summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* PAM: add pam_sss option allow_missing_nameSumit Bose2016-06-092-4/+64
| | | | | | | | | With this option SSSD can be used with the gdm Smartcard feature. Resolves: https://fedorahosted.org/sssd/ticket/2941 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add OCSP default responder optionsSumit Bose2016-06-096-4/+242
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add no_verification optionSumit Bose2016-06-0910-45/+126
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add missing man page entry and config APISumit Bose2016-06-093-0/+30
| | | | | | | The pam_cert_auth and pam_cert_db_path option where missing in the config API and had no man page entries. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: use krb5_keytab for subdomain initializationSumit Bose2016-06-095-17/+26
| | | | | | | | | | During the initialization of AD subdomains parameters like the SASL auth id are determined. Since subdomains use a default set of the AD specific configuration options the default keytab will be used. If krb5_keytab is set in sssd.conf for the AD domain this keytab should be used for the subdomains (domains of the same AD forest) as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Fix error check in cache_req.cJakub Hrozek2016-06-091-1/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD_PROVIDER: Fix constant char *Petr Cech2016-06-071-1/+1
| | | | | | | | This patch fixes loading of ad_domain option. It is declared like const, co we should use dp_opt_get_cstring() instead of dp_opt_get_string(). Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient: wbcSidsToUnixIds() don't fail on errorsSumit Bose2016-06-071-8/+7
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3028 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* GPO: Add "polkit-1" to ad_gpo_map_allowStephen Gallagher2016-06-032-1/+8
| | | | | | | | | | | Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Try also the AD access control for IPA usersJakub Hrozek2016-06-031-0/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2927 If a user from an AD trusted domain is logging in, we should also check their AD lockout status. This helps cases where the user might have been disabled but is logging in with an SSH public key. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-318-93/+132
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* AD: Do not leak file descriptors during machine password renewalJakub Hrozek2016-05-311-13/+15
| | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3017 The AD renewal task was opening a pipe to write to the child process but never closed it, leaking the fd. This patch uses a desctructor we already use for pipes towards other child processes. Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_ulong()Fabiano Fidêncio2016-05-315-31/+44
| | | | | | | | | | | | | | | | | | | | | | As the add_ulong() convenience can add, replace or remove a unsigned long according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_ulong(), sysdb_replace_ulong() and sysdb_delete_ulong(). These new functions are basically wrappers of add_ulong() (now sysdb_ldb_msg_ulong_helper()), calling it using the proper flag according to each function. Any code previously using add_ulong() is now adapted to use these brand new functions. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_ulong() convenience to sysdb.cFabiano Fidêncio2016-05-312-13/+13
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_ulong() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: add sysdb_{add,replace,delete}_string()Fabiano Fidêncio2016-05-315-37/+51
| | | | | | | | | | | | | | | | | | | | | | As the add_string() convenience can add, replace or delete a string according to the operation received as its argument, some confusion can easily happen due to its misleading name. In order to improve the explicitness of our code, let's introduce sysdb_add_string(), sysdb_replace_string() and sysdb_delete_string(). These new functions are basically wrappers of add_string() (now sysdb_ldb_msg_string_helper()), calling it using the proper flag according to each function. Any code previously using add_string() is now adapted to use these brand new functions. Resolves: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* sysdb: move add_string() convenience to sysdb.cFabiano Fidêncio2016-05-312-13/+13
| | | | | | | | | | | | | | Considering that sysdb.c is about utilities around our cache and that sysdb_ops.c is about operations on objects, seems that add_string() could fit better in sysdb.c. This move is a suggestion from Jakub Hrozek. Related: https://fedorahosted.org/sssd/ticket/1656 Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Petr Cech <pcech@redhat.com>
* IPA: use forest name when looking up the Global CatalogSumit Bose2016-05-241-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3015 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Do not schedule the machine renewal task if adcli is not executableJakub Hrozek2016-05-191-0/+9
| | | | | | | | | | | Before scheduling the adcli renewal task, check if the renewal program (typically adcli) is accessible. If not, do dot schedule the renewal task at all. Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-199-96/+85
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: Fix warning maybe-uninitializedLukas Slebodnik2016-05-121-0/+1
| | | | | | | | | | src/tools/files.c: In function ‘copy_file_contents’: src/tools/files.c:413:12: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] return ret; ^~~ Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing of redudant functionPetr Cech2016-05-112-31/+0
| | | | | | | There is redudant function responder_get_neg_timeout_from_confdb(). This patch removes it. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from sudo_ctxPetr Cech2016-05-113-15/+3
| | | | | | This patch switches ncache from sudo_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from pam_ctxPetr Cech2016-05-114-21/+8
| | | | | | This patch switches ncache from pam_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from pac_ctxPetr Cech2016-05-113-14/+1
| | | | | | This patch switches ncache from pac_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from ifp_ctxPetr Cech2016-05-115-23/+13
| | | | | | This patch switches ncache from ifp_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing ncache from nss_ctxPetr Cech2016-05-117-72/+40
| | | | | | This patch switches ncache from nss_ctx to resp_ctx. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDERS: Negcache in resp_ctx preparingPetr Cech2016-05-116-13/+83
| | | | | | Preparation for initialization of negative cache in common responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from nss responderPetr Cech2016-05-117-13/+5
| | | | | | | | | | Timeout of negative cahce is handled by internal negative cache context. This patch removes neg_timeout from struct nss_ctx. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from ifp repsonderPetr Cech2016-05-113-16/+4
| | | | | | | | | | | Timeout of negative cache is handled by context of negative cache itself. This patch removes neg_timeout parameter from ifp_ctx and from ifp_user_get_attr_state. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from sudo resp.Petr Cech2016-05-112-10/+0
| | | | | | | | | | Timout of negative cache is handled by context of negative cache. So this parameter is not needed now. Resolves: https://fedorahosted.org/sssd/ticket/2137 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from pac_ctxPetr Cech2016-05-112-11/+0
| | | | | | | | | | It removes neg_timeout parameter from pac responder. Timeout is handled by internall structure of negative cache. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Removing neg_timeout from pam responderPetr Cech2016-05-1111-79/+32
| | | | | | | | | | | | It removes neg_timeout parameter from struct pam_ctx. Timeout is handled by context of negative cache internally. This patch additioanlly removes neg_timeout from struct cache_req_state. Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Adding getter for timeoutPetr Cech2016-05-112-0/+7
| | | | | | | | | | It adds new function to negative cache API: * int sss_ncache_get_timeout(struct sss_nc_ctx *ctx); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Removing timeout from sss_ncache_check_*Petr Cech2016-05-117-197/+154
| | | | | | | | | | | | | | | | It removes timeout parameter from check functions of negative cache. Timeout is set ny init function and it is handled internally. API change: * int sss_ncache_check_...(struct sss_nc_ctx *ctx, int ttl, <----- timeout vanished struct sss_domain_info *dom, ...); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Adding timeout to struct sss_nc_ctxPetr Cech2016-05-1113-14/+71
| | | | | | | | | | | | | | | | | | | It adds timeout of negative cache to handling struct sss_nc_ctx. There is one change in API of negatice cache: * int sss_ncache_init(TALLOC_CTX *memctx, uint32_t timeout, <----- new struct sss_nc_ctx **_ctx); There is also one new function in common/responder: * errno_t responder_get_neg_timeout_from_confdb(struct confdb_ctx *cdb, uint32_t *ncache_timeout); Resolves: https://fedorahosted.org/sssd/ticket/2317 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Failover to next server if authentication failsPavel Březina2016-05-111-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3010 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Inform about (un)successful connectionPavel Březina2016-05-111-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFIG: Use default config when none providedStephen Gallagher2016-05-116-5/+74
| | | | | | | | | | | | This patch makes SSSD possibly useful "out of the box" by allowing packagers to provide a default config file located in $LIBDIR/sssd/conf that will be copied by the monitor to /etc/sssd if no file already exists in that location. This will make it possible to have SSSD set up to have distribution-specific default configuration, such as enabling the proxy provider to cache /etc/passwd (such as in the provided example in this patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Internal: Rename CONFDB_DEFAULT_CONFIG_FILEStephen Gallagher2016-05-114-7/+7
| | | | | | | | New name is SSSD_CONFIG_FILE. This is done because we will start to ship a static default configuration in addition to the runtime configuration. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add secure copy functionStephen Gallagher2016-05-113-40/+159
| | | | | | | | | | | This is a precursor to supporting a static default configuration file. We need to be able to copy the default into the mutable location if the infopipe is asked to modify it. This patch opens both the source and destination files together in order to avoid time-of-check/time-of-use bugs. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Do not crash on invalid arguments to GetUserAttrJakub Hrozek2016-05-101-2/+2
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add ERR_SBUS_REQUEST_HANDLEDJakub Hrozek2016-05-103-0/+3
| | | | | | | | | | | In most cases when sbus request parsing finishes, the request is handled internally and a reply is sent to the caller. However, in handlers that are parsed and handled completely manually, we might want to be notified about this case so that the called of sbus_request_parse_or_finish() aborts the request and doesn't proceed with using the sbus request which is already freed internally in sbus_request_parse_or_finish(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Remove references to the obsolete PubkeyAgent ssh optionJakub Hrozek2016-05-101-14/+4
| | | | | | | The PubkeyAgent option is not supported for some time and references to it should be removed from our man pages. Reviewed-by: Jan Cholasta <jcholast@redhat.com>
* Make sdap_process_group_send() staticJakub Hrozek2016-05-091-8/+9
| | | | Reviewed-by: Petr Cech <pcech@redhat.com>
* GPO: Add "unity" to ad_gpo_map_interactiveStephen Gallagher2016-05-062-1/+7
| | | | | | | | | | | Ubuntu systems use "unity" as their screen-locker. Without this in the defaults, people often get locked out of their machines when the screen locks. Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TEST: Removing duplication of mock_rctxPetr Cech2016-05-052-28/+1
| | | | | | There were duplicaton of mock_rctx(). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AUTOFS: Removing of redudant debug messagePetr Cech2016-04-281-7/+1
| | | | | | | | | | Debug message has been doubled. At a low level, we have a very accurate debug messsage with description of situation (in confdb_get_int()). At higher level we informe about the fatal crash, if it happend. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Drop the reference to IPAv2 in the man pageJakub Hrozek2016-04-281-1/+1
| | | | | | | As suggested by Rob in https://fedorahosted.org/sssd/ticket/1907#comment:2 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Print port in sdap_print_serverLukas Slebodnik2016-04-271-3/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: terminate properly if view name lookup failsSumit Bose2016-04-221-7/+1
| | | | | | | | | | | Since commit 5a5f1e1053415efaa99bb4d5bc7ce7ac0a95b757 the view name lookup is the last step in the subdomain lookup request. In case of an error the request should be finished and no previous step should be called again. Resolves https://fedorahosted.org/sssd/ticket/2993 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 01:10:56 +0000