summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* TOOLS: Fix "-Wstack-protector" caught by GCCFabiano Fidêncio2017-09-251-4/+3
| | | | | | | This warning only happens when building SSSD on RHEL6. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Fix "-Werror=null-dereference" caught by GCCFabiano Fidêncio2017-09-251-0/+10
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: Fix "-Wold-style-definition" caught by GCCFabiano Fidêncio2017-09-251-1/+1
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SIFP: Fix "-Wjump-misses-init" caught by GCCFabiano Fidêncio2017-09-251-1/+3
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESOLV: Fix "-Werror=null-dereference" caught by GCCFabiano Fidêncio2017-09-251-0/+7
| | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Print a warning when enumeration is requested but disabledAmitKumar2017-09-253-0/+11
| | | | | | | | | | | | | | Add an explanatory message to be logged once, at the start-up, mentioning that in case enumeration is not enabled, getent passwd won't return all users by design. The debug level chosen to show the message is SSS_LOG_NOTICE. Resolves: https://pagure.io/SSSD/sssd/issue/2301 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sssd_client: add mutex protected call to the PAC responderSumit Bose2017-09-226-2/+297
| | | | | | | | | | | | | | | | | | | | | | SSSD's plugin for MIT Kerberos to send the PAC to the PAC responder currently uses sss_pac_make_request() which does not protect the communication with the PAC responder with a mutex as e.g. the NSS and PAM clients. If an application using threads loads this plugin via libkrb5 in different threads and is heavily processing Kerberos tickets with PACs chances are that two threads try to communicate with SSSD at once. In this case one of the threads will miss a reply and will wait for it until the default client timeout of 300s is passed. This patch adds a call which uses a mutex to protect the communication which will avoid the 300s delay mentioned above. Resolves: https://pagure.io/SSSD/sssd/issue/3518 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IDMAP: add a unit testSumit Bose2017-09-201-0/+32
| | | | | | | A unit test for the recent changes from 0526dde7f3d4089617c0f4a6a85f83e9d266c9f1 is added. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* IDMAP: Prevent colision for explicitly defined slice.Marlena Marlenowska2017-09-191-0/+10
| | | | | | | | | | | Currently it happens for default domain, if someone configures different ldap_idmap_default_domain_sid for two domains in sssd.conf. There is no check preventing this in sdap_idmap.c, it's simply: sdap_idmap_add_domain(idmap_ctx, dom_name,sid_str, 0). However, I believe here is the best place to check it since there may be different use of sss_idmap_calculate_ranges in the future. Reviewed-by: Sumit Bose <sbose@redhat.com>
* MAN: Add a note about the output of all commands when using ↵Fabiano Fidêncio2017-09-141-0/+24
| | | | | | | | | | | | | | | | domain_resolution_order As the output of all commands when using domain_resolution_order is fully-qualified, even when using shortnames, let's add a note in the man page to make it explicit. Also, let's suggest a possible workaround for this having the output non fully-qualified and also mention the problems that the possible workaround may cause. Resolves: https://pagure.io/SSSD/sssd/issue/3513 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add missing indicesSumit Bose2017-09-143-1/+92
| | | | | | Resolves https://pagure.io/SSSD/sssd/issue/3472 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: fix handling of certmap_ctxSumit Bose2017-09-148-53/+421
| | | | | | | | | | This patch fixes a use-after-free in the AD provider part and initializes the certmap_ctx with data from the cache at startup. Related to https://pagure.io/SSSD/sssd/issue/3508 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* certmap: make sure eku_oid_list is always allocatedSumit Bose2017-09-142-9/+29
| | | | | | | | | | If there are only OIDs in a <EKU> part of a matching rule a NULL pointer dereference might occur. Related to https://pagure.io/SSSD/sssd/issue/3508 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: check if IPA hostname is fully qualifiedAmitKumar2017-09-131-0/+11
| | | | | | | | | | | Some users change the IPA hostname post-install which results in strange bugs. Code change make sure that the ipa_hostname contains at least one domain component. Resolves: https://pagure.io/SSSD/sssd/issue/1946 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MAN: Improve ipa_hostname descriptionAmitKumar2017-09-131-0/+1
| | | | | | | | | | | The description of ipa_hostname config option doesn't mention it must be fully-qualified, although when using a non-fully qualified name IPA server may behave weirdly. Thus, let's add this info the the man page. Related: https://pagure.io/SSSD/sssd/issue/1946 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: Fix schema for try_inotifyLukas Slebodnik2017-09-133-5/+5
| | | | | | | | | It is read only from "[sssd]" section. Resolves: https://pagure.io/SSSD/sssd/issue/3511 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pysss_nss_idmap: Fix typos in python documentationLukas Slebodnik2017-09-131-12/+12
| | | | | | s/dictonary/dictionary/g Reviewed-by: Sumit Bose <sbose@redhat.com>
* pysss_nss_idmap: return same type as it is in module constantsLukas Slebodnik2017-09-131-8/+8
| | | | | | | | | | | | | | | | | | | | | | | The python module pysss_nss_idmap contains few module constants which should be used (based on python documentation) for checking type of results. e.g. getsidbyid(...) getsidbyid(id or list/tuple of id) -> dict(id => dict(results)) Returns a dictionary with a dictionary of results for each given POSIX ID. The result dictionary contains the SID and the type of the object which can be accessed with the key constants SID_KEY and TYPE_KEY, respectively. However, type of module constant and type of returned key had different type with python3 due to different handling of strings. This patch unifies it to string. The same as it is in python2. Resolves: https://pagure.io/SSSD/sssd/issue/3491 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Revert "PYTHON: Define constants as bytes instead of strings"Lukas Slebodnik2017-09-131-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 9375eae59550437c85ada9212be430a4242b25a4. Patch introduced difference between python2 and python3. constant should be strings in both versions. sh$ python2 Python 2.7.13 (default, Aug 16 2017, 12:56:26) [GCC 7.1.1 20170802 (Red Hat 7.1.1-7)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import pysss_nss_idmap >>> type(pysss_nss_idmap.SID_KEY) <type 'str'> sh$ python3 Python 3.6.2 (default, Sep 1 2017, 12:03:48) [GCC 7.1.1 20170802 (Red Hat 7.1.1-7)] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import pysss_nss_idmap >>> type(pysss_nss_idmap.SID_KEY) <class 'bytes'> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: Use initgr_with_views when looking up a sudo userJakub Hrozek2017-09-085-53/+259
| | | | | | | | | | | | | The sudo responder code didn't take views into account when looking for rules, which resulted in sudo rules being ignored if the user's name was overriden. Please see the ticket for a detailed info on how to reproduce the bug. Resolves: https://pagure.io/SSSD/sssd/issue/3488 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Use NULL for pointer, not 0Jakub Hrozek2017-09-081-3/+3
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Add sssd-systemtap man pageJustin Stephenson2017-09-084-1/+401
| | | | | | | | Provide information for administrators and users to utilize SSSD systemtap infrastructure. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Add Generic DP Request ProbesJustin Stephenson2017-09-084-0/+96
| | | | | | | | | | | | | | | Add the ability to analyze performance and monitor Data Provider requests at a high-level, probes fire when a request is sent and when a request is completed. Request name, domain, target, method, and return code information is passed as target variables to the systemtap probe tapsets which can be used in systemtap scripts. Resolves: https://pagure.io/SSSD/sssd/issue/3061 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: make sure view name is initialized at startupSumit Bose2017-09-061-1/+18
| | | | | | | | | | | | | sysdb_master_domain_update() can only set the view name properly if it was not set before but it might be called multiple times before the view name is available if the cache is empty. Since ipa_apply_view() keeps track if the view name was already set at startup or not the name can safely be cleaned here before sysdb_master_domain_update() is called. Resolves: https://pagure.io/SSSD/sssd/issue/3501 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: Look for name attribute also in nss_cmd_getsidbyidLukas Slebodnik2017-09-061-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We always check negcache after getting data from backend since commit 4c09cd008967c5c0ec358dc658ffc6fc1cef2697 because we usually do have a name in begging of requests "* by ID". We were not interested in name in request sid by id before. However, function cache_req_search_ncache_filter always expect name otherwise it returns ERR_INTERNAL. [sssd[nss]] [cache_req_set_plugin] (0x2000): CR #8: Setting "Object by ID" plugin [sssd[nss]] [cache_req_send] (0x0400): CR #8: New request 'Object by ID' [sssd[nss]] [cache_req_select_domains] (0x0400): CR #8: Performing a multi-domain search [sssd[nss]] [cache_req_search_domains] (0x0400): CR #8: Search will check the cache and check the data provider [sssd[nss]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain sssdad2012r2.com type POSIX is valid [sssd[nss]] [cache_req_set_domain] (0x0400): CR #8: Using domain [sssdad2012r2.com] [sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Looking up ID:233600513@sssdad2012r2.com [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: Checking negative cache for [ID:233600513@sssdad2012r2.com] [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/sssdad2012r2.com/233600513] [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: [ID:233600513@sssdad2012r2.com] is not present in negative cache [sssd[nss]] [cache_req_search_cache] (0x0400): CR #8: Looking up [ID:233600513@sssdad2012r2.com] in cache [sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Returning [ID:233600513@sssdad2012r2.com] from cache [sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #8: Filtering out results by negative cache [sssd[nss]] [cache_req_search_ncache_filter] (0x0020): CR #8: sss_get_name_from_msg() returned NULL, which should never happen in this scenario! [sssd[nss]] [cache_req_process_result] (0x0400): CR #8: Finished: Error 1432158209: Internal Error [sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: error [1432158209]: Internal Error [sssd[nss]] [client_recv] (0x0200): Client disconnected! Resolves: https://pagure.io/SSSD/sssd/issue/3485 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* certmap: Suppress warning Wmissing-bracesLukas Slebodnik2017-09-061-1/+7
| | | | | | | | | | | | | | | | | | | | Older version of gcc(e.g. gcc-4.8.5-11.el7) had a false positive warning with c99 struct initialisation "{ 0 }". https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53119 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64709 CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c: In function 'add_pkinit_princ_to_san_list': src/lib/certmap/sss_cert_content_nss.c:475:12: error: missing braces around initializer [-Werror=missing-braces] struct kerberos_principal_name kname = { 0 }; ^ src/lib/certmap/sss_cert_content_nss.c:475:12: error: (near initialization for 'kname.realm') [-Werror=missing-braces] Reviewed-by: Sumit Bose <sbose@redhat.com>
* SELINUX: Use getseuserbyname to get IPA seuserJustin Stephenson2017-09-063-81/+6
| | | | | | | | | | | | | | The libselinux function getseuserbyname is more reliable method to retrieve SELinux usernames then functions from libsemanage `semanage_user_query` and is recommended by libsemanage developers. Replace get_seuser function with getseuserbyname. Resolves: https://pagure.io/SSSD/sssd/issue/3308 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Petr Lautrbach <plautrba@redhat.com>
* MAN: Document that the secrets provider can only be specified in a ↵Jakub Hrozek2017-09-061-8/+19
| | | | | | | | | | | per-client section Resolves: https://pagure.io/SSSD/sssd/issue/3417 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* MAN: Improve failover documentation by explaining the timeout betterJakub Hrozek2017-09-052-4/+66
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* certmap: add OpenSSL implementationSumit Bose2017-09-057-220/+1166
| | | | | | | | | | The OpenSSL 1.1 API is used but there is a short macro block which should added the needed compatibility if and older OpenSSL version is used. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Improve description of 'trusted domain section' in sssd.conf's man pageAmitKumar2017-09-051-2/+15
| | | | | | | | | | | PR generated to include explaination for ipa ad trust sssd configuration where ad has a child domain. Explanation is added to 'TRUSTED DOMAIN SECTION'. Also an example is included to better understanding. Resolves: https://pagure.io/SSSD/sssd/issue/3399 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Use sysdb_search_*_by_orig_dn() in _subdomains_ext_group.cFabiano Fidêncio2017-09-051-10/+2
| | | | | | | | | | | | Methods for searching the users, groups and entries by their orig dn have been introduced in one of the previous commit. Let's make use of those whenever it makes sense. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Use sysdb_search_*_by_orig_dn() in sdap_async_groups.cFabiano Fidêncio2017-09-051-21/+2
| | | | | | | | | | | | Methods for searching the users, groups and entries by their orig dn have been introduced in one of the previous commit. Let's make use of those whenever it makes sense. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Use sysdb_search_*_by_orig_dn() in sdap_async_nested_groups.cFabiano Fidêncio2017-09-051-48/+13
| | | | | | | | | | | | Methods for searching the users, groups and entries by their orig dn have been introduced in one of the previous commit. Let's make use of those whenever it makes sense. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use sysdb_search_*_by_orig_dn() _hbac_users.cFabiano Fidêncio2017-09-051-21/+7
| | | | | | | | | | | | Methods for searching the users, groups and entries by their orig dn have been introduced in one of the previous commit. Let's make use of those whenever it makes sense. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add tests for sysdb_search_{users,groups}_by_orig_dn()Fabiano Fidêncio2017-09-051-0/+74
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Add sysdb_search_by_orig_dn()Fabiano Fidêncio2017-09-052-7/+86
| | | | | | | | | | | | | | Three new methods have been added to sysdb's API in order to perform search by the orig dn (which is quite common in SSSD's code base). A common/base method called sysdb_search_by_orig_dn() is the most important one and then a few other helpers for searching users and groups groups directly. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Only generate kdcinfo files on clientsJakub Hrozek2017-09-042-9/+18
| | | | | | | | | | | | | | | | | In some cases, IPA masters end up having a broken SSSD configuration that also includes the SRV records. This can cause the kdcinfo files to point to a different master which uses a different PKINIT certificate which is only valid for that IPA master. This can result e.g. in webui not working. This patch prevents the kdcinfo files from being generated on the IPA masters, but keep generating them on the clients. Not generating kdcinfo files on masters has no negative performance impact, because libkrb5 is configured via krb5.conf to point to self anyway. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Reword the DEBUG message about SRV resolution on IDM mastersJakub Hrozek2017-09-041-3/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Relax the assert in test_idle_timeoutJakub Hrozek2017-09-041-7/+9
| | | | | | | | | | | | | | | | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/3473 We're being quite strict in test_idle_timeout when checking for the number of open fds which leads to spurious failures like: =================================== FAILURES =================================== ______________________________ test_idle_timeout _______________________________ Traceback (most recent call last): File "/var/lib/jenkins/workspace/ci/label/fedora23/src/tests/intg/test_secrets.py", line 427, in test_idle_timeout assert nfds_pre + 1 == nfds_conn AssertionError: assert (27 + 1) == 27 ==================== 1 failed, 221 passed in 473.37 seconds ==================== This is just a check that "a" connection was opened, so we don't have to check for exact match, but just for larger-or-equal. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Support 0 as unlimited for the quotasJakub Hrozek2017-09-017-3/+95
| | | | | | | | | | | | Add a special value for all the quota-like settings that means 'no limit'. Because the responder also had a global limit on the size of the accepted body (64kiB), this patch also removes the hardcoded limit and instead keep track of the biggest quota value on startup. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Add a new option to control per-UID limitsJakub Hrozek2017-09-019-1/+178
| | | | | | | | | | | Adds a new option max_uid_secrets that allows to set a limit of secrets for this particular client so that the user cannot starve other users. Resolves: https://pagure.io/SSSD/sssd/issue/3363 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Test that ccaches can be stored after max_secrets is reached for ↵Jakub Hrozek2017-09-011-1/+51
| | | | | | | | | | | regular non-ccache secrets Test that even when we store the maximum number of secrets, we can still store kerberos credentials, but only until we reach the max_secrets limit as well. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Use separate quotas for /kcm and /secrets hivesJakub Hrozek2017-09-015-23/+51
| | | | | | | | | | | | | | | | | | This would differentiate between out-of-capacity errors for secrets and for KCM as they are two independent trees as far as sssd-secrets is concerned. The quotas for /kcm are also different in their defaults. For the /secrets hive, we presume a large amount of small secrets. For the /kcm hive, we presume a small amount of large secrets, because the secret is a ccache which contains multiple credentials. The operations are also passed in a struct quota from the local request context instead of local_context. The quota is assigned to the request context when the hive is selected. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Rename local_db_req.basedn to local_db_req.req_dnJakub Hrozek2017-09-011-15/+15
| | | | | | | | | | This will make it possible to reuse the basedn name later for the "hive" base DN in order to differentiate quotas for different hives. There is no functional change in this patch. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Read the quotas for cn=secrets from [secrets/secrets] configuration ↵Jakub Hrozek2017-09-014-54/+259
| | | | | | | | | | | | | | | | subsection This patch makes obsoletes the old way of configuring quotas for the secrets responder. Instead, adds a new way of configuring each hive separately in a configuration subsection, e.g. [secrets/secrets] max_secrets = 123 The old way is still supported as a backwards-compatible method. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Store quotas in a per-hive configuration structureJakub Hrozek2017-09-013-18/+26
| | | | | | | | | | Adds two new structures to hold the quotas and associate a quota with a hive. This is just an internal change for now, but will allow us to read quota configuration from per-hive sections later. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SECRETS: Do not link with c-aresJakub Hrozek2017-09-013-11/+0
| | | | | | | | | | | | Since we started using libcurl for the proxy provider, there is no point in initializing or linking against c-ares. If we want to explicitly use a resolver in the future, we should use libcurl callbacks. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Remove unused declarationsJakub Hrozek2017-09-011-2/+0
| | | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Only attempt migration for the joined domainJakub Hrozek2017-09-011-1/+11
| | | | | | | | | | | | | | After the recent changes in commit a5e134b22aa27ff6cd66a7ff47089788ebc098a1 to fix ticket #3394, the PAM_CRED_ERR error would try to start migration for any account. Further down the request, a sysdb search would try to find the user in the joined domain only because the migration code presumes the user is in the IPA domain which would error out and return System Error to the PAM client. This patch changes the migration somewhat to only attempt the migration for IPA users. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-20 05:20:05 +0000