sssd.git/src/sss_client, branch certificate_mapping

pam_sss: Suppress warning format-truncation

2017-02-01T13:10:50+00:00

src/sss_client/pam_sss.c: In function ‘send_and_receive’:
src/sss_client/pam_sss.c:742:39: error: ‘%.*s’ directive output
  between 0 and 18446744073709551615 bytes may cause result to exceed
  ‘INT_MAX’ [-Werror=format-truncation=]
     ret = snprintf(user_msg, bufsize, "%s%s%.*s",
                                       ^~~~~~~~~~
sssd/src/sss_client/pam_sss.c:742:39: note: assuming directive output
  of 4294967295 bytes

Reviewed-by: Fabiano Fidêncio

libwbclient-sssd: wbcLookupSid() allow NULL arguments

2017-01-21T19:13:56+00:00

Some caller might not be interested in some of the values wbcLookupSid()
returns and just pass NULL. Currently 'net ads user info' does this
because it is not interested in the domain. wbcLookupSid() should handle
this gracefully.

Resolves:
https://fedorahosted.org/sssd/ticket/3273

Reviewed-by: Lukáš Slebodník

sss_client: Defer thread cancellation until completion of nss/pam operations

2016-11-24T11:12:46+00:00

The client code is not cancellation-safe, an application which
has cancelled an NSS operation will experience subtle bugs,
hence thread cancellation is deferred until completion of client
operations.

Resolves:
https://fedorahosted.org/sssd/ticket/3156

Reviewed-by: Sumit Bose 
Reviewed-by: Florian Weimer

libwbclient-sssd: update interface to version 0.13

2016-10-14T16:42:54+00:00

This patch adds wbcCtxUnixIdsToSids() and wbcUnixIdsToSids() to SSSD's
libwbclient and implements the latter.

Resolves:
https://fedorahosted.org/sssd/ticket/3181

Reviewed-by: Fabiano Fidêncio

Remove double semicolon at the end of line

2016-09-21T13:10:11+00:00

Reviewed-by: Pavel Březina

PAM: call free only when memory is expected to be allocated

2016-09-19T11:11:45+00:00

Reborted by Coverity

Reviewed-by: Lukáš Slebodník

pam_sss: check PKCS11_LOGIN_TOKEN_NAME

2016-09-16T13:05:17+00:00

Check if PKCS11_LOGIN_TOKEN_NAME is set and prompt the user if the
matching Smartcard is not inserted.

Related to https://fedorahosted.org/sssd/ticket/3165

Reviewed-by: Jakub Hrozek

PAM/KRB5: optional otp and password prompting

2016-07-07T10:39:36+00:00

Depending on the available Kerberos pre-authentication methods pam_sss
will prompt the user for a password, 2 authentication factors or both.

Resolves https://fedorahosted.org/sssd/ticket/2988

Reviewed-by: Nathaniel McCallum 
Reviewed-by: Lukáš Slebodník

SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user

2016-07-01T13:28:33+00:00

If an IPA client uses the SSH integration and a local user logs in with
SSH, the sss_ssh_authorizedkeys looks up their keys in the SSH
responder, which doesn't find the user and returns ENOENT. The
sss_ssh_authorizedkeys reports a failure on any error, including ENOENT
which produced a confusing error message in the logs.

This patch adds a new error code that handles users that are not found
by SSSD but exist on the system and also special cases root with the
same error code. Therefore, logging in as a local user no longer prints
an error message.

Resolves:
https://fedorahosted.org/sssd/ticket/3003

Reviewed-by: Pavel Březina

nss-idmap: add sss_nss_getnamebycert()

2016-06-09T14:12:25+00:00

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník