responder is supposed to be socket-activated and its been configured accordingly. Otherwise the responders' socket startup will fail with a quite helpful debug message leading the admins to choose between using systemd or not and what has to be done to achieve their desire. This suggestion came from Sumit Bose. The reason for adding a new binary instead of a simple python script is to avoid dragging unnecessary dependencies to sssd-common package. Resolves: https://pagure.io/SSSD/sssd/issue/3300 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: use own namespace for UPNsSumit Bose2017-03-026-5/+95
| | | | | | | | | | | | | If the UPN use the same domain name as the configured domain an unsuccessful lookup by name will already create an entry in the negative cache. If the lookup by UPN would use the same namespace the lookup will immediately be finished because there would already be an entry in the negative cache. Resolves: https://pagure.io/SSSD/sssd/issue/3313 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam: use authtok from PAM stack if availableSumit Bose2017-03-022-3/+29
| | | | | | | | | | | | | | | | | With this patch the behavior of pam_sss is slightly changed to be more similar to the behavior of other PAM modules. Currently pam_sss expects that there is a authtok (password) on the PAM stack if the 'use_first_pass' option was used. Without the option pam_sss unconditionally prompts for credentials. With this patch pam_sss will use an authtok from the PAM stack even if 'use_first_pass' is not set but it will assume that it is a password. To return to the previous behavior the new 'prompt_always' can be used. Resolves: https://pagure.io/SSSD/sssd/issue/2984 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSTEMD: Avoid starting a responder socket in case SSSD is not startedFabiano Fidêncio2017-03-017-0/+14
| | | | | | | | | | | | | | | | | | | | | | As systemd adds "Before=sockets.target" to any socket unit by default, during the startup of the system we can end up having a responder socket up, being contacted while SSSD is shutdown. By using "DefaultDependencies=no" we ensure that sockets.target won't trigger the sockets' startup and that it only will be done when SSSD is up. The downside of using "DefaultDependencies=no" is that we have to deal with conflicts and add "Conflicts=shutdown.target" to each of the sockets unit. This patch has been suggested by Lukáš Nykrýn. Related: https://pagure.io/SSSD/sssd/issue/3298 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSTEMD: Add "After=sssd.service" to the responders' sockets unitsFabiano Fidêncio2017-03-017-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | While debugging the whole breakage reported by Stric I've noticed that the NSS socket has been starting up the NSS responder _before_ SSSD being up. As libc does initgroups on pretty much any account and initgroups checks all NSS modules in order to be precise, the nss_sss triggers the NSS responder which would try talking to the data providers which are not up uet (because SSSD is not up yet), causing the whole process to hang until libc gives up (causing a timeout on services like systemd-logind and on services depending on this one). By adding this ordering explicitly we can avoid the reported situation. Also, it has been recommend by Lukáš Nykrýn that "BindsTo", which is used to tie up two services, and After must be used together in order to avoid undefined/unexpected behavior (although it's still not mentioned in the systemd documentation). Related: https://pagure.io/SSSD/sssd/issue/3298 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* authtok: fix tests on big-endianSumit Bose2017-02-281-4/+18
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3270 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Use pagure links as a reference to upstreamLukas Slebodnik2017-02-2811-14/+12
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Update link to commit templateLukas Slebodnik2017-02-281-1/+1
| | | | | | | | | | Link to tickets on fedorahosted are redirected to pagure https://fedorahosted.org/sssd/ticket/XXXX -> https://pagure.io/SSSD/sssd/issue/XXXX But we should prefer new links Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFDB: If no configuration file is provided, create a fallback configurationJakub Hrozek2017-02-282-13/+63
| | | | | | | | | | | | | | | This functionality is only enabled in case SSSD is configured with with --enable-files-domain. If not, the behaviour is as it used to -- SSSD returns an error, instructing the admin to create a configuration file. If the option is enabled, a very minimal confdb that only enables the NSS responder is created. The confdb later adds the implicit files domain. Resolves: https://pagure.io/SSSD/sssd/issue/2229 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Refactor reading the config fileJakub Hrozek2017-02-281-60/+84
| | | | | | This is in preparation for creating a fallback configuration Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Test the files domain autoconfigurationJakub Hrozek2017-02-271-0/+78
| | | | | | Adds tests that exercise the implicit files domain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Enable the files domain for all integration testsJakub Hrozek2017-02-272-1/+10
| | | | | | | | This is done to make sure that enabling the files domain doesn't break existing functionality as well as making it possible to even that the implicit domain, since all integration tests use the same configuration. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Enable an implicit files domain if one is not configuredJakub Hrozek2017-02-2710-2/+238
| | | | | | | | | | | | | | | | | If SSSD is compiled with --enable-files-domain, the loading of the domains changes such that: * if no domain with id_provider=files exists in the config file, an implicit SSSD files domain is added * this domain is always first in the list The administrator is free to create a files domain in the config file himself and either place it at the end of the list or not enable it at all. Resolves: https://pagure.io/SSSD/sssd/issue/3112 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DOC: Deprecate README, add README.mdJakub Hrozek2017-02-272-43/+28
| | | | | | | | | | | | | To make it easier to display the contents of README on the project homepage, this patch converts the README contents to README.md. The original README is removed so that we don't maintain two different sources. The links to fedorahosted are retained until we migrate the wiki pages. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Remove unused importJakub Hrozek2017-02-231-1/+0
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: allow pkinit pre-authenticationSumit Bose2017-02-234-13/+303
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-234-15/+45
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: return name of PKCS#11 module and key id to pam_sssSumit Bose2017-02-237-18/+221
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: forward Smartcard credentials to backendsSumit Bose2017-02-233-24/+97
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authtok: enhance support for Smartcard auth blobsSumit Bose2017-02-235-15/+625
| | | | | | | | | The blobs contains beside the PIN the name of the PKCS#11 module and the token name where the certificate of the user was found and the key id. Those data will be used e.g. by the pkinit module to make sure them right certificate is used. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/proxy: tell frontend that Smartcard auth is not supportedSumit Bose2017-02-232-1/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-30 20:22:16 +0000