summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Updating the translations for the 1.14 alpha releasesssd-1_14_0_alpha1sssd-1_13_90Jakub Hrozek2016-06-2018-17977/+38704
|
* DP: Move be_req_acct and remove discard_constPavel Březina2016-06-203-16/+4
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: New interface for client registrationPavel Březina2016-06-2015-62/+371
| | | | | | | | | | | | | | | | This is just a beginning of new responder interface to data provider and it is just to make the client registration work. It needs further improvement. The idea is to take the existing interface and make it work better with further extensions of data provider. The current interface has several disadvantages such as it is originally build only for account requests and doesn't take different set of output parameters. It also doesn't work well with integration into tevent-made responders. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Switch to new interfacePavel Březina2016-06-2073-8416/+8178
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP TESTS: Add unit tests for dp_builtin.cPavel Reichl2016-06-203-0/+221
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP TESTS: Add unit tests for dp_request.cPavel Reichl2016-06-201-0/+469
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP TESTS: Add unit tests for dp_request_table.cPavel Březina2016-06-201-0/+356
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP TESTS: Mock data_providerPavel Březina2016-06-202-0/+133
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Add callback for backward compatibilityPavel Březina2016-06-203-0/+147
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Introduce new interface for backendPavel Březina2016-06-2023-0/+3628
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Terminology: * Backend: Implemenation of domain * Data Provider: interface between backend and responders * Module: ldap/ipa/ad/... dlopened library that implements dp interface * Target: id/autofs/sudo/... functionality of module Benefits over current code: * data provider is a black box completely separated from backend * method handlers are just simple tevent requests on backend side * no need of spy on be_client * simplified and error proof adding of new responders * simplified adding of new methods * reply to D-Bus message is completely handled by DP code * each target can have several methods defined * properties can be added on objects * each method can have output parameters * modules now support constructor * improved debugging * clear memory hierarchy * ability to chain requests * type safe private data Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap ops: add support for derefPavel Březina2016-06-202-0/+289
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow returning only the first replyPavel Březina2016-06-202-42/+123
| | | | | | | | | In some cases we want to cycle through all search bases but stop iterating when we get first non-empty reply. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sdap_search_bases: allow map to be NULLPavel Březina2016-06-201-10/+8
| | | | | | | | In some cases we do not want any attribute translations. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_MISSING_DP_TARGETPavel Březina2016-06-202-0/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_INVALID_DATA_TYPEPavel Březina2016-06-202-0/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_TERMINATEDPavel Březina2016-06-202-0/+2
| | | | | | | | To indicate that data provider request was unexpectedly terminated. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_OFFLINEPavel Březina2016-06-202-0/+2
| | | | | | | | To indicate that backend is offline. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Print debug message when handler failsPavel Březina2016-06-201-0/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Add data provider errorsPavel Březina2016-06-201-0/+4
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Add sbus_conn_register_iface_mapPavel Březina2016-06-203-18/+29
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_backend.h to backend.hPavel Březina2016-06-2041-40/+40
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.c to be_dyndns.cPavel Březina2016-06-202-1/+1
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_dyndns.h to be_dyndns.hPavel Březina2016-06-2012-11/+11
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_refresh.c to be_refresh.cPavel Březina2016-06-201-0/+0
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_refresh.h to be_refresh.hPavel Březina2016-06-205-4/+4
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Rename dp_ptask to be_ptaskPavel Březina2016-06-2012-12/+12
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-1811-31/+31
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam-srv-tests: Fix warning unused-functionLukas Slebodnik2016-06-171-0/+2
| | | | | | | | | | | | | | If pam-srv-tests is not build with NSS support then certificate related test are not executed and therefore there is unused setup function pam_test_setup_no_verification. src/tests/cmocka/test_pam_srv.c:323:12: error: 'pam_test_setup_no_verification' defined but not used [-Werror=unused-function] static int pam_test_setup_no_verification(void **state) ^ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DEBUG: Add `debug` alias for debug_levelStephen Gallagher2016-06-166-1/+34
| | | | | | | | | | | | | Our users constantly make the mistake of typing `debug = 9` in the sssd.conf instead of `debug_level = 9` as would be correct. This happens frequently-enough that we should just alias it rather than continue to have people make mistakes. Resolves: https://fedorahosted.org/sssd/ticket/2999 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Petr Cech <pcech@redhat.com>
* ssh: skip invalid certificatesSumit Bose2016-06-161-45/+134
| | | | | | | | | | | Current an invalid certificate cause the whole ssh key lookup request to abort. Since it is possible that e.g. the LDAP user entry contains certificates where the client does not have the needed CA certificates for validation we should just ignore invalid certificates. Resolves https://fedorahosted.org/sssd/ticket/2977 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add underlying diagnostic message for SSL errors.Graham Leggett2016-06-161-1/+18
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3005 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TEST: New tests for negative caching of localsPetr Cech2016-06-104-0/+711
| | | | | | | | | | | Negative cache has special timeout for local entities (users, groups). This patch adds new tests for such behaviour. The tests are based on cwrap. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDERS: Negative caching of local usersPetr Cech2016-06-1013-20/+205
| | | | | | | | | | | This patch adds new option 'neg_cache_locals_timeout' into section of NSS responder. It allows negative caching of local groups and users. Default value is 0 which means no caching. Resolves: https://fedorahosted.org/sssd/ticket/2928 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Decorate the hot paths in the LDAP provider with systemtap probesJakub Hrozek2016-06-107-0/+367
| | | | | | | | | | | | | During performance analysis, the LDAP provider and especially its nested group code proved to be the place where we spend the most time during account requests. Therefore, I decorated the LDAP provider with systemtap probes to be able to observe where the time is spent. The code allows passing of search properties (base, filter, ...) from marks to probes. Where applicable, the probes pass on these arguments to functions and build a human-readable string representation. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* STAP: Add helper functions to for human-readable account request representationJakub Hrozek2016-06-102-0/+68
| | | | | | | | The caller of the systemtap script would be able to see what kind of account request sssd received with a string representation, not just the cryptic hexadecimal number. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Add systemtap probes to track sysdb transactionsJakub Hrozek2016-06-103-0/+44
| | | | | | | | | | | | | | | | | | | Actually adds marks for sysdb transactions that receive the transaction nesting level as an argument. The nesting is passed on from probes to marks along with a human-friendly description. The transaction commit is decorated with two probes, before and after. This would allow the caller to distinguish between the time we spend in the transaction (which might be important, because if a transaction is active on an ldb context, even the readers are blocked before the transaction completes) and the time we spend commiting the transaction (which is important because that's when the disk writes occur) The probes would be installed into /usr/share/systemtap/tapset on RHEL and Fedora. This is in line with systemtap's paths which are described in detail in "man 7 stappaths". Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Track transaction nesting in sysdb_ctxJakub Hrozek2016-06-102-3/+10
| | | | | | | | | Adds an integer that tracks how deeply nested we are in sysdb transactions. This will become useful later, because generally we are only interested in level-0 transactions when probing, so we'll want to pass the transaction nesting to the systemtap probes. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Add build infrastructure for systemtap scriptsJakub Hrozek2016-06-104-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds infrastructure that generatest the probes.h and probes.o from the dtrace probes.d file. The probes.d file is empty except for the provider name in this commit, its content will be added with later commits that actually add some content. The probes.d file is always distributed in the tarball so that distributions can optionally enable systemtap support. The generation is done using the "dtrace" command because the probes.d file is compatible with the Solaris dtrace format. Please see "man 1 dtrace" for more information on the dtrace format and the command line tool. In order to make libtool happy, a fake libtool object is generated. This hunk was taken from the libvirt code. The AM_V_GEN macro is used to make the build compatible with the silent build configuration. To enable systemtap probing, configure sssd with: --enable-systemtap In order to do so, the 'dtrace' command-line utility must be installed. On Fedora and RHEL, this package is installed as part of the "systemtap-sdt-devel" package. You'll also want the 'systemtap' package installed as well as the matching versions of kernel-devel and kernel-debuginfo on your machine. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a PROBE macro into probes.hJakub Hrozek2016-06-101-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The macros are inspired by very similar macros in libvirt code. Adds a macro PROBE that can be used by SSSD developers to add systemtap marks to code. These marks, when coupled with a location in a binary can be in turn used to call probes. The mark can be called like this: PROBE(PROBE_NAME, arguments) This is cleaner than using the SSSD_$(PROBE_NAME) directly as it directly shows that a probe is being called at that place. If the systemtap tracing is disabled, they would expand to an empty macro. If the systemtap tracing is enabled, the systemtap probe will be called. The overhead of calling the probes is close to zero. As one of the systemtap developers explained to me: """ STAP_PROBE() macros cost apprx. one nop in the executable, so apprx. no cost at all. The more the merrier. Only when activated by a stap script do we generally think of it like a microsecond of time. """ The probe arguments can be used in the probes to be printed or passed on to functions. There was an issue in case a string argument was NULL. This commit adds a helper macro to deal with NULL-strings as if they were empty (""). This file would be included by any source file that wants to call the PROBE() macro. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam-srv-tests: Increase cached_auth_timeoutLukas Slebodnik2016-06-101-2/+2
| | | | | | | | | | | | | | The execution sysdb_cache_password_ex can be slow due to function s3crypt_sha512 and valgrind slowdown. Therefore 2 seconds timeout can be reached in possitive tests test_pam_cached_auth_success and test_pam_cached_auth_success_combined_pw_with_cached_2fa Resolves: https://fedorahosted.org/sssd/ticket/2994 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss-idmap: add sss_nss_getnamebycert()Sumit Bose2016-06-095-3/+92
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: add SSS_NSS_GETNAMEBYCERT requestSumit Bose2016-06-093-0/+266
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: allow lookups by cert in sub-domains on the clientSumit Bose2016-06-093-9/+41
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_override: add certificate supportSumit Bose2016-06-094-11/+42
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: return user certificate base64 encodedSumit Bose2016-06-091-5/+20
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: read user certificate if availableSumit Bose2016-06-091-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: save cert as blob in the cacheSumit Bose2016-06-091-2/+17
| | | | | | | | The IPA extdom plugin returns the user certificate base64 encoded. Before the IPA client can store it in the cache it must be decoded so that it is stored as a binary as the certificate from other sources. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: include certificates in full result listSumit Bose2016-06-091-0/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: add support for certificate overridesSumit Bose2016-06-094-0/+33
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: use overide aware call for lookup by certificateSumit Bose2016-06-091-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-17 21:36:50 +0000