summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: add debug hintPavel Reichl2015-03-201-1/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: set EINVAL if dn can't be linearizedPavel Reichl2015-03-191-0/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: make sure output variable is setSumit Bose2015-03-191-1/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* selinux: Handle setup with empty default and no configured rulesJakub Hrozek2015-03-172-4/+10
| | | | | | | | | | SSSD also needs to handle the setup where no rules match the machine and the default has no MLS component. Related to: https://fedorahosted.org/sssd/ticket/2587 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA idviews: check if view name is setSumit Bose2015-03-171-1/+4
| | | | | | | | | | When working with older FreeIPA releases the view name might not always been set. This patch add checks to might sure it is only dereferenced when set. Resolves https://fedorahosted.org/sssd/ticket/2604 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* debug-tests: Fix test with new line in debug messageLukas Slebodnik2015-03-171-5/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-1746-104/+107
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP/AD: do not resolve group members during tokenGroups requestSumit Bose2015-03-179-18/+64
| | | | | | | | | | | | | | | | | | | | | | During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* responder_cache: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | | | There is a warning with gcc-5.0 and enabled optimization. Warning is not visible with "-O0". CC src/responder/common/responder_cache_req.o src/responder/common/responder_cache_req.c: In function ‘cache_req_next_domain’: src/responder/common/responder_cache_req.c:296:160: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] src/responder/common/responder_cache_req.c:277:13: note: ‘ret’ was declared here errno_t ret; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa_selinux: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | src/providers/ipa/ipa_selinux.c: In function 'ipa_selinux_handler_done': src/providers/ipa/ipa_selinux.c:927:16: error: 'sci' may be used uninitialized in this function [-Werror=maybe-uninitialized] state->sci = sci; ^ src/providers/ipa/ipa_selinux.c:333:33: note: 'sci' was declared here struct selinux_child_input *sci; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: make sure extdom expo data is availableSumit Bose2015-03-131-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa: do not treat missing sub-domain users as errorSumit Bose2015-03-131-3/+7
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2444 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_initgr_check_timeout: add debug outputSumit Bose2015-03-131-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use the logon_name as the key for the PAM initgr cacheSumit Bose2015-03-131-13/+3
| | | | | | | | | | | | | Currently the name member of the pam_data struct is used as a key but it can change during a request. Especially for sub-domain users the name is changed from the short to the fully-qualified version before the cache entry is created. As a result the cache searches are always done with the short name while the entry was written with the fully-qualified name. The logon_name member of the pam_data struct contains the name which was send by the PAM client and is never changed during the request. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: return ERR_INTERNAL if more than one entry is foundPavel Březina2015-03-131-1/+1
| | | | | | | This means that the db is not in the expected format thus we should make the error more visible. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: parse input name if neededPavel Březina2015-03-134-27/+288
| | | | | | | | The input name is now parse automatically by cache_req if none particullar domain is specified. The parsed named is returned from _recv as an output parameter. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cmocka: include mock_parse_inp in header filePavel Březina2015-03-131-0/+2
| | | | | | | This is a non static function that is supposed to be used in tests but it was missing from header file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by idPavel Březina2015-03-133-1/+420
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove default branch from switchesPavel Březina2015-03-131-20/+4
| | | | | | | | | | | | Originaly, the cache_req used enum sss_dp_acct_type to indicate request type but not all types were implemented. Thus we used default branch to indicate unimplemented request type. Now when we switched to a custom enum type we can get rid of the default branch so the compiler can check if all switches contains all values. This proved to be useful during development of new request types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by namePavel Březina2015-03-133-1/+398
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for user by uidPavel Březina2015-03-134-11/+485
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: preparations for different input typePavel Březina2015-03-133-100/+310
| | | | | | | | | Currently cache_req takes only user name as an input parameter. However, this is not enough since we will need also UID and GID in the future. This patch creates a structure to hold input parameters so it can be simply extended to support other input types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: define user name constantPavel Březina2015-03-131-11/+14
| | | | | | | Using a constant here is better since the name is shared between the test function and testing _done function. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: rename test_user to test_user_by_namePavel Březina2015-03-131-25/+25
| | | | | | | This is done in order to distinguish those tests from other user tests that are about to come. For example: test_user_by_id. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus_codegen: Port to python3Lukas Slebodnik2015-03-131-8/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2017 Reviewed-by: Petr Viktorin <pviktori@redhat.com>
* test: Check ERR_LASTMichal Zidek2015-03-133-1/+12
| | | | | | Check if number of error codes and messages is the same. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Add missing strings for error messagesMichal Zidek2015-03-132-1/+4
| | | | | | | | We had more error codes than corresponding messages. Also order of two messages was wrong. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: libkrb5 and SSSD use different expansionsPavel Reichl2015-03-131-0/+9
| | | | | | | | | | Users often wrongly use SSSD expansions in libkrb5 expansion template for principals. State explicitly it won't work. Resolves: https://fedorahosted.org/sssd/ticket/2528 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add unit tests for initgroupsJakub Hrozek2015-03-121-0/+346
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Handle ENOENT when doing initgroups by UPNJakub Hrozek2015-03-121-18/+28
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: Add a getpwnam-by-UPN testJakub Hrozek2015-03-121-0/+97
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: ncache_hit must be an int to test UPNsJakub Hrozek2015-03-121-9/+9
| | | | | | | | In order to detect faulty cases where negcache would be checked twice, we need to convert the ncache_hit to integer and check exact amounts of hits. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* tests: convert all unit tests to cmocka 1.0 or laterJakub Hrozek2015-03-1135-663/+769
| | | | | | All tests now use the cmocka-1.0-compatible API. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RPM: BuildRequire libcmocka >= 1.0Jakub Hrozek2015-03-111-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Only run cmocka tests if cmocka 1.0 or newer is availableJakub Hrozek2015-03-111-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: default_domain_suffix with use_fully_qualified_names.Michal Zidek2015-03-111-2/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2569 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Use FQDN if default domain was setMichal Zidek2015-03-113-4/+35
| | | | | | https://fedorahosted.org/sssd/ticket/2569 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ldap_child: fix coverity warningPavel Reichl2015-03-111-2/+12
| | | | | | | In ldap_child_get_tgt_sync() variable 'ret' got overriden in done section without ever before being read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Log reason in debug message why ldb_modify failedLukas Slebodnik2015-03-118-10/+68
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: More debugging for create_ccache()Jakub Hrozek2015-03-101-13/+41
| | | | | | | | It was difficult to find where the problem was without advanced techniques like strace. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAC: Fix memory leakLukas Slebodnik2015-03-091-0/+1
| | | | | | Reported by clang static analyser. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: use sysdb_user/group_dnPavel Březina2015-03-094-38/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: get rid of callback pointersPavel Březina2015-03-091-67/+31
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support groupsPavel Březina2015-03-085-0/+63
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: support usersPavel Březina2015-03-085-0/+62
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2346 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: add sdap_refresh_initPavel Březina2015-03-085-30/+33
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refactor netgroups refreshPavel Březina2015-03-081-32/+77
| | | | | | | This is a preparation to support other object types without introducing duplicated code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_handle_acct_req_send: remove be_reqPavel Březina2015-03-084-17/+13
| | | | | | | | | | | be_req was used only as a talloc context for subreq. This memory context was replace by state of the parent request which is more suitable for tevent coding style. This change will allow us to use this function in be_refresh where none be_req is available. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_refresh: refresh all domains in backendPavel Březina2015-03-084-37/+66
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: fix minor neglect in is_account_locked()Pavel Reichl2015-03-061-0/+2
| | | | | | | | | | It would be better to return explicit error code, although access is still denied and error message printed. Relates: https://fedorahosted.org/sssd/ticket/2534 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-06 05:52:38 +0000