freeipa.git/daemons/ipa-slapi-plugins, branch patternfly

ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

2014-05-05T15:50:01+00:00

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Simo Sorce 
Reviewed-By: Alexander Bokovoy

ipa_range_check: Change range_check return values from int to range_check_result_t enum

2014-04-23T11:18:41+00:00

Using integers for return values that are used for complex casing can be fragile
and typo-prone. Change range_check function to return range_check_result_t enum,
whose values properly describes each of the range_check results.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Martin Kosek

ipa_range_check: Fix typo when comparing strings using strcasecmp

2014-04-23T11:16:35+00:00

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

ipa_range_check: Do not fail when no trusted domain is available

2014-04-23T11:16:35+00:00

When building the domain to forest root map, we need to take the case
of IPA server having no trusted domains configured at all. Do not abort
the checks, but return an empty map instead.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

ipa_range_check: Make a new copy of forest_root_id attribute for range_info struct

2014-04-23T11:16:34+00:00

Not making a new copy of this attribute creates multiple frees caused by multiple
pointers to the same forest_root_id from all the range_info structs for all the
domains belonging to given forest.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

ipa_range_check: Connect the new node of the linked list

2014-04-23T11:16:34+00:00

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

ipa_range_check: Use special attributes to determine presence of RID bases

2014-04-23T11:16:34+00:00

The slapi_entry_attr_get_ulong which is used to get value of the RID base
attributes returns 0 in case the attribute is not set at all. We need
to distinguish this situation from the situation where RID base attributes
are present, but deliberately set to 0.

Otherwise this can cause false negative results of checks in the range_check
plugin.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

Extend ipa-range-check DS plugin to handle range types

2014-04-08T12:23:18+00:00

The ipa-range-check plugin used to determine the range type depending
on the value of the attributes such as RID or secondary RID base. This
approached caused variety of issues since the portfolio of ID range
types expanded.

The patch makes sure the following rules are implemented:
    * No ID range pair can overlap on base ranges, with exception
      of two ipa-ad-trust-posix ranges belonging to the same forest
    * For any ID range pair of ranges belonging to the same domain:
        * Both ID ranges must be of the same type
        * For ranges of ipa-ad-trust type or ipa-local type:
            * Primary RID ranges can not overlap
        * For ranges of ipa-local type:
            * Primary and secondary RID ranges can not overlap
            * Secondary RID ranges cannot overlap

For the implementation part, the plugin was extended with a domain ID
to forest root domain ID mapping derivation capabilities.

https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy

ipa-range-check: Fix memory leaks when freeing range object

2014-04-08T12:23:18+00:00

When cleaning the range_info struct, simple free of the struct
is not enough, we have to free contents of char pointers in the
struct as well.

https://fedorahosted.org/freeipa/ticket/4276

ipa-pwd-extop: Fix memory leak in ipapwd_pre_bind

2014-04-08T12:23:18+00:00

We need to free the entry before returning from the function.

https://fedorahosted.org/freeipa/ticket/4295