summaryrefslogtreecommitdiffstats
path: root/daemons
Commit message (Collapse)AuthorAgeFilesLines
* ipa-pwd-extop: do not use dn until it is really setSumit Bose2013-04-021-20/+20
| | | | https://fedorahosted.org/freeipa/ticket/3539
* Configure ipa_dns DS plugin on install and upgradeMartin Kosek2013-03-222-0/+21
| | | | | | | | | | The plugin is configured unconditionally (i.e. does not check if IPA was configured with DNS) as the plugin is needed on all replicas to prevent objectclass violations due to missing SOA serial in idnsZone objectclass. The violation could happen if just one replica configured DNS and added a new zone. https://fedorahosted.org/freeipa/ticket/3347
* Add 389 DS plugin for special idnsSOASerial attribute handlingPetr Spacek2013-03-224-0/+253
| | | | | | | | | Default value "1" is added to replicated idnsZone objects if idnsSOASerial attribute is missing. https://fedorahosted.org/freeipa/ticket/3347 Signed-off-by: Petr Spacek <pspacek@redhat.com>
* Perform secondary rid range overlap check for local ranges onlyTomas Babej2013-03-111-16/+25
| | | | | | | | | | | Any of the following checks: - overlap between primary RID range and secondary RID range - overlap between secondary RID range and secondary RID range is performed now only if both of the ranges involved are local domain ranges. https://fedorahosted.org/freeipa/ticket/3391
* ipa-pwd: Unchecked return value ipapwd_chpwop()Sumit Bose2013-02-281-1/+5
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3427
* ipa-extdom: Double-free in ipa_extdom_common.cSumit Bose2013-02-281-1/+0
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3426
* ipa-lockout: Wrong sizeof argument in ipa_lockout.cSumit Bose2013-02-281-1/+1
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3425
* ipa-kdb: Dereference after null check in ipa_kdb_mspac.cSumit Bose2013-02-281-1/+1
| | | | | | A wrong logic was used to check ipactx. Fixes https://fedorahosted.org/freeipa/ticket/3424
* ipa-sam: Array compared against 0 in ipasam_set_trusted_domain()Sumit Bose2013-02-281-1/+1
| | | | | | | ipa_mspac_well_known_sids is a globally defined array so the check was always true. Fixes https://fedorahosted.org/freeipa/ticket/3423
* ipa-kdb: Uninitialized scalar variable in ipadb_reinit_mspac()Sumit Bose2013-02-281-5/+4
| | | | | | | There was a code path where ret was used instead of kerr to save a return value. Fixes https://fedorahosted.org/freeipa/ticket/3422
* ipa-kdb: remove unused variableSumit Bose2013-02-281-1/+1
|
* ipasam: use base scope when fetching domain information about own domainAlexander Bokovoy2013-02-191-1/+1
| | | | | | | | | Since we use associatedDomain attribute to store information about UPN suffixes and our own domain, searching subtree is going to return more than one entry. Limit search for own domain by base scope as we only need to fetch our own domain information here, not UPN suffixes. Required for https://fedorahosted.org/freeipa/ticket/2945
* ipa-kdb: Free talloc autofree context when module is closedsbose2013-02-141-0/+3
| | | | | | | | | | | | | | | Currently kdb5kdc crashes on exit if the ipadb KDB modules is loaded and trusts are configured. The reason is the talloc autofree context which get initialised during the ndr_push_union_blob() call. On exit the KDC module is unloaded an later on atexit() tries to free the context, but all related symbols are already unloaded with the module. This patch frees the talloc autofree context during the cleanup routine of the module. Since this is called only at exit and not during normal operations this is safe even if other KDC plugins use the talloc autofree context, e.g. via some Samba libraries, as well. Fixes https://fedorahosted.org/freeipa/ticket/3410
* ipa-kdb: fix retry logic in ipadb_deref_searchMartin Kosek2013-02-141-1/+1
| | | | | | | | This function retried an LDAP search when the result was OK due to flawed logic of retry detection (ipadb_need_retry function which returns true when we need retry and not 0). https://fedorahosted.org/freeipa/ticket/3413
* ipa-kdb: remove memory leaksMartin Kosek2013-02-144-2/+25
| | | | | | | | All known memory leaks caused by unfreed allocated memory or unfreed LDAP results (which should be also done after unsuccessful searches) are fixed. https://fedorahosted.org/freeipa/ticket/3413
* ipa-sam: Fill SID blacklist when trust is addedMartin Kosek2013-02-121-1/+13
| | | | | | | Fill incoming and outgoing trust LDAP entry with default SID blacklist value. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: read SID blacklist from LDAPMartin Kosek2013-02-122-54/+104
| | | | | | | | | | | | SIDs in incoming MS-PAC were checked and filtered with a fixed list of well-known SIDs. Allow reading the SID blacklist from LDAP (ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list to mspac adtrust structure. Use the hardcoded SID list only if the LDAP SID list is not configured. LIMITATION: SID blacklist list is not used yet. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: reinitialize LDAP configuration for known realmsMartin Kosek2013-02-121-12/+45
| | | | | | | | | | | | | ipa-kdb did not reinitialize trusted domain configuration when it was loaded to ipa-kdb. However, admin then would have to restart krb5kdc if he wanted to apply the change to running krb5kdc service. Run ipadb_reinit_mspac unconditionally every time when trusted domain is loaded. Among the already configured 1 minute grace time, also add a quick check if there is at least one configured trusted domain before reinitializing the mspac structure. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: avoid ENOMEM when all SIDs are filtered outMartin Kosek2013-02-121-4/+14
| | | | | | | | | When all SIDs in info3.sids structure were filtered out, we tried to talloc_realloc to zero memory size. talloc_realloc then returned NULL pointer and filter_login_info returned with ENOMEM. The code now rather frees the SID array and set info3.sidcount to correct value.
* ipa-kdb: add sentinel for LDAPDerefSpec allocationMartin Kosek2013-02-121-5/+6
| | | | | Without sentinel in place, ldap_create_deref_control_value executed an invalid read in unallocated memory.
* Prevent integer overflow when setting krbPasswordExpirationTomas Babej2013-02-084-13/+47
| | | | | | | | | | | | | | | | Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
* ipa-kdb: Support Windows 2012 ServerAlexander Bokovoy2012-12-071-15/+253
| | | | | | | | | | | Windows 2012 Server changed procedure how KERB_VALIDATION_INFO ([MS-PAC] section 2.5) is populated. Detailed description is available in [MS-KILE] version 25.0 and above. Refactor KERB_VALIDATION_INFO verification and ensure we filter out extra SIDs in case they belong to our domain. https://fedorahosted.org/freeipa/ticket/3231
* Bump 389-ds-base minimum in our spec fileMartin Kosek2012-12-071-1/+1
| | | | | Our code needs both Requires and BuildRequires set to 389-ds-base which supports transactions. Also add the requires to configure.ac.
* Password change in a transaction, ensure passwords are truly expiredRob Crittenden2012-12-073-4/+34
| | | | | | | | | | Wrap the password change extop in a transaction. Fix the case where a password is reset and then immediately used. If done fast enough then the KDC may not detect that the password is expired and grant access using the expired password rather than prompting for a reset. https://fedorahosted.org/freeipa/ticket/1064
* Honor the kdb options disabling KDC writes in ipa_lockout pluginRob Crittenden2012-12-051-1/+119
| | | | | | | | | | | | | Ther3 are two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* Lookup the user SID in external group as wellSumit Bose2012-11-301-5/+14
| | | | | | | Currently only the group SIDs from a PAC are used to find out about the membership in local groups. This patch adds the user SID to the list. Fixes https://fedorahosted.org/freeipa/ticket/3257
* MS-PAC: Special case NFS servicesSimo Sorce2012-11-301-1/+35
| | | | | | | | | | The current Linux NFS server is severely limited when it comes to handling kerberos tickets. Bsically any ticket bigger than 2k will cause it to fail authentication due to kernel->userspace upcall interface restrictions. Until we have additional support in IPA to indivdually mark principals to opt out of getting PACs attached we always prevent PACs from being attached to TGTs or Tickets where NFS is involved.
* Enable transactions by default, make password and modrdn TXN-awareRob Crittenden2012-11-216-5/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | The password and modrdn plugins needed to be made transaction aware for the pre and post operations. Remove the reverse member hoop jumping. Just fetch the entry once and all the memberof data is there (plus objectclass). Fix some unit tests that are failing because we actually get the data now due to transactions. Add small bit of code in user plugin to retrieve the user again ala wait_for_attr but in the case of transactions we need do it only once. Deprecate wait_for_attr code. Add a memberof fixup task for roles. https://fedorahosted.org/freeipa/ticket/1263 https://fedorahosted.org/freeipa/ticket/1891 https://fedorahosted.org/freeipa/ticket/2056 https://fedorahosted.org/freeipa/ticket/3043 https://fedorahosted.org/freeipa/ticket/3191 https://fedorahosted.org/freeipa/ticket/3046
* ipasam: better Kerberos error handling in ipasamAlexander Bokovoy2012-11-211-3/+5
| | | | | | | If time is moved back on the IPA server, ipasam does not invalidate the existing ticket. https://fedorahosted.org/freeipa/ticket/3183
* Forbid overlapping primary and secondary rid rangesTomas Babej2012-10-191-14/+97
| | | | | | | | | | | Commands ipa idrange-add / idrange-mod no longer allows the user to enter primary or secondary rid range such that has non-zero intersection with primary or secondary rid range of another existing id range, as this could cause collision. Unit tests added to test_range_plugin.py https://fedorahosted.org/freeipa/ticket/3086
* extdom: handle INP_POSIX_UID and INP_POSIX_GID requestsSumit Bose2012-10-181-6/+32
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3166
* Fix various issues found by CoveritySumit Bose2012-10-176-12/+22
|
* ipadb: reload trust information if domain is not knownSumit Bose2012-10-091-1/+39
| | | | | | | | | | Currently the data about trusted domains is read once at startup. If a new trust is added the KDC must be restarted to know about the new trust. This patch reloads the trust data if there is a request from an unknown domain. To make DOS attacks a bit harder the data can be updated only once in a minute. Fixes https://fedorahosted.org/freeipa/ticket/3156
* ipasam: generate proper SID for trusted domain objectSumit Bose2012-10-041-8/+49
|
* Add SIDs for existing users and groups at the end of ipa-adtrust-installSumit Bose2012-10-043-10/+11
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3104
* ipasam: add fallback primary groupSumit Bose2012-10-041-7/+230
| | | | https://fedorahosted.org/freeipa/ticket/2955
* ipasam: Fixes build with samba4 rc1Sumit Bose2012-09-141-10/+10
|
* Support the new Winsync POSIX API.Rob Crittenden2012-09-061-6/+50
| | | | | | | | | | | This will sync down the POSIX attributes from AD so we need to be careful to not mess with them when they are already set. This includes uidNumber, gidNumber, homeDirectory, loginShell and gecos. http://port389.org/wiki/WinSync_Posix http://port389.org/wiki/Windows_Sync_Plugin_API#Version_3_API_functions https://fedorahosted.org/freeipa/ticket/3007
* ipasam: replace trim_char() with trim_string()Sumit Bose2012-09-061-2/+1
|
* ipasam: remove fetch_ldap_pw()Sumit Bose2012-09-061-10/+2
|
* ipasam: replace get_global_sam_sid()Sumit Bose2012-09-061-4/+12
|
* ipasam: add libsss_idmap context and replace string_to_sid()Sumit Bose2012-09-062-31/+89
|
* ipasam: Replace global_sid_BuiltinSumit Bose2012-09-061-1/+3
|
* ipasam: Replace sid_peek_check_rid()Sumit Bose2012-09-061-1/+17
|
* ipasam: Replace sid_check_is_our_sam()Sumit Bose2012-09-061-2/+1
|
* ipasam: Replace dom_sid_compare_domain()Sumit Bose2012-09-061-1/+27
|
* ipasam: Replace is_null_sid()Sumit Bose2012-09-061-1/+24
|
* ipasam: replace sid_compose()Sumit Bose2012-09-061-1/+14
|
* ipasam: replace sid_copy()Sumit Bose2012-09-061-1/+15
|
* ipasam: remove talloc_asprintf_strupper_m()Sumit Bose2012-09-061-3/+8
|
generated by cgit (git 2.34.1) at 2024-05-19 05:20:04 +0000