summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* KCM: include missing header fileLukas Slebodnik2017-05-091-0/+1
| | | | | | | | | | | | | | | | | | man 2 readv says that the header file "sys/uio.h" must be included for the functions readv/writev Previously, "sys/uio.h" was included in "sys/socket.h" in glibc. It worked just by a change. But it will be changed in glibc-2.26. https://sourceware.org/bugzilla/show_bug.cgi?id=21426 src/responder/kcm/kcmsrv_cmd.c: In function 'kcm_iovec_op': src/responder/kcm/kcmsrv_cmd.c:75:15: error: implicit declaration of function 'readv'; did you mean 'read'? [-Werror=implicit-function-declaration] src/responder/kcm/kcmsrv_cmd.c:77:15: error: implicit declaration of function 'writev'; did you mean 'write'? [-Werror=implicit-function-declaration] Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SERVER_MODE: Update sdap lists for each ad_ctxMichal Židek2017-05-041-0/+36
| | | | | | | | | | | | | | | | | We use separate AD context for each subdomain in the server mode. Every such context has it's own sdap_domain list witch represents sdap options such as filter and search bases for every domain. However AD context can only fully initialize sdap_domain structure for the same domain for which the whole context was created, which resulted in the other sdap_domain structures to be have automaticily detected settings. This can cause problems if user is member of groups from multiple domains. Resolves: https://pagure.io/SSSD/sssd/issue/3381 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: check matching certificates from all domainsSumit Bose2017-05-041-6/+63
| | | | | | | | | | Although the cache_req lookup found matching in multiple domains only the results from the first domain were used. With this patch the results from all domains are checked. Resolves https://pagure.io/SSSD/sssd/issue/3385 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: Do not fail in case rfc2307bis_nested_groups_recv() returns ENOENTFabiano Fidêncio2017-05-031-1/+7
| | | | | | | | | | | | | | | Commit 25699846 introduced a regression seen when an initgroup lookup is done and there's no nested groups involved. In this scenario the whole lookup fails due to an ENOENT returned by rfc2307bis_nested_groups_recv(), which leads to the user removal from sysdb causing some authentication issues. Resolves: https://pagure.io/SSSD/sssd/issue/3331 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SPEC: Use %license macroLukas Slebodnik2017-05-031-18/+24
| | | | | | | | | | | | Starting with rpm 4.11, it is possible to install the license using a new file macro %license, this will separate the license files from documents and install them in a special directory in /usr/share rpm -q -l -p ./sssd-1.15.3-0.el7.x86_64.rpm /usr/share/licenses/sssd-1.15.3 /usr/share/licenses/sssd-1.15.3/COPYING Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use macro python_provide conditionallyLukas Slebodnik2017-05-031-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The rpm macro python_provide is defined only in fedora and epel. This is the reason why we have fallback definition in the beginning of spec file otherwise build on rhel would fail. This macro is defined in file /usr/lib/rpm/macros.d/macros.python provided by package python-rpm-macros. sh$ rpm -qf /usr/lib/rpm/macros.d/macros.python python-rpm-macros-3-20.fc26.noarch sh$ grep python_provide /usr/lib/rpm/macros.d/macros.python %python_provide() %{lua: print("%python_provide: ERROR: ") But this package is not installed in minimal chroot and therefore build dependencies cannot be extracted from spec file. sh$ mock --clean --shell 'rpm -q python-rpm-macros' 2>/dev/null package python-rpm-macros is not installed sh$ mock --shell 'rpm --eval "%{python_provide python-test}"' 2>/dev/null %{python_provide python-test} sh$ mock --resultdir . --rebuild sssd-1.15.3-0.fc26.src.rpm ... error: line 295: Unknown tag: %{python_provide python2-sssdconfig} ... This is the reason why it has to be used conditionally in fedora as it is shown in example common spec file in python fedora packaging guidelines http://fedoraproject.org/wiki/Packaging:Python#Example_common_spec_file sh$ rpm -q --whatrequires python-rpm-macros python2-devel-2.7.13-5.fc26.x86_64 python3-devel-3.6.0-22.fc26.x86_64 This patch reduce differences between upstream and fedora spec file. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Call ldconfig in libsss_certmap scriptletsLukas Slebodnik2017-05-031-0/+4
| | | | | | We do it for other libraries. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Move kcm scriptlets to systemd sectionLukas Slebodnik2017-05-031-12/+12
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Move files provider files within packageLukas Slebodnik2017-05-031-4/+3
| | | | | | | | | It's a cosmetic change to group similar files together (e.g. man pages). The same order is in fedora downstream spec file. It simplifies comparison of changes between spec files. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated sssd-kcm man pagesLukas Slebodnik2017-05-031-2/+5
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated sss_certmap man pagesLukas Slebodnik2017-05-031-4/+9
| | | | | | | | | This patch also moved sss_certmap.5 from sssd-common to libsss_certmap Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated idmap_sss man pagesLukas Slebodnik2017-05-031-3/+6
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated sssctl man pagesLukas Slebodnik2017-05-031-0/+3
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated sss_ssh* man pagesLukas Slebodnik2017-05-031-0/+3
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Move man page for sss_rpcidmapd to the right packageLukas Slebodnik2017-05-031-4/+7
| | | | | | | | | Patch also fixes location of translated manual pages Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Use correct package for translated sssd-ifp man pageLukas Slebodnik2017-05-031-3/+6
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3327 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Add missing scriptlets for package sssd-dbusLukas Slebodnik2017-05-031-0/+9
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Move systemd service sssd-ifp.service to right packageLukas Slebodnik2017-05-031-1/+3
| | | | | | | The sssd-ifp.service was installed even though sssd_ifp was not installed on systemd. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SPEC: Update processing of translation in %installLukas Slebodnik2017-05-031-4/+22
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* AD: Make ad_account_can_shortcut() reusable by SSSD on an IPA serverJakub Hrozek2017-05-021-78/+84
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3318 The ad_account_can_shortcut() function is helpful to avoid unnecessary searches when SSSD is configured with an Active Directory domain that uses ID-mapping in the sense that if we find that an ID is outside our range, we can just abort the search in this domain and carry on. This function was only used in the AD provider functions which are used when SSSD is enrolled direcly with an AD server. This patch moves the function to a codepath that is shared between directly enrolled SSSD and SSSD running on an IPA server. Apart from moving the code, there are some minor changes to the function signature, namely the domain is passed as as struct (previously the domain name from the DP input was passed). Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Fix handling of search basesMichal Židek2017-05-024-16/+30
| | | | | | | | | | | | | We were rewriting the sdap_domain's search bases for only the first sdap_domain in the list, which does not work for subdomains. Also when search bases were already initialized in sdap_domain_subdom_add, we should only rewrite them when they were explicitly set in sssd.conf. Resolves: https://pagure.io/SSSD/sssd/issue/3351 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONTRIB: Force single-thread install to workaround concurrency issuesFabiano Fidêncio2017-05-021-1/+2
| | | | | | | | @see also https://bugzilla.redhat.com/show_bug.cgi?id=1260190 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Remove duplicated debug messageFabiano Fidêncio2017-05-021-1/+0
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Fix typo inigroups -> initgroupsFabiano Fidêncio2017-05-022-2/+2
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh tools: Split connect and communication phasesSimo Sorce2017-04-281-8/+22
| | | | | | | | | | | | | | | | | We can fallback after a connect error, but we cannot easily fall back once we start sending data as we may have consumed part of the buffer so reconnecting and sending what's left would not make sense. Therefore we now fallback on connect errors, but we issue a hard fail if error happens after communication has been established. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh tools: Fix issues with multiple IP addressesSimo Sorce2017-04-281-1/+7
| | | | | | | | | | | | | | | Cycle through all resolved address until one succeed or all fail. This is needed for dual stack systems where either IPv4 or IPv6 are improperly configured or selectively filtered at some point along the route. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh tools: The ai structure is not an array,Simo Sorce2017-04-281-3/+3
| | | | | | | | | | | | | This structure is actually a linked list, so do not mislead readers by treating it as an array. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: Avoid bool in switch/caseLukas Slebodnik2017-04-281-11/+7
| | | | | | | | Pair-Programmed-With: Michal Židek <mzidek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* Use correct spelling of overrideRené Genz2017-04-286-8/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Improve s2n debug message for missing ipaNTSecurityIdentifierJustin Stephenson2017-04-281-1/+7
| | | | | | | | | | | | This patch improves the log message to be more information for the SSSD user troubleshooting issues. If the IDM POSIX group used for AD trust HBAC/SUDO operation is missing the ipaNTSecurityIdentifier it can cause client s2n operations failures resolving the group which resulted in the inability to login for the AD user. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* overrides: add certificates to mapped attributeSumit Bose2017-04-281-0/+41
| | | | | | | | | Certificates in overrides are explicitly used to map users to certificates, so we add them to SYSDB_USER_MAPPED_CERT as well. Resolves https://pagure.io/SSSD/sssd/issue/3373 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad: handle forest root not listed in ad_enabled_domainsSumit Bose2017-04-281-3/+36
| | | | | | | | | | | Although users and groups from the forest root should be ignored SSSD will still try to get information about the forest topology from a DC from the forest root. So even if the forest root domain is disabled we should makes sure it is usable for those searches. Resolves https://pagure.io/SSSD/sssd/issue/3361 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* utils: add sss_domain_is_forest_root()Sumit Bose2017-04-282-0/+6
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3361 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Fix standalone application domainsJakub Hrozek2017-04-281-4/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a standalone application domain was configured, for example: ------------------------------------------------- [sssd] domains = appdomain [application/appdomain] id_provider=ldap ldap_uri = ldap://dc.ipa.test ldap_search_base = cn=accounts,dc=ipa,dc=test ldap_schema = rfc2307bis sudo_provider = none ldap_sasl_mech = gssapi krb5_realm = IPA.TEST krb5_server = dc.ipa.test ldap_user_uid_number = telephonenumber ldap_user_gid_number = mobile ldap_user_extra_attrs = location:l ------------------------------------------------- We would, when unrolling the application section into a domain section, first add a domain stub, equivalent to: ----------------------------- [domain/appdomain] domain_type = application ----------------------------- Which in config.ldb also contains cn. Then, whem we would add the parameters from the [application] section, but try to add the cn again. This didn't happen when inheriting from a POSIX domain, because there we would set LDB_FLAG_REPLACE for any attributes that exist in the inherited domain. This patch skips the cn attribute both when replacing an inherited domain's attributes and when writing a standalone application domain. Resolves: https://pagure.io/SSSD/sssd/issue/3355 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use search bases instead of domain_to_basedn when fetching external groupsJakub Hrozek2017-04-261-17/+13
| | | | | | | | | | | | | Instead of deriving the search base from the IPA domain name, actually use the search base from the sdap_domain structure. This has primarily the advantage of not matching groups in the compat tree. Resolves: https://pagure.io/SSSD/sssd/issue/3378 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Allow passing a NULL map to sdap_search_bases_ex_sendJakub Hrozek2017-04-261-1/+1
| | | | | | | | | | NULL attribute map and a NULL list of attributes should translate into "fetch all entry attributes" Required for: https://pagure.io/SSSD/sssd/issue/3378 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ_DOMAIN: debug the set domain resolution orderFabiano Fidêncio2017-04-261-0/+11
| | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER_COMMON: Improve domaiN_resolution_order debug messagesFabiano Fidêncio2017-04-261-0/+6
| | | | | | | | | Indicate whether a domain_resolution_order has been used and where it came from. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ_DOMAIN: Add some comments to ↵Fabiano Fidêncio2017-04-261-0/+4
| | | | | | | | cache_req_domain_new_list_from_string_list() Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Allow configurationless shortname lookupsFabiano Fidêncio2017-04-263-1/+50
| | | | | | | | | | | | | | | | Configurationless shortnames lookups must be allowed when a domains' resolution order is present and the (head) domain is not enforcing the usage of fully-qualified-names. With this patch SSSD does not require any kind of changes from client side for taking advantage of shortname lookups. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Improve non-fqnames testsFabiano Fidêncio2017-04-261-15/+30
| | | | | | | | | | | | | | | | | | | | | | With the changes that are about to happen we have to have the subdomain's fqnames flag set by the time we populate the cr_domains list (as it actually occurs with the real code), as this list may set its own fqnames flag based on the subdomain's fqnames flag. Currently the flag is set to false only when running the tests itself so the cr_domains list doesn't get populate properly (although it still works with the current code). For the changes that are comming, let's introduce a new setup function that ensures that the subdomain's fqnames flag is set up in the right time. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Fallback to global domain resolution order in case the view ↵Fabiano Fidêncio2017-04-263-53/+74
| | | | | | | | | | | | | | | | | | | | doesn't have this option set The current code has been ignoring the domain resolution order set globally on IPA in case there's a view but this doesn't have any domain resolution order set. It happens because we haven't been checking whether the view attribute didn't exist and then we ended up populating the list cache_req domains' list assuming that no order has been set instead of falling back to the next preferred method. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifierHEADmasterJakub Hrozek2017-04-241-1/+4
| | | | | | | | | | | | There was an issue in a production deployment where the admin selected a GID outside the IDM range for a group that contained a user from the trusted domain. This resulted in not adding a SID for the IPA group, which in turn meant the group couldn't be resolved on the client. This patch just improves the DEBUG message so that it's clearer for the admins where the issue is. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: remove unused variableLukas Slebodnik2017-04-211-5/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Use sized_domain_name to format the groups the user is a member ofJakub Hrozek2017-04-211-14/+15
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3268 Uses the common function sized_domain_name() to format a group the user is a member of to the appropriate format. To see the code is working correctly, run: dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:trusted_user Where trusted_user is a user from a trusted domain that is a member of groups from the joined domain and a trusted domain as well. The groups from the joined domain should not be qualified, the groups from the trusted domain should be qualified. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Move sized_output_name() and sized_domain_name() into responder common codeJakub Hrozek2017-04-215-99/+112
| | | | | | | | | | | | | | | | | | | | | These functions are used to format a name into a format that the user configured for output, including case sensitiveness, replacing whitespace and qualified format. They were used only in the NSS responder, which typically returns strings to the NSS client library and then the user. But it makes sense to just reuse the same code in the IFP responder as well, since it does essentially the same job. The patch also renames sized_member_name to sized_domain_name. Previously, the function was only used to format a group member, the IFP responder would use the same function to format a group the user is a member of. Related to: https://pagure.io/SSSD/sssd/issue/3268 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* README: Update links to mailing listsLukas Slebodnik2017-04-201-2/+4
| | | | | | | | | | Old links are redirected to information about Fedorahosted-retirement e.g. https://fedorahosted.org/mailman/listinfo/sssd-devel -> https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Drop conditional build for krb5_local_auth_pluginLukas Slebodnik2017-04-191-6/+0
| | | | | | | | | It was mainly aimed for time when stable CentOS and rhel nightly had different versions of krb5. Anyway, rhel7.0 and rhel <= 6.6 are already out of support Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* minor typo fixesRené Genz2017-04-195-16/+16
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* UTIL: Use max 15 characters for AD host UPNLukas Slebodnik2017-04-121-1/+7
| | | | | | | | | | | | | | | | | We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" because it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" because of other principals in keytab. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name Resolves: https://pagure.io/SSSD/sssd/issue/3329 Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 20:21:09 +0000