summaryrefslogtreecommitdiffstats
path: root/daemons
Commit message (Collapse)AuthorAgeFilesLines
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-299-35/+9
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable authentication indicators for OTP and RADIUSNathaniel McCallum2016-05-261-2/+8
| | | | | | | | | If the user is configured for OTP or RADIUS authentication, insert the relevant authentication indicator. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Return password-only preauth if passwords are allowedNathaniel McCallum2016-05-261-4/+2
| | | | | | | | | | Before this patch, if either password or password+otp were permitted, only the otp preauth mech would be returned to the client. Now, the client will receive either enc_ts or enc_chl in addition to otp. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Ensure that ipa-otpd bind auths validate an OTPNathaniel McCallum2016-05-263-6/+15
| | | | | | | | | | | | | | | | | | | | | | Before this patch, if the user was configured for either OTP or password it was possible to do a 1FA authentication through ipa-otpd. Because this correctly respected the configuration, it is not a security error. However, once we begin to insert authentication indicators into the Kerberos tickets, we cannot allow 1FA authentications through this code path. Otherwise the ticket would contain a 2FA indicator when only 1FA was actually performed. To solve this problem, we have ipa-otpd send a critical control during the bind operation which informs the LDAP server that it *MUST* validate an OTP token for authentication to be successful. Next, we implement support for this control in the ipa-pwd-extop plugin. The end result is that the bind operation will always fail if the control is present and no OTP is validated. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Rename syncreq.[ch] to otpctrl.[ch]Nathaniel McCallum2016-05-264-13/+13
| | | | | | | | | | | | This gives us a place to handle all OTP related controls. Also, genericize otpctrl_present() so that the OID can be specified as an argument to the function call. These changes are preparatory for the subsequent patches. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa_kdb: add krbPrincipalAuthInd handlingMatt Rogers2016-05-021-0/+170
| | | | | | | | | | Store and retrieve the authentication indicator "require_auth" string in the krbPrincipalAuthInd attribute. Skip storing auth indicators to krbExtraData. https://fedorahosted.org/freeipa/ticket/5782 Reviewed-By: Sumit Bose <sbose@redhat.com>
* BUILD: Remove detection of libcheckLukas Slebodnik2016-04-221-11/+0
| | | | | | | | | | The unit test framework check has not been used in freeipa for long time (if ever) but there was still conditional check for this framework. It just produced confusing warning: Without the 'CHECK' library, you will be unable to run all tests in the 'make check' suite Reviewed-By: Petr Spacek <pspacek@redhat.com>
* extdom: do not fail to process error case when no request is specifiedAlexander Bokovoy2016-03-101-1/+1
| | | | | | Coverity CID 13130 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-7/+9
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-sam: Do not redefine LDAP_PAGE_SIZELukas Slebodnik2016-03-091-1/+0
| | | | | | | | | | | | | | | | The value of LDAP_PAGE_SIZE was changed in samba-4.4 and it caused warning because it's already defined in samba header files ipa_sam.c:114:0: warning: "LDAP_PAGE_SIZE" redefined #define LDAP_PAGE_SIZE 1024 In file included from /usr/include/samba-4.0/smbldap.h:24:0, from ipa_sam.c:31: /usr/include/samba-4.0/smb_ldap.h:81:0: note: this is the location of the previous definition #define LDAP_PAGE_SIZE 1000 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* CONFIGURE: Replace obsolete macrosLukas Slebodnik2016-03-081-1/+1
| | | | | | | | | The AC_PROG_LIBTOOL macro is obsoleted by since libtool-2.0 which is already in rhel6+ https://fedorahosted.org/FedoraReview/wiki/AutoTools Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow admins to disable preauth for SPNs.Simo Sorce2016-03-083-6/+27
| | | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* IPA-SAM: Fix build with samba 4.4Lukas Slebodnik2016-02-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | samba_util.h is not shipped with samba-4.4 and it was indirectly included by "ndr.h" Some functions have prototypes in different header file "util/talloc_stack.h" and other does not have declarations in other header file. But they are still part of libsamba-util.so sh$ objdump -T /usr/lib64/libsamba-util.so.0.0.1 | grep -E "trim_s|xstrdup" 0000000000022200 g DF .text 000000000000001f SAMBA_UTIL_0.0.1 smb_xstrdup 00000000000223b0 g DF .text 000000000000019d SAMBA_UTIL_0.0.1 trim_string ipa_sam.c: In function 'ldapsam_uid_to_sid': ipa_sam.c:836:24: warning: implicit declaration of function 'talloc_stackframe' [-Wimplicit-function-declaration] TALLOC_CTX *tmp_ctx = talloc_stackframe(); ^ ipa_sam.c: In function 'pdb_init_ipasam': ipa_sam.c:4493:2: warning: implicit declaration of function 'trim_string' [-Wimplicit-function-declaration] trim_string( uri, "\"", "\"" ); ^ ipa_sam.c:4580:26: warning: implicit declaration of function 'smb_xstrdup' [-Wimplicit-function-declaration] ldap_state->domain_dn = smb_xstrdup(dn); ^ Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-012-52/+32
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve keytab code to select the right principal.Simo Sorce2016-02-014-9/+20
| | | | | | | | | | | | Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD compatibility), however since we added alias support we need to search for the krbCanonicalName in preference, hen nothing is specified, and for the requested principal name when a getkeytab operation is performed. This is so that the correct salt can be applied. (Windows AD uses some peculiar aliases for some special accounts to generate the salt). Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: Remove unused macroLukas Slebodnik2016-01-291-2/+0
| | | | | | | Last usage of the macre SSSD_SYSDB_SID_STR was removed in the commit 0ee8fe11aea9811c724182def3f50960d5dd87b3 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* prevent moving of topology entries out of managed scope by modrdn operationsLudwig Krispenz2016-01-213-0/+56
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/5536 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Always verify we have a valid ldap context.Simo Sorce2016-01-131-0/+29
| | | | | | | | | | | LDAP calls just assert if an invalid (NULL) context is passed in, so we need to be sure we have a valid connection context before calling into LDAP APIs and fail outright if a context can't be obtained. https://fedorahosted.org/freeipa/ticket/5577 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use only AES enctypes by defaultSimo Sorce2016-01-131-11/+3
| | | | | | | | | | | | Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't error when find_base() fails if a base is not requiredNathaniel McCallum2016-01-121-4/+5
| | | | | | | | | We always have to call find_base() in order to force libldap to open the socket. However, if no base is actually required then there is no reason to error out if find_base() fails. This condition can arise when anonymous binds are disabled. Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Log debug messages at log level DEBUGPetr Spacek2016-01-071-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-ods-exporter: add ldap-cleanup commandPetr Spacek2016-01-071-12/+48
| | | | | | | | | | | | | | | Command "ldap-cleanup <zone name>" will remove all key metadata from LDAP. This can be used manually in sequence like: ldap-cleanup <zone name> update <zone name> to delete all key metadata from LDAP and re-export them from OpenDNSSEC. ldap-cleanup command should be called when disabling DNSSEC on a DNS zone to remove stale key metadata from LDAP. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAPPetr Spacek2016-01-071-7/+38
| | | | | | | | | | Key purging has to be only only after key metadata purging so ipa-dnskeysyncd on replices does not fail while dereferencing non-existing keys. https://fedorahosted.org/freeipa/ticket/5334 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: logging improvements in ipa-ods-exporterPetr Spacek2016-01-071-6/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Make sure that current state in OpenDNSSEC matches key state in LDAPPetr Spacek2016-01-071-10/+95
| | | | | | | | | | | | | | | | | | | | | | | | Previously we published timestamps of planned state changes in LDAP. This led to situations where state transition in OpenDNSSEC was blocked by an additional condition (or unavailability of OpenDNSSEC) but BIND actually did the transition as planned. Additionally key state mapping was incorrect for KSK so sometimes KSK was not used for signing when it should. Example (for code without this fix): - Add a zone and let OpenDNSSEC to generate keys. - Wait until keys are in state "published" and next state is "inactive". - Shutdown OpenDNSSEC or break replication from DNSSEC key master. - See that keys on DNS replicas will transition to state "inactive" even though it should not happen because OpenDNSSEC is not available (i.e. new keys may not be available). - End result is that affected zone will not be signed anymore, even though it should stay signed with the old keys. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Improve error reporting from ipa-ods-exporterPetr Spacek2016-01-071-1/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused importsMartin Basti2015-12-233-16/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* FIX: ipa_kdb_principals: add missing break statementMartin Basti2015-11-301-0/+1
| | | | | | | Needs a 'break' otherwise prevents correct reporting of data and it always overrides it with the placeholder data. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipasam: fix a use-after-free issueSumit Bose2015-11-231-1/+2
| | | | | | | Since endptr points to a location inside of dummy, dummy should be freed only after dereferencing endptr. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: use more restrictive search filter for group lookupSumit Bose2015-11-231-1/+3
| | | | | | | | | | | Since we are interested in looking up the SID of a group it makes sense to include the objectclass which contains the SID attribute in the search filter. This makes sure the group is not accidentally found a second time in the compat tree. Related to https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: fix wrong usage of talloc_new()Sumit Bose2015-11-231-1/+1
| | | | | | Fixes https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_kdb_tests: Fix test with default krb5.confLukas Slebodnik2015-11-181-0/+4
| | | | | | | Default krb5.conf needn't have defined default_realm. Unit tests should not rely on existing default value. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cmocka_tests: Do not use deprecated cmocka interfaceLukas Slebodnik2015-11-183-25/+36
| | | | | | | | The cmocka-1.0 introduced new interface for tests which is not compatible with the old one. And the old interface is deprecated which caused compiled warnings. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-extdom-extop: Fix warning WformatLukas Slebodnik2015-11-131-1/+1
| | | | | | | | | | | | | | | In file included from ipa_extdom_extop.c:41:0: ipa_extdom_extop.c: In function ‘ipa_extdom_init_ctx’: ipa_extdom_extop.c:203:9: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘size_t {aka long unsigned int}’ [-Wformat=] LOG("Maximal nss buffer size set to [%d]!\n", ctx->max_nss_buf_size); ^ ../common/util.h:53:21: note: in definition of macro ‘LOG_PLUGIN_NAME’ fmt, ##__VA_ARGS__) ^ ipa_extdom_extop.c:203:5: note: in expansion of macro ‘LOG’ Reviewed-By: Martin Basti <mbasti@redhat.com>
* topology: Fix warning WshadowLukas Slebodnik2015-11-131-1/+0
| | | | | | | | | | | | topology_pre.c: In function ‘ipa_topo_pre_add’: topology_pre.c:509:15: warning: declaration of ‘errtxt’ shadows a previous local [-Wshadow] char *errtxt; ^ topology_pre.c:494:11: note: shadowed declaration is here char *errtxt = NULL; ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Fix warning Wmissing-bracesLukas Slebodnik2015-11-131-2/+2
| | | | | | | | | | | | | | | | tests/ipa_kdb_tests.c:254:9: warning: missing braces around initializer [-Wmissing-braces] {3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", BLACKLIST_SID"-1002"}, ^ tests/ipa_kdb_tests.c:254:9: note: (near initialization for ‘test_data[6]’) tests/ipa_kdb_tests.c:256:9: warning: missing braces around initializer [-Wmissing-braces] {0, NULL, 0 , NULL} ^ tests/ipa_kdb_tests.c:256:9: note: (near initialization for ‘test_data[7]’) tests/ipa_kdb_tests.c:234:21: warning: missing braces around initializer [-Wmissing-braces] } test_data[] = { ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Remove unused variablesLukas Slebodnik2015-11-131-4/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* update list of managed servers when a suffix becomes managedLudwig Krispenz2015-10-304-30/+42
| | | | | | | when a suffix becomes managed for a host, the host needs to be added to the managed servers, otherwise connectivity check would fail Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* reject agreement only if both ends are managedLudwig Krispenz2015-10-301-1/+2
| | | | | | | the creation or deletion of a replication agreemet is rejected if the servers are managed for the suffix. But bot endpoints need to checked Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* handle cleaning of RUV in the topology pluginLudwig Krispenz2015-10-263-0/+106
| | | | | | | | | | After removing a server the replicaid needs to be cleared in the ruv entry and in the changelog. This was triggere by initiating a cleanallruv task in "ipa-replica-manage del", but the removal of a master already triggers a cleanup of segments and replication agreement by the topology plugin, so this could be handled by the plugin as well. Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* prevent operation on tombstonesLudwig Krispenz2015-10-154-1/+22
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* handle multiple managed suffixesLudwig Krispenz2015-10-157-50/+212
| | | | | | | | trigger topology updaet if suffix entry is added trigger topology update if managedSuffix is modified in host entry Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology plugin configuration workaroundPetr Vobornik2015-10-151-0/+1
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client referral support for trusted domain principalsAlexander Bokovoy2015-10-083-0/+123
| | | | | | https://fedorahosted.org/freeipa/ticket/3559 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Avoid ipa-dnskeysync-replica & ipa-ods-exporter crashes caused by exceeding ↵Petr Spacek2015-10-072-8/+4
| | | | | | | | | | | | | | | | LDAP limits ldap2 internally does LDAP search to find out what LDAP search limits should be used (!). The problem is that this internal search has hardcoded limits and throws LimitExceeded exception when DS is too slow. DNSSEC daemons do not need any abstractions from ldap2 so we are going to use ipaldap directly. This will avoid the unnecessary search and associated risks. https://fedorahosted.org/freeipa/ticket/5342 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.Stringio instead of StringIO.StringIOPetr Viktorin2015-10-071-2/+3
| | | | | | | | | The StringIO class was moved to the io module. (In Python 2, io.StringIO is available, but is Unicode-only.) Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix an integer underflow bug in libotpNathaniel McCallum2015-09-291-3/+3
| | | | | | | | | | Temporarily storing the offset time in an unsigned integer causes the value of the offset to underflow when a (valid) negative offset value is generated. Using a signed variable avoids this problem. https://fedorahosted.org/freeipa/ticket/5333 Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-21 20:35:46 +0000