summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* RESPONDER: Wrap up the code to setup the idle timeoutFabiano Fidêncio2017-03-082-35/+54
| | | | | | | | | | | | | As secrets responder will make use of this very same code in the future, let's wrap it up into a new function in order to avoid code duplication. Related: https://pagure.io/SSSD/sssd/issue/3316 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* cache_req: use rctx as memory context during midpoint refreshPavel Březina2017-03-081-1/+1
| | | | | | | | Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: first letter of user name template for override_homedirIgnacio Reguero2017-03-072-0/+21
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_secrets: Fail in child if sssd_secrets cannot startLukas Slebodnik2017-03-071-12/+19
| | | | | | | | | | | | | | | If there is a problem to execute sssd_secrets then exception is raised. Test will not continue in parent process because it is waiting for socket for a second. The child process will continue in execution of tests because parent process will kill child in teardown after test execution. This patch makes starting of secret service more robust and immediately fail child process when there was a problem to start sssd_secrets. It also adds few assertions for ensuring that setup passed as it should. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Add dyndns_auth optionJustin Stephenson2017-03-072-0/+30
| | | | | | | Add the dyndns_auth option into the AD or IPA provider man pages for more configuration information of nsupdate behavior. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Sanitize newline and carriage return characters.Victor Tapia2017-03-071-0/+10
| | | | | | | | | | Introducing valid usernames with a trailing newline character triggers the removal of valid LDB cache entries. Resolves: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Updating the version for the 1.15.2 releaseJakub Hrozek2017-03-031-1/+1
|
* Updating translations for the 1.15.1 releasesssd-1_15_1Jakub Hrozek2017-03-0340-16323/+18634
|
* CACHE_REQ: Only search the given domain when looking up entries by UPNJakub Hrozek2017-03-031-2/+2
| | | | | | | | | | | | | | We were searching UPNs in the whole sysdb, which made cache_req think the result came in from the domain it was searching. The bug manifested when a user from a trusted domain was looked by UPN, then cache_req searched the main domain, the result from subdomain was considered as coming from the main domain and as a result, the getpwnam() output was not qualified. That is a problem, because PAM applications often sanitize the user with getpwnam, so effectively a login with UPN was shortened to just a shortname and failed. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: When searching for UPNs, search either the whole DB or only the given ↵Jakub Hrozek2017-03-039-21/+32
| | | | | | | | | | | | | | | | domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Improve debugging on smartcard creds forwardSumit Bose2017-03-031-0/+1
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Adapt pam-srv-tests to deal with cache_req related changesFabiano Fidêncio2017-03-031-23/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to what happened for nss-srv-tests, there were a few kind of changes required to fix the tests breakage caused by the last commit. 1) For tests including no user, no changes was required. 2) As we call an equivalent to "get by name" command, a name is parsed with sss_parse_inp and the returned value is now mocked. 3) For the "cache_auth_success*" tests we set pam_test_ctx->tctx->done to false after adding the password to the cache, since the code now contains tevent calls and without it only the first request proceeds into tevent_loop in test_ev_loop(), as the first finished request sets done to true. 4) As the user certificate is added as a result of calling sss_dp_account_recv and the certificate value is read by the certificate lookup, we have to, in case a certificate lookup callback is set, call mock_account_recv() for the certificate before going through the mock_account_recv() for the initgroup. 5) If no logon name is given, then the user is looked by certificates first. Since there's a matching user, the upcoming lookup by name will find the user entry. However, since the looked ip data is up to date the dp response has to be mocked and the second argument of mock_input_pam_cert() cannot be NULL but must match the user name. 6) Add a new attribute to mock_input_pam_cert() that represents whether the backend is contacted only once. It's needed because in test_pam_cert_auth() the backend is contacted first to check whether it can handle smartcard authenticatiom, but before that there's a lookup. Since the first mocked reply already adds the certificate to the user entry, the lookup by certificate will already find the user in the cache and no second lookup is needed. Co-Author: Pavel Březina <pbrezina@redhat.com> Co-Author: Sumit Bose <sbose@redhat.com> Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Use cache_req to perform initgroups lookupsFabiano Fidêncio2017-03-033-389/+83
| | | | | | | | | | | | | | PAM responder has been already taking advantage of the cache_req interface, so this patch is just replacing some code that performs initgroups lookups by using cache_req to do so. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: Add cache_req_data_set_bypass_cache()Fabiano Fidêncio2017-03-034-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new cache_req_data method has been added because of the upcoming changes in the PAM responder. For deciding whether to contact the cache, or just query the data provider directly, PAM responder calls pam_initgr_check_timeout() which will return whether the cache entry may still be valid. The cache will be contacted only in case the cache entry is still valid, otherwise the data provider will be called. pam_initgr_check_timeout() basically checks whether the user (being looked up) is still a part of an in-memory hash table. Because the entry is a part of the hash table for really short period of time, and is automatically removed, the communication with the data provider is forced to happen quite often. As the follow-up changes should not modify this behaviour, this function was introduced so we can still call pam_initgr_check_timeout() and pass its result to the cache_req call that will perform the lookup. Related: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Store UPN suffixes when creating a new subdomainJakub Hrozek2017-03-025-7/+17
| | | | | | | | | We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSTEMD: Force responders to refuse manual startFabiano Fidêncio2017-03-027-0/+7
| | | | | | | | | | | | | | As the responders will either be explicitly started by the monitor or {dbus,socket}-activated, let's force them to refuse manual start, being a little bit restricter on our side. Resolves: https://pagure.io/SSSD/sssd/issue/3300 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSTEMD: Don't mix up responders' socket and monitor activationFabiano Fidêncio2017-03-0210-0/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | Let's ensure that in case a responder is explicitly configured in the sssd.conf its socket won't even start. The patchset introduces a new binary that will be distributed and will be called before starting the responders' sockets, ensuring the sockets will only start in case the responder is supposed to be socket-activated and its been configured accordingly. Otherwise the responders' socket startup will fail with a quite helpful debug message leading the admins to choose between using systemd or not and what has to be done to achieve their desire. This suggestion came from Sumit Bose. The reason for adding a new binary instead of a simple python script is to avoid dragging unnecessary dependencies to sssd-common package. Resolves: https://pagure.io/SSSD/sssd/issue/3300 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: use own namespace for UPNsSumit Bose2017-03-026-5/+95
| | | | | | | | | | | | | If the UPN use the same domain name as the configured domain an unsuccessful lookup by name will already create an entry in the negative cache. If the lookup by UPN would use the same namespace the lookup will immediately be finished because there would already be an entry in the negative cache. Resolves: https://pagure.io/SSSD/sssd/issue/3313 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam: use authtok from PAM stack if availableSumit Bose2017-03-022-3/+29
| | | | | | | | | | | | | | | | | With this patch the behavior of pam_sss is slightly changed to be more similar to the behavior of other PAM modules. Currently pam_sss expects that there is a authtok (password) on the PAM stack if the 'use_first_pass' option was used. Without the option pam_sss unconditionally prompts for credentials. With this patch pam_sss will use an authtok from the PAM stack even if 'use_first_pass' is not set but it will assume that it is a password. To return to the previous behavior the new 'prompt_always' can be used. Resolves: https://pagure.io/SSSD/sssd/issue/2984 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSTEMD: Avoid starting a responder socket in case SSSD is not startedFabiano Fidêncio2017-03-017-0/+14
| | | | | | | | | | | | | | | | | | | | | | As systemd adds "Before=sockets.target" to any socket unit by default, during the startup of the system we can end up having a responder socket up, being contacted while SSSD is shutdown. By using "DefaultDependencies=no" we ensure that sockets.target won't trigger the sockets' startup and that it only will be done when SSSD is up. The downside of using "DefaultDependencies=no" is that we have to deal with conflicts and add "Conflicts=shutdown.target" to each of the sockets unit. This patch has been suggested by Lukáš Nykrýn. Related: https://pagure.io/SSSD/sssd/issue/3298 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSTEMD: Add "After=sssd.service" to the responders' sockets unitsFabiano Fidêncio2017-03-017-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | While debugging the whole breakage reported by Stric I've noticed that the NSS socket has been starting up the NSS responder _before_ SSSD being up. As libc does initgroups on pretty much any account and initgroups checks all NSS modules in order to be precise, the nss_sss triggers the NSS responder which would try talking to the data providers which are not up uet (because SSSD is not up yet), causing the whole process to hang until libc gives up (causing a timeout on services like systemd-logind and on services depending on this one). By adding this ordering explicitly we can avoid the reported situation. Also, it has been recommend by Lukáš Nykrýn that "BindsTo", which is used to tie up two services, and After must be used together in order to avoid undefined/unexpected behavior (although it's still not mentioned in the systemd documentation). Related: https://pagure.io/SSSD/sssd/issue/3298 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* authtok: fix tests on big-endianSumit Bose2017-02-281-4/+18
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3270 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Use pagure links as a reference to upstreamLukas Slebodnik2017-02-2811-14/+12
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Update link to commit templateLukas Slebodnik2017-02-281-1/+1
| | | | | | | | | | Link to tickets on fedorahosted are redirected to pagure https://fedorahosted.org/sssd/ticket/XXXX -> https://pagure.io/SSSD/sssd/issue/XXXX But we should prefer new links Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFDB: If no configuration file is provided, create a fallback configurationJakub Hrozek2017-02-282-13/+63
| | | | | | | | | | | | | | | This functionality is only enabled in case SSSD is configured with with --enable-files-domain. If not, the behaviour is as it used to -- SSSD returns an error, instructing the admin to create a configuration file. If the option is enabled, a very minimal confdb that only enables the NSS responder is created. The confdb later adds the implicit files domain. Resolves: https://pagure.io/SSSD/sssd/issue/2229 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Refactor reading the config fileJakub Hrozek2017-02-281-60/+84
| | | | | | This is in preparation for creating a fallback configuration Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Test the files domain autoconfigurationJakub Hrozek2017-02-271-0/+78
| | | | | | Adds tests that exercise the implicit files domain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Enable the files domain for all integration testsJakub Hrozek2017-02-272-1/+10
| | | | | | | | This is done to make sure that enabling the files domain doesn't break existing functionality as well as making it possible to even that the implicit domain, since all integration tests use the same configuration. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Enable an implicit files domain if one is not configuredJakub Hrozek2017-02-2710-2/+238
| | | | | | | | | | | | | | | | | If SSSD is compiled with --enable-files-domain, the loading of the domains changes such that: * if no domain with id_provider=files exists in the config file, an implicit SSSD files domain is added * this domain is always first in the list The administrator is free to create a files domain in the config file himself and either place it at the end of the list or not enable it at all. Resolves: https://pagure.io/SSSD/sssd/issue/3112 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DOC: Deprecate README, add README.mdJakub Hrozek2017-02-272-43/+28
| | | | | | | | | | | | | To make it easier to display the contents of README on the project homepage, this patch converts the README contents to README.md. The original README is removed so that we don't maintain two different sources. The links to fedorahosted are retained until we migrate the wiki pages. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Remove unused importJakub Hrozek2017-02-231-1/+0
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: allow pkinit pre-authenticationSumit Bose2017-02-234-13/+303
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-234-15/+45
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: return name of PKCS#11 module and key id to pam_sssSumit Bose2017-02-237-18/+221
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: forward Smartcard credentials to backendsSumit Bose2017-02-233-24/+97
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authtok: enhance support for Smartcard auth blobsSumit Bose2017-02-235-15/+625
| | | | | | | | | The blobs contains beside the PIN the name of the PKCS#11 module and the token name where the certificate of the user was found and the key id. Those data will be used e.g. by the pkinit module to make sure them right certificate is used. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/proxy: tell frontend that Smartcard auth is not supportedSumit Bose2017-02-232-1/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: new error codesSumit Bose2017-02-232-0/+4
| | | | | | | | ERR_SC_AUTH_NOT_SUPPORTED can be used by backends to indicate that Smartcard authentication is not supported. ERR_NO_AUTH_METHOD_AVAILABLE can be used by backends that no authentication method was found. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use sentinel error code in PAM testsSumit Bose2017-02-231-1/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: fix memory leak in pam_sssSumit Bose2017-02-231-0/+6
| | | | | | | | | | | Since there can be multiple rounds trips between the PAM client and SSSD it might be possible that the same data is send multiple times by SSSD. So before overriding the old data it should be freed. I've seen this with the domain name which is send both in the pre-auth and the auth responses. To be on the safe side I added free() for some other items as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: store user object in the preq contextSumit Bose2017-02-232-6/+7
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FILES: Remove unnecessary checkLukas Slebodnik2017-02-221-1/+1
| | | | | | | | | "grp_iter->gr_mem" is an array of strings and not just a string. We tried to compare first string to NULL (acctually '\0') But after that we iterated over the array to find count of members and we check for NULL one more time. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MONITOR: Don't return an error in case we fail to register a serviceFabiano Fidêncio2017-02-221-5/+1
| | | | | | | | | | | | | | This behaviour was mistakenly changed by the {dbus,socket}-activation series and, as it's now, I've noticed the monitor may end up in some weird state due to this change, where it doesn't stop properly and leave some defuncts children processes. Let's change it back to what it was before and avoid possible regressions (even if no regression where hit yet). Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_sss: check conversation callbackSumit Bose2017-02-221-0/+8
| | | | | | | | | With this patch pam_sss checks if a conversation callback is available before using it. Resolves https://fedorahosted.org/sssd/ticket/3296 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* FILES: Fix reallocation logicJakub Hrozek2017-02-222-3/+72
| | | | | | | | | | | There were two bugs in the files provider reallocation logic: 1) the reallocated array was not NULL-terminated properly 2) talloc_get_size was used in place of talloc_array_length This bug could have resulted in a crash when the passwd or groups file contained more than FILES_REALLOC_CHUNK entries. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* check_duplicate: check name member before using itSumit Bose2017-02-222-1/+33
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3231 Reviewed-by: Petr Cech <pcech@redhat.com>
* sdap_extend_map: make sure memory can be freedSumit Bose2017-02-222-2/+23
| | | | | | | | | | If there is an error after calling talloc_realloc() the caller cannot free the memory properly because neither src_map nor _map were pointing to a valid memory location. With this patch _map will always point to the current valid location so that it can always be used with talloc_free(). Reviewed-by: Petr Cech <pcech@redhat.com>
* DYNDNS: Correct debug log message of realmJustin Stephenson2017-02-221-1/+5
| | | | | | | | | | If the realm is not added to the nsupdate message, the SSSD Debug log message should inform about utilizing autodiscovered realm. Resolves: https://fedorahosted.org/sssd/ticket/3220 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* DYNDNS: Update PTR record after non-fatal errorJustin Stephenson2017-02-221-3/+0
| | | | | | | | | | Continue to send PTR record update in situations where the nsupdate child forward zone updates are successful but nsupdate returns non-zero Resolves: https://fedorahosted.org/sssd/ticket/3227 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* intg: Fix python3 issuesLukas Slebodnik2017-02-173-8/+12
| | | | | | | | | | | | | | NamedTemporaryFile use the default mode 'w+b' and we tried to write strings. It is not a problem on python2 but failed on pyhton3 Python module ctypes directly uses C functions from libraries. C functions usually expect/returns "char *" when string is expected. But python3 uses unicode for string. Decoding returned bytes ("char *") to unicode strings simplify tests in python3. Otherwise we would need to convert bytes to string in each assertion. Reviewed-by: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 15:47:54 +0000