summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* MONITOR: Remove deprecated pong sbus methodJakub Hrozek2016-11-0913-27/+0
| | | | | | | The pong method is deprecated since we started using the watchdog. Since this is dead code, it makes sense to just remove it. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding message about reason why cache changedPetr Cech2016-11-081-4/+20
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Adding message to inform which cache is usedPetr Cech2016-11-081-0/+32
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3060 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Extending sysdb sudo store testsPetr Čech2016-11-081-1/+167
| | | | | | | | | | | We covered diference between case sensitive and case insensitive domains. If domain is case insensitive we add lowercase form of sudoUser to local sysdb cache. Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Adding lowercase sudoUser formPetr Čech2016-11-081-0/+64
| | | | | | | | | | | If domain is not case sensitive we add lowercase form of usernames to sudoUser attributes. So we actually able to apply sudoRule on user Administrator@... with login admnistrator@... Resolves: https://fedorahosted.org/sssd/ticket/3203 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Do not set up watchdog for monitorJakub Hrozek2016-11-083-4/+10
| | | | | | | | | | | It makes little sense to set up watchdog for monitor because there is no entity that would restart the monitor. Therefore we should disable the watchdog for monitor process. Resolves: https://fedorahosted.org/sssd/ticket/3232 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix linking with librtLukas Slebodnik2016-11-072-0/+14
| | | | | | | | | | | | | The posix realime extensions defines timer_* functions but it does not mention library with these functions. http://www.unix.org/version2/whatsnew/realtime.html The autoconf macro AC_SEARCH_LIBS firstly check the function timer_create with no libraries, then for each library listed in 2nd parameter. Possible libraries librt and libposix4 were used in nspr for similar detection. Reviewed-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
* ad_access_filter search for nested groupsMike Ely2016-11-031-0/+16
| | | | | | | | | | Includes instructions and example for AD nested group access Related to https://fedorahosted.org/sssd/ticket/3218 Signed-off-by: Mike Ely <github@taupehat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as wellJakub Hrozek2016-11-034-7/+144
| | | | | | | | | | | | | | | | | | | In cases where the domain name in sssd.conf does not match the AD domain, our previous matching process wouldn't match. This patch augments the matching as follows: - the search base is known to sysdb_try_to_find_expected_dn and is expected to be non-NULL - the existing matching is ran first - during the search base, matching, all the non-DC components are stripped from the search base to 'canonicalize' the search base - if only a single entry that matches with a non-DC DN component (matching with a DC component would mean the DN comes from a different domain) then this entry is a match and is returned Resolves: https://fedorahosted.org/sssd/ticket/3199 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Split sysdb_try_to_find_expected_dn() into smaller functionsJakub Hrozek2016-11-031-99/+179
| | | | | | | | | | The function sysdb_try_to_find_expected_dn was performing several matching algorithms and thus it was getting big and hard to extend. This patch doesn't contain any functional changes, only shuffles the code around and splits the monolithic sysdb_try_to_find_expected_dn function into smaller blocks. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: add pam_response_filter optionSumit Bose2016-11-028-15/+297
| | | | | | | | | Currently the main use-case for this new option is to not set the KRB5CCNAME environment varible for services like 'sudo-i'. Resolves https://fedorahosted.org/sssd/ticket/2296 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add a test for filter_responses()Sumit Bose2016-11-023-2/+57
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: resolve domain local groups for remote usersSumit Bose2016-10-314-7/+569
| | | | | | | | | | | | | If a user from a trusted domain in the same forest is a direct or indirect member of domain local groups from the local domain those memberships must be resolved as well. Since those domain local groups are not valid in the trusted domain a DC from the trusted domain which is used to lookup the user data is not aware of them. As a consequence those memberships must be resolved against a local DC in a second step. Resolves https://fedorahosted.org/sssd/ticket/3206 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: make some nested group related calls publicSumit Bose2016-10-312-10/+18
| | | | | | | sdap_nested_groups_store() and rfc2307bis_nested_groups_send/recv() will be reused for domain local group lookups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add parent_dom to sysdb_get_direct_parents()Sumit Bose2016-10-313-5/+34
| | | | | | | | | | Currently sysdb_get_direct_parents() only return direct parents from the same domain as the child object. In setups with sub-domains this might not be sufficient. A new option parent_dom is added which allows to specify a domain the direct parents should be lookup up in. If it is NULL the whole cache is searched. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: Flags for command initializationMichal Židek2016-10-273-44/+63
| | | | | | | | | | | Allow passing flags for command specific initialization. Currently only one flag is available to skip the confdb initialization which is required to improve config-check command. Resolves: https://fedorahosted.org/sssd/ticket/3209 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* dlopen-test: Add check for untested librariesLukas Slebodnik2016-10-251-0/+69
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Move libraries to the right "sections"Lukas Slebodnik2016-10-251-5/+4
| | | | | | | | The library winbind_idmap_sss.so is build only when building with samba. The library libdlopen_test_providers.so was moved to the group of libraries build for testing purposes. Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Add missing libraries to the check listLukas Slebodnik2016-10-251-0/+13
| | | | | | | | nfsidmap plugin(sss.so) and libsss_cert.so were not checked. Few libraries which are build for testing purposes were added to the list otherwise we would not be able to detect unchecked libraries. Reviewed-by: Petr Čech <pcech@redhat.com>
* dlopen-test: Use portable macro for location of .libsLukas Slebodnik2016-10-251-2/+3
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* BUILD: Accept krb5 1.15 for building the PAC pluginLukas Slebodnik2016-10-251-1/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* BUILD: Fix installation without sambaSorah Fukumori2016-10-221-0/+4
| | | | | | | | winbindplugindir is defined only when BUILD_SAMBA is on. Also the file doesn't exist when BUILD_SAMBA is off, so installation will fail. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* crypto-tests: Rename encrypt decrypt test caseLukas Slebodnik2016-10-211-2/+2
| | | | | | | | | | | libsss_crypto provide 2 pairs of encrypt + decrypt functions. sss_password_encrypt + sss_password_decrypt and more generic sss_encrypt + sss_decrypt. The name of one test case was a little bit confusing. It evokes that different pair of functions were tested. Reviewed-by: Christian Heimes <cheimes@redhat.com>
* crypto-tests: Add unit test for sss_encrypt + sss_decryptLukas Slebodnik2016-10-211-0/+44
| | | | Reviewed-by: Christian Heimes <cheimes@redhat.com>
* libcrypto: Check right value of CRYPTO_memcmpLukas Slebodnik2016-10-211-1/+1
| | | | | | | | sss_decrypt failed even though should pass because we were checking wrong value of CRYPTO_memcmp. Nobody noticed that because there was not a unit test :-) Reviewed-by: Christian Heimes <cheimes@redhat.com>
* BUILD: Fix build without sambaLukas Slebodnik2016-10-211-1/+1
| | | | | | | | | | | | | The test test_ad_subdom should be compiled only if samba build is enabled. In file included from src/tests/cmocka/test_ad_subdomains.c:39:0: ./src/providers/ad/ad_subdomains.c:35:17: fatal error: ndr.h: No such file or directory #include <ndr.h> ^ compilation terminated. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* crypto: Port libcrypto code to openssl-1.1Lukas Slebodnik2016-10-207-91/+190
| | | | | | EVP_MD_CTX and EVP_CIPHER_CTX are opaque in openssl-1.1 Reviewed-by: Tomas Mraz <tmraz@redhat.com>
* cache_req: delete old codePavel Březina2016-10-202-1886/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: switch to new codePavel Březina2016-10-2010-14/+53
| | | | | | | This patch switch the old switch-based cache req code to the new plugin-based. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: move from switch to plugins, add pluginsPavel Březina2016-10-2015-0/+2019
| | | | | | This patch adds all existing functionality into plugins. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: move from switch to plugins; add logicPavel Březina2016-10-205-0/+1295
| | | | | | | | | | | | | | | cache_req grown quite big from the original code and it turned out that using switch statements to branch code for different cases makes the code quite hard to read and further extend and any modification to the logic itself is difficult. This patch changes the switch statements to plugins with small functions and separates logic into multiple modules. This gives us better control over the code and improves readability and maintainability while keeping code duplication to minimum. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Petr Cech <pcech@redhat.com>
* Updating the version to track sssd-1-15 developmentJakub Hrozek2016-10-201-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Updating the version for the 1.14.3 developmentJakub Hrozek2016-10-191-1/+1
|
* Updating the translations for the 1.14.2 releasesssd-1_14_2Jakub Hrozek2016-10-1940-25003/+37462
|
* CI: Remove dlopen-test from valgrind blacklistLukas Slebodnik2016-10-191-2/+2
| | | | | | | | | | | | | Dlopen test was added to blacklist due to following reason: > Disable running dlopen-tests under Valgrind as their use of dlclose > makes Valgrind drop symbols and produce meaningless backtraces, which > cannot be matched with specific suppressions. It's true that dlclose makes meaningless backtraces but backtraces should not be generated otherwise there is a bug in some library which need to be fixed and not suppressed. Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* TESTS: Fix check for py bindings in dlopen testsFabiano Fidêncio2016-10-171-2/+2
| | | | | | | | | The current code checks only for "HAVE_PYTHON_BINDINGS", which is not even a valid check. Let's do the proper check according to the python version (HAVE_PYTHON2_BINDINGS or HAVE_PYTHON3_BINDINGS). Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Adding intg. tests on nested groupsPetr Čech2016-10-141-0/+157
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2940 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Removing of member link from groupSumit Bose2016-10-141-0/+9
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2940 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libwbclient-sssd: update interface to version 0.13Sumit Bose2016-10-145-3/+71
| | | | | | | | | | This patch adds wbcCtxUnixIdsToSids() and wbcUnixIdsToSids() to SSSD's libwbclient and implements the latter. Resolves: https://fedorahosted.org/sssd/ticket/3181 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sssctl: Fix a typo in preprocessor macroJakub Hrozek2016-10-141-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RPM: Require initscripts on non-systemd platformsJakub Hrozek2016-10-141-0/+3
| | | | | | | | In order for sssctl to work on platforms that do not use systemd, we need to require /sbin/service them for sssd-tools so that the binary can be invoked. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Not having /sbin/service is not fatalJakub Hrozek2016-10-141-1/+1
| | | | | | | If the target platform does not have the service executable, we must not fail the build, but proceed, just disabling the functionality in sssctl. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Only search for service in /sbin and /usr/sbinJakub Hrozek2016-10-141-1/+1
| | | | | | | The shell is executed for invocation of the service binary. Therefore it is better to search the binary only in safe paths. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sssctl: call service with absolute pathPavel Březina2016-10-111-3/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Detect the path of the "service" executableJakub Hrozek2016-10-112-4/+15
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sssctl: use systemd D-Bus APIPavel Březina2016-10-114-10/+154
| | | | | | | | | If systemd is used we leverage it's D-Bus API instead of running systemctl. Resolves: https://fedorahosted.org/sssd/ticket/3056 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Add tests for getorig by UPN NSS opJakub Hrozek2016-10-111-0/+34
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* tests: Add tests for sidbyname NSS operationJakub Hrozek2016-10-111-0/+129
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* nss: allow UPNs in SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAMESumit Bose2016-10-101-10/+66
| | | | | | | | | | | | | | When adding support for UPNs, email addresses and aliases the SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME request were forgotten. This patch adds the missing support because it might be irritating if getpwnam() can resolve the name but the other requests fail. The same logic as for the plain user lookup is used, this add some code duplication which is expected to be removed when the nss responder will be switched to use the new cache_req code. Resolves https://fedorahosted.org/sssd/ticket/3194 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_cache: improve option argument handlingJustin Stephenson2016-10-102-1/+10
| | | | | | | | | | Print informational message and exit when multiple arguments are provided for single-argument options with sss_cache Resolves: https://fedorahosted.org/sssd/ticket/3180 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-10-01 20:22:56 +0000