summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* SYSDB: Remove unused prototype from header fileLukas Slebodnik2016-11-251-5/+0
| | | | | | | The function sysdb_get_sudo_filter was removed as part of ticket #2919 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Fix implicit declaration of function 'htobe32'Lukas Slebodnik2016-11-252-0/+2
| | | | | | | | | | | | | | | | | | | Include internal wrapper header file for endian related functions. The "util/sss_endian.h" include available header file on different platform or it provides compatible macros in the worst case. Breakage noticed when building SSSD on FreeBSD CC src/util/cert/nss/libsss_cert_la-cert.lo src/util/cert/nss/cert.c: In function 'cert_to_ssh_key': src/util/cert/nss/cert.c:358: error: implicit declaration of function 'htobe32' gmake[2]: *** [Makefile:12421: src/util/cert/nss/libsss_cert_la-cert.lo] Error 1 gmake[2]: Leaving directory '/root/sssd_from_git' gmake[1]: *** [Makefile:20050: all-recursive] Error 1 gmake[1]: Leaving directory '/root/sssd_from_git' gmake: *** [Makefile:7116: all] Error 2 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Drop libsss_configFabiano Fidêncio2016-11-2416-1849/+0
| | | | | | | | | | | | libsss_config has been used only by OpenLMI and the project has been deprecated making, then, no sense to keep the support on SSSD. Distros that, for some reason, are still packing and distributing OpenLMI can stick to SSSD 1.14 branch. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Defer thread cancellation until completion of nss/pam operationsHoward Guo2016-11-243-85/+7
| | | | | | | | | | | | | The client code is not cancellation-safe, an application which has cancelled an NSS operation will experience subtle bugs, hence thread cancellation is deferred until completion of client operations. Resolves: https://fedorahosted.org/sssd/ticket/3156 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Florian Weimer <fweimer@redhat.com>
* SECRETS: Add configurable payload size limit of a secretFabiano Fidêncio2016-11-2413-0/+83
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3169 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Delete all secrets stored during "max_secrets" testFabiano Fidêncio2016-11-241-0/+4
| | | | | | | | | | Otherwise we will have an 507 error in case any secret is added by any of the tests that may be implemented in the future. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Check new line at end of fileLukas Slebodnik2016-11-234-3/+16
| | | | Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* SYSDB: Fixing of sudorule without a sudoUserPetr Čech2016-11-231-0/+5
| | | | | | | | | | | | | | This patch solved a regression caused by the recent patches to lowercase sudoUser -- in case sudoUser is missing completely, we abort the processing of this rule and all others. With this patch, we return ERR_MALFORMED_ENTRY and gracefully skip the malformed rule instead. Resolves: https://fedorahosted.org/sssd/ticket/3241 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Remove spurious warning in logsLukas Slebodnik2016-11-221-1/+1
| | | | | | | | | | The option krb5_map_user is empty by default. Therefore we should not confuse users wih warning (Fri Nov 15 09:58:49 2016) [sssd[be[example.com]]] [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty! Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Fix a typo in inotify.m4Jakub Hrozek2016-11-221-2/+2
| | | | | | | | This typo prevented HAVE_INOTIFY from ever being set and as an effect, prevented /etc/resolv.conf inotify detection from working Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* tests: Add a test for group resolution with ldap_group_nesting_level=0Jakub Hrozek2016-11-161-0/+29
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Qualify ghost user attribute in case ldap_group_nesting_level is set to 0Jakub Hrozek2016-11-161-4/+11
| | | | | | | | | | | When the sssd is set to not resolve nested groups with RFC2307bis, then the LDAP provider takes a different path. We didn't qualify the ghost users in this case. Resolves: https://fedorahosted.org/sssd/ticket/3236 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for IPA providerJustin Stephenson2016-11-153-75/+144
| | | | | | | | | | | Update man pages for any IPA provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for AD providerJustin Stephenson2016-11-153-24/+78
| | | | | | | | | | | Update man pages for any AD provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa: Nested netgroups do not workMichal Židek2016-11-141-12/+3
| | | | | | | | | | | | | | | We lowercase the keys to the hash table used to store netgroups but do not lowercase it when reading the table. This results in nested netgroups not being found when they should and the processing fails. The lowercasing does not seem to be necessary anymore (not sure if it ever was) so we can skip it. Resolves: https://fedorahosted.org/sssd/ticket/3159 Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Removing of never read valuePetr Čech2016-11-141-1/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Adding of return value checkingPetr Čech2016-11-141-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Add allowed_sec_users_optionsFabiano Fidêncio2016-11-101-5/+10
| | | | | | | | | | | There are options (the proxying related ones) that only apply to the secrets' subsections. In order to make config API able to catch those, let's create a new section called allowed_sec_users_options) and move there these proxying options. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Fix secrets rule in the allowed sectionsFabiano Fidêncio2016-11-101-2/+2
| | | | | | | | | | | | | | We have been matching an invalid subsection of the secrets' section, like: [secrets/users/] Let's ensure that we only match the following cases: [secrets] [secrets/users/[0-9]+] Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA/AD: check auth ctx before using itSumit Bose2016-11-102-5/+28
| | | | | | | | | | | | | In e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483 a feature was introduced to set the 'canonicalize' option in the system-wide Kerberos configuration according to the settings in SSSD if the AD or IPA provider were used. Unfortunately the patch implied that the auth provider is the same as the id provider which might not always be the case. A different auth provider caused a crash in the backend which is fixed by this patch. Resolves https://fedorahosted.org/sssd/ticket/3234 Reviewed-by: Petr Cech <pcech@redhat.com>
* MONITOR: Remove unused shutDown sbus methodJakub Hrozek2016-11-0911-21/+0
| | | | | | | The shutDown method has not been used or set for a long time. Trim the internal interface by removing all references to this internal method. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Remove deprecated pong sbus methodJakub Hrozek2016-11-0913-27/+0
| | | | | | | The pong method is deprecated since we started using the watchdog. Since this is dead code, it makes sense to just remove it. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding message about reason why cache changedPetr Cech2016-11-081-4/+20
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding message to inform which cache is usedPetr Cech2016-11-081-0/+32
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Extending sysdb sudo store testsPetr Čech2016-11-081-1/+167
| | | | | | | | | | | We covered diference between case sensitive and case insensitive domains. If domain is case insensitive we add lowercase form of sudoUser to local sysdb cache. Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Adding lowercase sudoUser formPetr Čech2016-11-081-0/+64
| | | | | | | | | | | If domain is not case sensitive we add lowercase form of usernames to sudoUser attributes. So we actually able to apply sudoRule on user Administrator@... with login admnistrator@... Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Do not set up watchdog for monitorJakub Hrozek2016-11-083-4/+10
| | | | | | | | | | | It makes little sense to set up watchdog for monitor because there is no entity that would restart the monitor. Therefore we should disable the watchdog for monitor process. Resolves: https://fedorahosted.org/sssd/ticket/3232 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix linking with librtLukas Slebodnik2016-11-072-0/+14
| | | | | | | | | | | | | The posix realime extensions defines timer_* functions but it does not mention library with these functions. http://www.unix.org/version2/whatsnew/realtime.html The autoconf macro AC_SEARCH_LIBS firstly check the function timer_create with no libraries, then for each library listed in 2nd parameter. Possible libraries librt and libposix4 were used in nspr for similar detection. Reviewed-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
* ad_access_filter search for nested groupsMike Ely2016-11-031-0/+16
| | | | | | | | | | Includes instructions and example for AD nested group access Related to https://fedorahosted.org/sssd/ticket/3218 Signed-off-by: Mike Ely <github@taupehat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as wellJakub Hrozek2016-11-034-7/+144
| | | | | | | | | | | | | | | | | | | In cases where the domain name in sssd.conf does not match the AD domain, our previous matching process wouldn't match. This patch augments the matching as follows: - the search base is known to sysdb_try_to_find_expected_dn and is expected to be non-NULL - the existing matching is ran first - during the search base, matching, all the non-DC components are stripped from the search base to 'canonicalize' the search base - if only a single entry that matches with a non-DC DN component (matching with a DC component would mean the DN comes from a different domain) then this entry is a match and is returned Resolves: https://fedorahosted.org/sssd/ticket/3199 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Split sysdb_try_to_find_expected_dn() into smaller functionsJakub Hrozek2016-11-031-99/+179
| | | | | | | | | | The function sysdb_try_to_find_expected_dn was performing several matching algorithms and thus it was getting big and hard to extend. This patch doesn't contain any functional changes, only shuffles the code around and splits the monolithic sysdb_try_to_find_expected_dn function into smaller blocks. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: add pam_response_filter optionSumit Bose2016-11-028-15/+297
| | | | | | | | | Currently the main use-case for this new option is to not set the KRB5CCNAME environment varible for services like 'sudo-i'. Resolves https://fedorahosted.org/sssd/ticket/2296 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add a test for filter_responses()Sumit Bose2016-11-023-2/+57
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: resolve domain local groups for remote usersSumit Bose2016-10-314-7/+569
| | | | | | | | | | | | | If a user from a trusted domain in the same forest is a direct or indirect member of domain local groups from the local domain those memberships must be resolved as well. Since those domain local groups are not valid in the trusted domain a DC from the trusted domain which is used to lookup the user data is not aware of them. As a consequence those memberships must be resolved against a local DC in a second step. Resolves https://fedorahosted.org/sssd/ticket/3206 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: make some nested group related calls publicSumit Bose2016-10-312-10/+18
| | | | | | | sdap_nested_groups_store() and rfc2307bis_nested_groups_send/recv() will be reused for domain local group lookups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add parent_dom to sysdb_get_direct_parents()Sumit Bose2016-10-313-5/+34
| | | | | | | | | | Currently sysdb_get_direct_parents() only return direct parents from the same domain as the child object. In setups with sub-domains this might not be sufficient. A new option parent_dom is added which allows to specify a domain the direct parents should be lookup up in. If it is NULL the whole cache is searched. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: Flags for command initializationMichal Židek2016-10-273-44/+63
| | | | | | | | | | | Allow passing flags for command specific initialization. Currently only one flag is available to skip the confdb initialization which is required to improve config-check command. Resolves: https://fedorahosted.org/sssd/ticket/3209 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* dlopen-test: Add check for untested librariesLukas Slebodnik2016-10-251-0/+69
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Move libraries to the right "sections"Lukas Slebodnik2016-10-251-5/+4
| | | | | | | | The library winbind_idmap_sss.so is build only when building with samba. The library libdlopen_test_providers.so was moved to the group of libraries build for testing purposes. Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Add missing libraries to the check listLukas Slebodnik2016-10-251-0/+13
| | | | | | | | nfsidmap plugin(sss.so) and libsss_cert.so were not checked. Few libraries which are build for testing purposes were added to the list otherwise we would not be able to detect unchecked libraries. Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Use portable macro for location of .libsLukas Slebodnik2016-10-251-2/+3
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* BUILD: Accept krb5 1.15 for building the PAC pluginLukas Slebodnik2016-10-251-1/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* BUILD: Fix installation without sambaSorah Fukumori2016-10-221-0/+4
| | | | | | | | winbindplugindir is defined only when BUILD_SAMBA is on. Also the file doesn't exist when BUILD_SAMBA is off, so installation will fail. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* crypto-tests: Rename encrypt decrypt test caseLukas Slebodnik2016-10-211-2/+2
| | | | | | | | | | | libsss_crypto provide 2 pairs of encrypt + decrypt functions. sss_password_encrypt + sss_password_decrypt and more generic sss_encrypt + sss_decrypt. The name of one test case was a little bit confusing. It evokes that different pair of functions were tested. Reviewed-by: Christian Heimes <cheimes@redhat.com>
* crypto-tests: Add unit test for sss_encrypt + sss_decryptLukas Slebodnik2016-10-211-0/+44
| | | | Reviewed-by: Christian Heimes <cheimes@redhat.com>
* libcrypto: Check right value of CRYPTO_memcmpLukas Slebodnik2016-10-211-1/+1
| | | | | | | | sss_decrypt failed even though should pass because we were checking wrong value of CRYPTO_memcmp. Nobody noticed that because there was not a unit test :-) Reviewed-by: Christian Heimes <cheimes@redhat.com>
* BUILD: Fix build without sambaLukas Slebodnik2016-10-211-1/+1
| | | | | | | | | | | | | The test test_ad_subdom should be compiled only if samba build is enabled. In file included from src/tests/cmocka/test_ad_subdomains.c:39:0: ./src/providers/ad/ad_subdomains.c:35:17: fatal error: ndr.h: No such file or directory #include <ndr.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* crypto: Port libcrypto code to openssl-1.1Lukas Slebodnik2016-10-207-91/+190
| | | | | | EVP_MD_CTX and EVP_CIPHER_CTX are opaque in openssl-1.1 Reviewed-by: Tomas Mraz <tmraz@redhat.com>
* cache_req: delete old codePavel Březina2016-10-202-1886/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: switch to new codePavel Březina2016-10-2010-14/+53
| | | | | | | This patch switch the old switch-based cache req code to the new plugin-based. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-10-02 13:45:51 +0000