summaryrefslogtreecommitdiffstats
path: root/daemons
Commit message (Collapse)AuthorAgeFilesLines
* kdb: check for local realm in enterprise principalsHEADmasterSumit Bose2016-07-061-12/+40
|
* IPA KDB: use empty profile to init krb5 context in testsSumit Bose2016-07-061-1/+7
| | | | | | If the systems /etc/krb5.conf contains some unexpected or broken configuration the test might fail. With this patch the tests are run with an empty configuration.
* ipa-sam: use proper domain GUIDSumit Bose2016-07-061-12/+16
|
* Allow unexpiring passwordsDavid Kupka2016-07-014-11/+32
| | | | | | | | | | Treat maxlife=0 in password policy as "never expire". Delete krbPasswordExpiration in user entry when password should never expire. https://fedorahosted.org/freeipa/ticket/2795 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Bump SSSD version in requiresMartin Basti2016-07-011-1/+1
| | | | | | | | | This is required by commit aa734da49440c5d12c0f8d4566505adaeef254e8 for function sss_nss_getnamebycert() https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipapwd_extop should use TARGET_DN defined by a pre-extop pluginThierry Bordaz2016-06-241-8/+28
| | | | | | | | | | | | | | ipapwd_extop allows to update the password on a specific entry, identified by its DN. It can be usefull to support virtual DN in the extop so that update of a virtual entry would land into the proper real entry. If a pre-extop sets the TARGET_DN, ipapwd_extop sets ORIGINAL_DN with the value of TARGET_DN, instead of using the original one (in the ber req) There is a dependency on slapi-nis >= 0.56-0.1 (https://fedorahosted.org/freeipa/ticket/5955) https://fedorahosted.org/freeipa/ticket/5946 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-enrollment: set krbCanonicalName attribute on enrolled host entryMartin Babinsky2016-06-231-0/+15
| | | | | | | Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: set krbCanonicalName when creating new principalsMartin Babinsky2016-06-231-3/+1
| | | | | | | | | | Additionally, stop setting ipakrbprincipalalias attribute during principal creation. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* perform case-insensitive principal search when canonicalization is requestedMartin Babinsky2016-06-231-1/+12
| | | | | | | | | | | | | When canonicalization is requested, the krbprincipalname attribute is searched for case-insensitively. In the case that krbcanonicalname is not set, the matched alias is returned with the casing stored in backend, not the one input by client. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Topology plugins sigsev/heap corruption when adding a managed hostroot2016-06-221-0/+1
| | | | | | | | | | | | | | | A managed host may handle several ipaReplTopoManagedSuffix. Removing (from the topology) such host, loops over the replicated suffixes array to retrieve, in the hosts list, the host record and delete it. The problem is that a variable used to manage a hosts list is not reset when looking at the next suffix. That will messup the lists, keeping freed elements in the lists. The fix is to reset the variable inside the replicated suffix loop https://fedorahosted.org/freeipa/ticket/5977 Reviewed-By: Ludwig Krispenz <lkrispen@redhat.com>
* Remove unused locking "context manager"David Kupka2016-06-171-13/+0
| | | | | | Class ods_db_lock is unused since August 2015. Reviewed-By: Martin Basti <mbasti@redhat.com>
* v2 - avoid crash in topology plugin when host list contains host with no ↵Ludwig Krispenz2016-06-131-1/+10
| | | | | | | | | | | hostname ticket #5928 prevent a crash when dereferncing a NULL hostnam, log an error to help debugging fix an incorrect order of statement when freeing a host list Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-113-13/+57
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* extdom: add certificate requestSumit Bose2016-06-092-8/+27
| | | | | | | Related to https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-299-35/+9
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable authentication indicators for OTP and RADIUSNathaniel McCallum2016-05-261-2/+8
| | | | | | | | | If the user is configured for OTP or RADIUS authentication, insert the relevant authentication indicator. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Return password-only preauth if passwords are allowedNathaniel McCallum2016-05-261-4/+2
| | | | | | | | | | Before this patch, if either password or password+otp were permitted, only the otp preauth mech would be returned to the client. Now, the client will receive either enc_ts or enc_chl in addition to otp. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Ensure that ipa-otpd bind auths validate an OTPNathaniel McCallum2016-05-263-6/+15
| | | | | | | | | | | | | | | | | | | | | | Before this patch, if the user was configured for either OTP or password it was possible to do a 1FA authentication through ipa-otpd. Because this correctly respected the configuration, it is not a security error. However, once we begin to insert authentication indicators into the Kerberos tickets, we cannot allow 1FA authentications through this code path. Otherwise the ticket would contain a 2FA indicator when only 1FA was actually performed. To solve this problem, we have ipa-otpd send a critical control during the bind operation which informs the LDAP server that it *MUST* validate an OTP token for authentication to be successful. Next, we implement support for this control in the ipa-pwd-extop plugin. The end result is that the bind operation will always fail if the control is present and no OTP is validated. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Rename syncreq.[ch] to otpctrl.[ch]Nathaniel McCallum2016-05-264-13/+13
| | | | | | | | | | | | This gives us a place to handle all OTP related controls. Also, genericize otpctrl_present() so that the OID can be specified as an argument to the function call. These changes are preparatory for the subsequent patches. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa_kdb: add krbPrincipalAuthInd handlingMatt Rogers2016-05-021-0/+170
| | | | | | | | | | Store and retrieve the authentication indicator "require_auth" string in the krbPrincipalAuthInd attribute. Skip storing auth indicators to krbExtraData. https://fedorahosted.org/freeipa/ticket/5782 Reviewed-By: Sumit Bose <sbose@redhat.com>
* BUILD: Remove detection of libcheckLukas Slebodnik2016-04-221-11/+0
| | | | | | | | | | The unit test framework check has not been used in freeipa for long time (if ever) but there was still conditional check for this framework. It just produced confusing warning: Without the 'CHECK' library, you will be unable to run all tests in the 'make check' suite Reviewed-By: Petr Spacek <pspacek@redhat.com>
* extdom: do not fail to process error case when no request is specifiedAlexander Bokovoy2016-03-101-1/+1
| | | | | | Coverity CID 13130 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-7/+9
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-sam: Do not redefine LDAP_PAGE_SIZELukas Slebodnik2016-03-091-1/+0
| | | | | | | | | | | | | | | | The value of LDAP_PAGE_SIZE was changed in samba-4.4 and it caused warning because it's already defined in samba header files ipa_sam.c:114:0: warning: "LDAP_PAGE_SIZE" redefined #define LDAP_PAGE_SIZE 1024 In file included from /usr/include/samba-4.0/smbldap.h:24:0, from ipa_sam.c:31: /usr/include/samba-4.0/smb_ldap.h:81:0: note: this is the location of the previous definition #define LDAP_PAGE_SIZE 1000 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* CONFIGURE: Replace obsolete macrosLukas Slebodnik2016-03-081-1/+1
| | | | | | | | | The AC_PROG_LIBTOOL macro is obsoleted by since libtool-2.0 which is already in rhel6+ https://fedorahosted.org/FedoraReview/wiki/AutoTools Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow admins to disable preauth for SPNs.Simo Sorce2016-03-083-6/+27
| | | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* IPA-SAM: Fix build with samba 4.4Lukas Slebodnik2016-02-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | samba_util.h is not shipped with samba-4.4 and it was indirectly included by "ndr.h" Some functions have prototypes in different header file "util/talloc_stack.h" and other does not have declarations in other header file. But they are still part of libsamba-util.so sh$ objdump -T /usr/lib64/libsamba-util.so.0.0.1 | grep -E "trim_s|xstrdup" 0000000000022200 g DF .text 000000000000001f SAMBA_UTIL_0.0.1 smb_xstrdup 00000000000223b0 g DF .text 000000000000019d SAMBA_UTIL_0.0.1 trim_string ipa_sam.c: In function 'ldapsam_uid_to_sid': ipa_sam.c:836:24: warning: implicit declaration of function 'talloc_stackframe' [-Wimplicit-function-declaration] TALLOC_CTX *tmp_ctx = talloc_stackframe(); ^ ipa_sam.c: In function 'pdb_init_ipasam': ipa_sam.c:4493:2: warning: implicit declaration of function 'trim_string' [-Wimplicit-function-declaration] trim_string( uri, "\"", "\"" ); ^ ipa_sam.c:4580:26: warning: implicit declaration of function 'smb_xstrdup' [-Wimplicit-function-declaration] ldap_state->domain_dn = smb_xstrdup(dn); ^ Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-012-52/+32
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve keytab code to select the right principal.Simo Sorce2016-02-014-9/+20
| | | | | | | | | | | | Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD compatibility), however since we added alias support we need to search for the krbCanonicalName in preference, hen nothing is specified, and for the requested principal name when a getkeytab operation is performed. This is so that the correct salt can be applied. (Windows AD uses some peculiar aliases for some special accounts to generate the salt). Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: Remove unused macroLukas Slebodnik2016-01-291-2/+0
| | | | | | | Last usage of the macre SSSD_SYSDB_SID_STR was removed in the commit 0ee8fe11aea9811c724182def3f50960d5dd87b3 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* prevent moving of topology entries out of managed scope by modrdn operationsLudwig Krispenz2016-01-213-0/+56
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/5536 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Always verify we have a valid ldap context.Simo Sorce2016-01-131-0/+29
| | | | | | | | | | | LDAP calls just assert if an invalid (NULL) context is passed in, so we need to be sure we have a valid connection context before calling into LDAP APIs and fail outright if a context can't be obtained. https://fedorahosted.org/freeipa/ticket/5577 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use only AES enctypes by defaultSimo Sorce2016-01-131-11/+3
| | | | | | | | | | | | Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't error when find_base() fails if a base is not requiredNathaniel McCallum2016-01-121-4/+5
| | | | | | | | | We always have to call find_base() in order to force libldap to open the socket. However, if no base is actually required then there is no reason to error out if find_base() fails. This condition can arise when anonymous binds are disabled. Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Log debug messages at log level DEBUGPetr Spacek2016-01-071-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-ods-exporter: add ldap-cleanup commandPetr Spacek2016-01-071-12/+48
| | | | | | | | | | | | | | | Command "ldap-cleanup <zone name>" will remove all key metadata from LDAP. This can be used manually in sequence like: ldap-cleanup <zone name> update <zone name> to delete all key metadata from LDAP and re-export them from OpenDNSSEC. ldap-cleanup command should be called when disabling DNSSEC on a DNS zone to remove stale key metadata from LDAP. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAPPetr Spacek2016-01-071-7/+38
| | | | | | | | | | Key purging has to be only only after key metadata purging so ipa-dnskeysyncd on replices does not fail while dereferencing non-existing keys. https://fedorahosted.org/freeipa/ticket/5334 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: logging improvements in ipa-ods-exporterPetr Spacek2016-01-071-6/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Make sure that current state in OpenDNSSEC matches key state in LDAPPetr Spacek2016-01-071-10/+95
| | | | | | | | | | | | | | | | | | | | | | | | Previously we published timestamps of planned state changes in LDAP. This led to situations where state transition in OpenDNSSEC was blocked by an additional condition (or unavailability of OpenDNSSEC) but BIND actually did the transition as planned. Additionally key state mapping was incorrect for KSK so sometimes KSK was not used for signing when it should. Example (for code without this fix): - Add a zone and let OpenDNSSEC to generate keys. - Wait until keys are in state "published" and next state is "inactive". - Shutdown OpenDNSSEC or break replication from DNSSEC key master. - See that keys on DNS replicas will transition to state "inactive" even though it should not happen because OpenDNSSEC is not available (i.e. new keys may not be available). - End result is that affected zone will not be signed anymore, even though it should stay signed with the old keys. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Improve error reporting from ipa-ods-exporterPetr Spacek2016-01-071-1/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused importsMartin Basti2015-12-233-16/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* FIX: ipa_kdb_principals: add missing break statementMartin Basti2015-11-301-0/+1
| | | | | | | Needs a 'break' otherwise prevents correct reporting of data and it always overrides it with the placeholder data. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipasam: fix a use-after-free issueSumit Bose2015-11-231-1/+2
| | | | | | | Since endptr points to a location inside of dummy, dummy should be freed only after dereferencing endptr. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: use more restrictive search filter for group lookupSumit Bose2015-11-231-1/+3
| | | | | | | | | | | Since we are interested in looking up the SID of a group it makes sense to include the objectclass which contains the SID attribute in the search filter. This makes sure the group is not accidentally found a second time in the compat tree. Related to https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: fix wrong usage of talloc_new()Sumit Bose2015-11-231-1/+1
| | | | | | Fixes https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_kdb_tests: Fix test with default krb5.confLukas Slebodnik2015-11-181-0/+4
| | | | | | | Default krb5.conf needn't have defined default_realm. Unit tests should not rely on existing default value. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cmocka_tests: Do not use deprecated cmocka interfaceLukas Slebodnik2015-11-183-25/+36
| | | | | | | | The cmocka-1.0 introduced new interface for tests which is not compatible with the old one. And the old interface is deprecated which caused compiled warnings. Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-06 17:01:51 +0000