summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Update viewname for all providerstlogPavel Březina2017-04-211-0/+6
|
* INTG: Add session recording testsNikolai Kondrashov2017-04-203-14/+702
| | | | | Add basic tests for all base combinations of session recording configuration options.
* PAM: Export original shell to tlog-recNikolai Kondrashov2017-04-201-0/+93
| | | | | | | Add exporting of original user shell (as returned by NSS) as an environment variable for use by tlog-rec, when session recording is enabled for the user. This lets tlog-rec start the actual user shell, after tlog-rec is started in its place.
* NSS: Substitute session recording shellNikolai Kondrashov2017-04-201-1/+47
| | | | | | | Substitute the configured session recording shell when unconditional session recording is enabled (scope = all), or when selective session recording is enabled (scope = some), and the user has the sessionRecording attribute set to true.
* CACHE_REQ: Pull sessionRecording attrs from initgrNikolai Kondrashov2017-04-205-4/+368
| | | | | | | | | | After entires are retrieved by cache_req for user info requests (except initgr), overlay them with sessionRecording attribute retrieved from an initgr request made additionally for each entry. Do not do additional initgr requests with selective session recording enabled, if we don't have any group names to match against in session recording configuration. Only do user name matches instead.
* DP: Overlay sessionRecording attribute on initgrNikolai Kondrashov2017-04-201-34/+237
| | | | | | Add sessionRecording attribute to user entries on initgr request in data provider, specifying if the user name or groups match the ones with session recording enabled.
* DP: Load override_space into be_ctxNikolai Kondrashov2017-04-202-0/+23
| | | | | | Add loading and storing the override_space configuration option to data provider. That will be needed for formatting output user and group names for matching against session recording configuration.
* SYSDB: Add sessionRecording attribute macroNikolai Kondrashov2017-04-201-0/+2
| | | | | | Add a macro for sessionRecording attribute to sysdb.h. To be used for storing a boolean attribute signifying if session recording is enabled for the user.
* DP: Add session recording conf loadingNikolai Kondrashov2017-04-203-0/+12
| | | | | | Add session recording configuration loading to the data provider initialization. To be used for matching users and groups with session recording enabled.
* RESPONDER: Add session recording conf loadingNikolai Kondrashov2017-04-204-0/+17
| | | | | | Add session recording configuration loading to the common responder initialization. To be used for substituting the user shell when session recording is enabled.
* UTIL: Add session recording conf management moduleNikolai Kondrashov2017-04-203-0/+154
| | | | | Add an util module for loading session recording configuration. To be used by responders and data provider.
* BUILD: Support configuring session recording shellNikolai Kondrashov2017-04-202-0/+17
| | | | | Add support for specifying the shell used for recording user sessions, at configure time.
* CONFIG: Add session_recording sectionNikolai Kondrashov2017-04-204-2/+26
| | | | | | | | | | Add information on "session_recording" config section, having three options: "scope", "users", and "groups". The section is intended for disabling session recording ("scope = none", default), enabling session recording for all users ("scope = all"), and enabling it for some specific users and/or groups ("scope = some", "users = <users>", "groups = <groups>").
* NSS: Move nss_get_shell_override to responder utilsNikolai Kondrashov2017-04-203-84/+89
| | | | | | | Move nss_get_shell_override to common responder utils and rename it to sss_resp_get_shell_override to make it available to other responders. In particular let PAM responder use it to provide original shell when it is overriden for session recording.
* NSS: Move shell options to common responderNikolai Kondrashov2017-04-205-126/+128
| | | | | | | Move all the shell-related options from the NSS responder context to the common responder context, so they can be used by other responders for retrieving original user shell, when it is overrided for session recording.
* NSS: Move output name formatting to utilsNikolai Kondrashov2017-04-206-49/+94
| | | | | Move NSS nss_get_name_from_msg and the core of sized_output_name to the utils to make them available to provider and other responders.
* CACHE_REQ: Rename done to search_domains_doneNikolai Kondrashov2017-04-201-3/+3
| | | | | | Rename `cache_req_done` to `cache_req_search_domains_done` to match the function using it (`cache_req_search_domains`) better and make space for chaining in session recording overlay request.
* CACHE_REQ: Rename search_domains_done to search_domains_next_doneNikolai Kondrashov2017-04-201-3/+4
| | | | | | | | Rename `cache_req_search_domains_done` to `cache_req_search_domains_next_done` to match the function using it (`cache_req_search_domains_next`), to avoid confusion with `cache_req_done`, and to make space for chaining in session recording overlay request.
* CACHE_REQ: Propagate num_results to cache_req_stateNikolai Kondrashov2017-04-201-2/+7
| | | | | | The num_results field in struct cache_req_state was only set in case of well-known objects, set it also for the regular results for uniformity, and for later use by session recording code.
* SPEC: Drop conditional build for krb5_local_auth_pluginLukas Slebodnik2017-04-191-6/+0
| | | | | | | | | It was mainly aimed for time when stable CentOS and rhel nightly had different versions of krb5. Anyway, rhel7.0 and rhel <= 6.6 are already out of support Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* minor typo fixesRené Genz2017-04-195-16/+16
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* UTIL: Use max 15 characters for AD host UPNLukas Slebodnik2017-04-121-1/+7
| | | | | | | | | | | | | | | | | We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" because it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" because of other principals in keytab. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name Resolves: https://pagure.io/SSSD/sssd/issue/3329 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sbus: check connection for NULL before unregister itSumit Bose2017-04-121-1/+7
| | | | | | | | | | | | There seem to be code paths where the data is a added to the hash before the connection is properly initialized, to avoid core dump during shut down we only call dbus_conection_unregister_object_path() if there is a connection. Resolves: https://pagure.io/SSSD/sssd/issue/3367 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5_LOCATOR: add env variable to disable pluginSumit Bose2017-04-112-0/+20
| | | | | | | | | | | | | If the new environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value SSSD's krb5 locator plugin is disabled. The variable is needed because there is currently no other way than removing the plugin completely to disable it. For a use-case see e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1072939. Resolves: https://pagure.io/SSSD/sssd/issue/3359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* config-check: Message when sssd.conf is missingMichal Židek2017-04-101-1/+4
| | | | | | | | | | sssctl config-check should print a message for user if no sssd.conf was found. Resolves: https://pagure.io/SSSD/sssd/issue/3330 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* i18n: adding sssctl filesSumit Bose2017-04-101-0/+8
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssctl: integrate pam_test_client into sssctlSumit Bose2017-04-105-72/+72
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add InfoPipe user lookupSumit Bose2017-04-102-0/+72
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_sifp: update method namesSumit Bose2017-04-102-3/+3
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add SSSD getpwnam lookupSumit Bose2017-04-102-2/+84
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add service and environment to PAM test clientSumit Bose2017-04-101-12/+38
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Fix handling of enable_files_domainLukas Slebodnik2017-04-101-8/+8
| | | | | | | | | | | The option enable_files_domain worked only if sssd was compiled with --enable-files-domain. But manual page described something else. Resolves: https://pagure.io/SSSD/sssd/issue/3340 Reviewed-by: Michal Židek <mzidek@redhat.com>
* DP: Fix typoPavel Březina2017-04-061-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* selinux: Do not fail if SELinux is not managedMichal Židek2017-04-065-24/+49
| | | | | | | | | | | Previously we failed if semanage_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa_s2n_get_acct_info_send: provide correct req_input namePavel Březina2017-04-031-4/+36
| | | | | | | | | | To avoid crash. Resolves: https://pagure.io/SSSD/sssd/issue/3358 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: do not leak selinux context on clients destructionPavel Březina2017-04-031-1/+19
| | | | | | | | | | The SELinux context created in get_client_cred is not talloc bound and we were leaking it if available with each client's destruction. Resolves: https://pagure.io/SSSD/sssd/issue/3360 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix compilation of libsss_certmap with libcryptoLukas Slebodnik2017-04-031-1/+2
| | | | | | | | | | | CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c:25:18: fatal error: cert.h: No such file or directory #include <cert.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com>
* libsss_certmap: Accept certificate with data before headerDavid Kupka2017-04-032-4/+21
| | | | | | | | | | | | | According to RFC 7468 parser must not fail when some data are present before the encapsulation boundary. sss_cert_pem_to_der didn't respect this and refused valid input. Changing it's code to first locate the certificate header fixes the issue. Resolves: https://pagure.io/SSSD/sssd/issue/3354 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* configure: fix typoPavel Březina2017-03-301-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_iobuf: fix 'read' shadows a global declarationPavel Březina2017-03-301-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* secrets: always add Content-Length headerPavel Březina2017-03-301-4/+68
| | | | | | | | | If custodia server does not reply with Content-Length header, curl may wait for non-existing body of http reply if such body does not exist (for example during POST operation when creating a container). Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: fix debug messagePavel Březina2017-03-301-1/+2
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: support HTTP basic authentication with proxy providerPavel Březina2017-03-301-0/+9
| | | | | | | | Even though configuration options auth_type = basic, username and password are read they were not used anywhere prior this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: allow to configure certificate checkPavel Březina2017-03-305-0/+149
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: remove http-parser code in proxy providerPavel Březina2017-03-301-581/+0
| | | | | | | | | | We switche to libcurl in previous patch. This just removes the unused code. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* secrets: use tcurl in proxy providerPavel Březina2017-03-304-84/+192
| | | | | | | | | | | | We switch from http-parser to libcurl for an http client. This gaves us many features for free such as tls and http basic authentication support instead of implementing it on our own. Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* build: make curl required by secretsPavel Březina2017-03-302-15/+7
| | | | | | | | Also remove --disable-libcurl since it doesn't make sense. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ci: do not build secrets on rhel6Pavel Březina2017-03-303-0/+20
| | | | | | | We require newer libcurl version than is available on rhel6. We don't ship secrets responder in rhel6 so we just disable its build. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tcurl test: add support for client certificatePavel Březina2017-03-301-0/+13
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: allow to set custom headersPavel Březina2017-03-301-2/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 21:15:39 +0000