summaryrefslogtreecommitdiffstats
path: root/src/man
Commit message (Collapse)AuthorAgeFilesLines
* minor typo fixesRené Genz2017-04-194-15/+15
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* KRB5_LOCATOR: add env variable to disable pluginSumit Bose2017-04-111-0/+5
| | | | | | | | | | | | | If the new environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value SSSD's krb5 locator plugin is disabled. The variable is needed because there is currently no other way than removing the plugin completely to disable it. For a use-case see e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1072939. Resolves: https://pagure.io/SSSD/sssd/issue/3359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* secrets: allow to configure certificate checkPavel Březina2017-03-301-0/+76
| | | | | | | | | | | | | | | | | | | | | | Some users may want to use TLS with unverified peer (for example if they use self-signed certificate) or if unverified hostname (if certificate hostname does not match with the real hostname). On the other side it may be useful to point to a directory containing custom certificate authorities. This patch add three new options to secrets responder: verify_peer => peer's certificate must be valid verify_host => hostnames must match capath => path to directory containing CA certs cacert => ca certificate cert => client certificate key => client private key Resolves: https://pagure.io/SSSD/sssd/issue/3192 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-301-0/+12
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CONFDB: Allow configuring [application] sections as non-POSIX domainsJakub Hrozek2017-03-301-0/+77
| | | | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Allows to add a new section: [application/$name] This section internally (on the confdb level) expands to: [domain/$name] domain_type = application The reasons to add this new section is two-fold. One, to make the configuration of application domains more explicit and two, to make it possible to share configuration between two domains, one POSIX and one non-POSIX by application domain's inherit_from option: [application/$name] inherit_from = posix_domain_name Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Introduce SSSD domain type to distinguish POSIX and application domainsJakub Hrozek2017-03-301-0/+33
| | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new option that allows to distinguish domains that do contain POSIX users and groups and those that don't. The POSIX domains are the default. The non-POSIX domains are selected by selecting an "application" type domain. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add domain_resolution_order config optionFabiano Fidêncio2017-03-291-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | This is the local equivalent of option of ipaDomainResolutionOrder and has precedence over the ones set on IPA side making the precedence order to be like: Local > View > Globally. As done for the IPA side configurations, the domains which were not explicitly set up will be apennded to the final of the domain_resolution_order list in the very same order they're presented in the "domains" option of [sssd] section in the config file. There's no guarantee of order for the subdomains though. It's also important to mention that no expansion magic is performed on our side. It means that if 'example.com' is set it does *not* stand for all its subdomains DNS wise (like 'foo.example.com', 'bar.example.com', etc). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-291-1/+2
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MAN: Add a manual page for sssd-kcmJakub Hrozek2017-03-273-1/+202
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* certmap: add new library libsss_certmapSumit Bose2017-03-233-1/+602
| | | | | | | | | | | | | | | | With this library it would be possible to map certificates and users not only by adding the full certificate to the user's LDAP object but by adding e.g. only parts like the issuer and subject name. Additionally the library is also able to flexible select/match certificates based on values in the certificate. Details about mapping and matching rules can be found in the included man page. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Mention sssd-secrets in "SEE ALSO" sectionLukas Slebodnik2017-03-221-0/+6
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3344 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Updating the translations for the 1.15.2 releasesssd-1_15_2Jakub Hrozek2017-03-1517-8724/+10611
|
* MAN: Add trusted domain section man entryMichal Židek2017-03-151-0/+22
| | | | | | | | | | Add note about trusted domain section in the sssd.conf man page. Resolves: https://pagure.io/SSSD/sssd/issue/2599 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CACHE_REQ: Check the caches firstFabiano Fidêncio2017-03-141-0/+12
| | | | | | | | | | | | | | | | | | | This patch introduces a new configurable option to define whether the responder should query all domains' caches before querying the Data Providers. This new option is called cache_first and, by default, it's disabled, meaning that, for each provider, the responder may contact the cache and the data provider in the same iteration. Co-Author: Pavel Březina <pbrezina@redhat.com> Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: first letter of user name template for override_homedirIgnacio Reguero2017-03-071-0/+4
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Add dyndns_auth optionJustin Stephenson2017-03-072-0/+30
| | | | | | | Add the dyndns_auth option into the AD or IPA provider man pages for more configuration information of nsupdate behavior. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Updating translations for the 1.15.1 releasesssd-1_15_1Jakub Hrozek2017-03-0317-8135/+10354
|
* pam: use authtok from PAM stack if availableSumit Bose2017-03-021-0/+18
| | | | | | | | | | | | | | | | | With this patch the behavior of pam_sss is slightly changed to be more similar to the behavior of other PAM modules. Currently pam_sss expects that there is a authtok (password) on the PAM stack if the 'use_first_pass' option was used. Without the option pam_sss unconditionally prompts for credentials. With this patch pam_sss will use an authtok from the PAM stack even if 'use_first_pass' is not set but it will assume that it is a password. To return to the previous behavior the new 'prompt_always' can be used. Resolves: https://pagure.io/SSSD/sssd/issue/2984 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Use pagure links as a reference to upstreamLukas Slebodnik2017-02-283-6/+4
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MONITOR: Enable an implicit files domain if one is not configuredJakub Hrozek2017-02-272-1/+23
| | | | | | | | | | | | | | | | | If SSSD is compiled with --enable-files-domain, the loading of the domains changes such that: * if no domain with id_provider=files exists in the config file, an implicit SSSD files domain is added * this domain is always first in the list The administrator is free to create a files domain in the config file himself and either place it at the end of the list or not enable it at all. Resolves: https://pagure.io/SSSD/sssd/issue/3112 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Add documentation for the files providerJakub Hrozek2017-02-153-0/+93
| | | | | | The new provider needs a man page. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Document the pwfield configuration optionJakub Hrozek2017-02-151-0/+17
| | | | | | | The pwfield was not documented at all previously. In addition, document the different defaults for remote provider and the file provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Updating the translations for the 1.15.0 releaseJakub Hrozek2017-01-2517-15042/+20949
|
* RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idleFabiano Fidêncio2017-01-231-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit introduces a new option for the responders called responder_idle_timeout, which specifies the number of seconds that the responder process can be up without being used. The default value is 300 seconds (5 minutes) and can be configured per responder, being 60 seconds the minimum acceptable value. Is important to note that setting "responder_idle_timeout = 0" disables the responder timeout, which makes sense for the responders that always will be running. The shutdown timeout is activated per responder in case the responder has been {dbus,socket}-activated. In case of any commnunication with the responder the timeout is reset thereby ensuring we won't shutdown a responder that is not idle. Setting the responder's last request time is done slightly differently for socket-activated and dbus-activated responders. In both cases it's updated in any internal communication in sbus_message_handler(), but for the socket-activated responders it's also updated when the responder's socket is used. Currently it works properly with all responders but the secrets one, which has a different logic and must be treated separately in case some change is required there. Is worth to mention that this commit does not affect the responders explicitly configured in the "services" line of sssd.conf. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: "user" doesn't work with socket-activated servicesFabiano Fidêncio2017-01-231-0/+13
| | | | | | | | | | | | | | | Make it clear in the manual that the "user" option is not going to work with socket-activated services and also mention what's the best way to change it in case it's needed, being clear about what can go wrong in case the admin decides to do it. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Mention that the services' list is optionalFabiano Fidêncio2017-01-233-1/+22
| | | | | | | | | | | | | | | For platforms where systemd is supported, after making the responders socket-activatable, the services' list is completely optional. So, let's mention that in the manual page for sssd.conf, including instructions on how to enabled the desired services. Related: https://fedorahosted.org/sssd/ticket/2243 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: sssctl debug levelMichal Židek2017-01-131-1/+1
| | | | | | | | | | Use tools specific reference to debug level explanation in sssctl man page. Resolves: https://fedorahosted.org/sssd/ticket/3085 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Updation of sssd-ad man page for case when dyndns_refresh_interval < 60 ↵Amith Kumar2017-01-061-1/+3
| | | | | | | | | | | | | seconds Changes for dyndns_refresh_interval < 60 sec man sss-ad changed for dyndns_refresh_interval < 60 sec Resolves: https://fedorahosted.org/sssd/ticket/2201 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SECRETS: Add configurable payload size limit of a secretFabiano Fidêncio2016-11-241-0/+12
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3169 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for IPA providerJustin Stephenson2016-11-153-75/+144
| | | | | | | | | | | Update man pages for any IPA provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for AD providerJustin Stephenson2016-11-153-24/+78
| | | | | | | | | | | Update man pages for any AD provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ad_access_filter search for nested groupsMike Ely2016-11-031-0/+16
| | | | | | | | | | Includes instructions and example for AD nested group access Related to https://fedorahosted.org/sssd/ticket/3218 Signed-off-by: Mike Ely <github@taupehat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: add pam_response_filter optionSumit Bose2016-11-021-0/+45
| | | | | | | | | Currently the main use-case for this new option is to not set the KRB5CCNAME environment varible for services like 'sudo-i'. Resolves https://fedorahosted.org/sssd/ticket/2296 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Updating the translations for the 1.14.2 releasesssd-1_14_2Jakub Hrozek2016-10-1917-16377/+27581
|
* sss_cache: improve option argument handlingJustin Stephenson2016-10-101-1/+2
| | | | | | | | | | Print informational message and exit when multiple arguments are provided for single-argument options with sss_cache Resolves: https://fedorahosted.org/sssd/ticket/3180 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Wrong defaults for AD providerMichal Židek2016-10-071-2/+4
| | | | | | | | | | | ldap_user_name and ldap_group_name have different defalts then what the man page states. Resolves: https://fedorahosted.org/sssd/ticket/3022 Reviewed-by: Sumit Bose <sbose@redhat.com>
* MAN: Typo in id mapping explanationMichal Židek2016-10-071-2/+2
| | | | | | | | | | It is probably result of modifying the code and not updating the man page properly. Resolves: https://fedorahosted.org/sssd/ticket/3205 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SECRETS: Add a configurable limit of secrets that can be storedFabiano Fidêncio2016-10-051-0/+12
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3169 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Add a configurable depth limit for nested containersFabiano Fidêncio2016-10-031-0/+12
| | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3168 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: sssd-secrets documentationJakub Hrozek2016-09-303-1/+455
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3053 Documents the API and the purpose of the sssd-secrets responder. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* man page: fix language in debug level descriptionPavel Březina2016-09-242-2/+2
| | | | Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* sss_override: improve --debug descriptionPavel Březina2016-09-243-1/+83
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2813 Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* MAN: sssd-sudo manual update IPA native LDAP tree supportJustin Stephenson2016-09-161-3/+6
| | | | | | | | | | Update sssd-sudo man page to reflect native IPA sudo support Resolves: https://fedorahosted.org/sssd/ticket/3145 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Adding proxy_max_children optionPetr Cech2016-09-131-0/+16
| | | | | | | | | | | The new option 'proxy_max_children' is applicable in domain section. Default value is 10. Resolves: https://fedorahosted.org/sssd/ticket/3153 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Add disable_netlink optionJustin Stephenson2016-09-121-0/+18
| | | | | | | | | | | | Adding a new monitor boolean option to disable netlink support. This will give users more control over sssd state changes without having to modify systemd unit files. Resolves: https://fedorahosted.org/sssd/ticket/3142 Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Remove --disable-netlink command-line optionJustin Stephenson2016-09-121-11/+0
| | | | | | | | Removing monitor command-line option, to be superceded by sssd.conf option Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document the ldap_user_primary_group optionJakub Hrozek2016-09-011-0/+15
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Remove the no longer used kill_service commandJakub Hrozek2016-08-301-33/+0
| | | | | | | | | | After introducing the watchdog, the force_timeout option is no longer used. Resolves: https://fedorahosted.org/sssd/ticket/3052 Reviewed-by: Petr Čech <pcech@redhat.com>
* Updating the translations for the 1.14.1 releasesssd-1_14_1Jakub Hrozek2016-08-1917-8986/+10395
|
* Monitor: Add support for disabling netlinkJustin Stephenson2016-08-171-0/+11
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2860 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-08 16:24:02 +0000