summaryrefslogtreecommitdiffstats
path: root/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
...
* NSS: add SSS_NSS_GETNAMEBYCERT requestSumit Bose2016-06-091-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Negcache in resp_ctx preparingPetr Cech2016-05-111-2/+4
| | | | | | Preparation for initialization of negative cache in common responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFIG: Use default config when none providedStephen Gallagher2016-05-111-1/+11
| | | | | | | | | | | | This patch makes SSSD possibly useful "out of the box" by allowing packagers to provide a default config file located in $LIBDIR/sssd/conf that will be copied by the monitor to /etc/sssd if no file already exists in that location. This will make it possible to have SSSD set up to have distribution-specific default configuration, such as enabling the proxy provider to cache /etc/passwd (such as in the provided example in this patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Removing duplication of mock_rctxPetr Cech2016-05-051-0/+1
| | | | | | There were duplicaton of mock_rctx(). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: move ndr_krb5pac check to the other Samba checksSumit Bose2016-04-211-3/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Test of sysdb_search_sudo_rulesPetr Cech2016-04-201-0/+16
| | | | | | | | | There are tests functions of sysdb_sudo_rules. Resolves: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAC: only save PAC blob into the cacheSumit Bose2016-04-131-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2158 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: process PAC during initgroups requestSumit Bose2016-04-131-0/+20
| | | | | | | | | If there is a recently attached PAC blob in the cached user entry the PAC data is used to update the group memberships data of the user. If there is no PAC attached or if it is too old the other configured methods will be used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: make some AD specific calls publicSumit Bose2016-04-131-0/+1
| | | | | | | Make sdap_ad_tokengroups_get_posix_members() and sdap_ad_resolve_sids_send() reusable. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CI: Use make check instead of make-check-wrapLukas Slebodnik2016-04-011-1/+0
| | | | | | | make-check-wrap had to be used due to missing LOG_COMPILER on rhel6 which is enabled with parallel test harness Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* UTIL: Move debug part from util.h -> new debug.hLukas Slebodnik2016-03-231-0/+1
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* mock domain: reset ldb errorsPavel Březina2016-03-141-1/+3
| | | | | | | | | | | | | | | | | | After ldb connect ldb context contains the following error: "NULL Base DN invalid for a base search" This comes from internal ldb function ldb_set_default_dns() which runs base search on NULL dn to discover records similar to what rootDSE provides. However, tdb backend considers this an error and sets the message above. This may break memory leak checks in tests when we do push/pop on test_ctx which is a indirect parent of ldb_context. The error message is allocated when push is called but it is freed by other ldb queries and therefore not preset during the push phase and thus the leak check fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Ensure we always build with C90Lukas Slebodnik2016-03-121-0/+5
| | | | | | | | | | | libipa_hbac is also used by external projects such as pam_hbac: https://github.com/jhrozek/pam_hbac In order to make sure we don't use C99 features in the libipa_hbac code in the future, this patch adds an explicit -std=c89 flag to CFLAGS. Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-121-7/+11
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-111-0/+1
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Remove unused include directoriesLukas Slebodnik2016-03-101-3/+1
| | | | | | | | We do not have the "include" directory in git and such directory is not generated by autotools in build directory either. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util: Move socket setup in a common utility fileSimo Sorce2016-03-091-0/+5
| | | | | | | | | | | | | Other components may need to connect sockets, the code here is generic enough that with minimal modifications can be used for non-ldap connections too. So create a sss_sockets.c/h utility file with all the non-ldap specific socket setup functions and make them available for other uses. Resolves: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST_TOOLS_COLONDB: Add tests for sss_colondb_*Petr Cech2016-02-241-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three functions at API of colondb wrapper: * sss_colondb_open() * sss_colondb_readline() * sss_colondb_writeline() This patch adds tests for all of them. We test those cases: * open nonexisting file for read * open nonexisting file for write * open existing empty file for read * open existing file with records for read * open existing empty file for write * open existing file with records for write * write to empty file * write to file with existing records * sss_colondb_open() * sss_colondb_readline() * sss_colondb_write_line() * write to empty file and read it Resolves: https://fedorahosted.org/sssd/ticket/2764 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Util: Improve code to get connection credentialsSimo Sorce2016-01-281-0/+2
| | | | | | | | | | Adds support to get SELINUX context and make code more abstract so that struct ucred (if availale) can be used w/o redefining uid,gid,pid to int32. Also gives a layer of indirection that may come handy if we want to improve the code further in the future. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* MAKE: Do not compile generated header filesPavel Březina2016-01-211-12/+11
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IDMAP: Add support for automatic adding of rangesPavel Reichl2016-01-201-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: add task to renew the machine account password if neededSumit Bose2016-01-191-0/+1
| | | | | | | | | | | | | | | | | | AD expects its clients to renew the machine account password on a regular basis, be default every 30 days. Even if a client does not renew the password it might not cause issues because AD does not enforce the renewal. But the password age might be used to identify unused machine accounts in large environments which might get disabled or deleted automatically. With this patch SSSD calls an external program to check the age of the machine account password and renew it if needed. Currently 'adcli' is used as external program which is able to renew the password since version 0.8.0. Resolves https://fedorahosted.org/sssd/ticket/1041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: Implement full refreshPavel Březina2016-01-191-1/+4
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement sudo handlerPavel Březina2016-01-191-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/XXXX Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: use ipa_get_rdn() in nested groupsPavel Březina2016-01-191-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: add ipa_get_rdn and ipa_check_rdnPavel Březina2016-01-191-0/+22
| | | | | | To exploit knowledge of IPA LDAP hierarchy. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: move code shared between ldap and ipa to separate modulePavel Březina2016-01-191-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-191-2/+0
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Add request that iterates over all search basesPavel Březina2016-01-191-0/+2
| | | | | | | | We often need to iterate over many search bases but we always use mostly copy&paste iterator. This will reduce code duplication and simplify code flow. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: convert periodical refreshes to be_ptaskPavel Březina2015-12-151-1/+1
| | | | | | | | | | | | | | | This removes old sudo timer and simplyfies code a lot. It also allows to manage offline/online state. - Full and smart refresh are disabled when offline. - Full refresh is run immediately when sssd is back online. - Smart refresh is scheduled normally when sssd is back online. Resolves: https://fedorahosted.org/sssd/ticket/1943 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Mark globals in krb5_opts.h as externPavel Březina2015-12-141-0/+5
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Mark globals in ipa_opts.h as externPavel Březina2015-12-141-0/+4
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Mark globals in ad_opts.h as externPavel Březina2015-12-141-0/+5
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Mark globals in ldap_opts.h as externPavel Březina2015-12-141-0/+5
| | | | | | To avoid collisions when we want to work with them elsewhere in the code. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Add autofs providerJakub Hrozek2015-11-261-0/+5
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1632 Adds the possibility to configure: autofs_provider = ad The AD autofs provider uses the rfc2307 (nis*) attribute maps. This is different (at the moment) from using autofs_provider=ldap with ldap_schema=ad. Reviewed-by: Ondrej Valousek <ondrejv2@fedoraproject.org> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* p11: enable ocsp checksSumit Bose2015-11-261-0/+2
| | | | | | | | | | | This patch enables the Online Certificate Status Protocol in NSS and adds an option to disable it if needed. To make further tuning of certificate verification more easy it is not an option on its own but an option to the new certificate_verification configuration option. Resolves https://fedorahosted.org/sssd/ticket/2812 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Only install polkit rules if the directory is availableJakub Hrozek2015-11-261-1/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* p11: allow p11_child to run completely unprivilegedSumit Bose2015-11-201-4/+4
| | | | | | | | | | | | | | | | To only operation of p11_child which requires special privileges is the communication to pcscd which handles the Smartcard access. pcscd uses policy-kit for access control so access can easily be configured by dropping config snippets into the right directory. If SSSD is configured to run as un-privileged user this patch creates the needed config snippet for policy-kit and installs it in a suitable directory. As a result p11_child does not have to be installed with SETUID or SETGID bits set. Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Remove sudo doxygen fileLukas Slebodnik2015-11-051-4/+0
| | | | | | There aren't any documented files in directory src/sss_client/sudo/ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Fix doc directory for sss_simpleifpLukas Slebodnik2015-11-041-1/+1
| | | | | | | | make all docs && make install DESTDIR=`pwd`/_instdir will not install doxygen generated files for sss_simpleifp because directory was wrong Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Run intgcheck without libsemanageMichal Židek2015-11-041-0/+1
| | | | | | | | | For now the libsemanage can not be used inside intgcheck tests. See the tracking ticket for this issue: https://fedorahosted.org/sssd/ticket/2859 Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Avoid symlinks with python modulesLukas Slebodnik2015-10-121-8/+8
| | | | | | | | | | | | | We need to use different names for python{2,3} modules if we want to build them in the same time with automake (prefix _py2 and _py3). But resulting name need to correspond with name of module because it is used in C import function. We used symbolic links for that purpose but it breaks debian python tools which rename the real modules making symbolic links to point nowhere Resolves: https://fedorahosted.org/sssd/ticket/2814 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Remove unused variable TEST_MOCK_OBJLukas Slebodnik2015-10-081-2/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Link crypto_tests with existing libraryLukas Slebodnik2015-10-081-5/+4
| | | | | | | It's not necessary to bundle libsss_crypto to crypto_tests. We can link it directly. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Link just libsss_crypto with crypto librariesLukas Slebodnik2015-10-081-3/+5
| | | | | | | | It should prevent such failures as in commit 73ec8fdfddb2d4bf99977f758eec80e1b1ee8542 BUILD: Link test_data_provider_be with -ldl Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Better libhbac debuggingPetr Cech2015-10-011-1/+1
| | | | | | | | | | | | | Added support for logging via external log function. Log provides information about rules evaluating (HBAC_DBG_INFO level) and additionally can describe rules (HBAC_DBG_TRACE level). Resolves: https://fedorahosted.org/sssd/ticket/2703 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Link test_data_provider_be with -ldlLukas Slebodnik2015-09-301-0/+1
| | | | | | | | | | | | | | | | | | The module data_provider_be.o uses uncfion dlsym and thus need to be linked with -ldl. /usr/bin/ld: src/providers/test_data_provider_be-data_provider_be.o: undefined reference to symbol 'dlsym@@GLIBC_2.2.5' /usr/lib64/libdl.so.2: error adding symbols: DSO missing from command line collect2: error: ld returned 1 exit status Makefile:10461: recipe for target 'test_data_provider_be' failed It was not a problem when sssd was compiled with NSS because it contains -ldl among its flags. NSS_LIBS='-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl ' However the compilation failed when sssd was compiled with libcrypto Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Remove unused variable SSSD_UTIL_OBJLukas Slebodnik2015-09-241-2/+0
| | | | | | | It was removed as part of commit fe2091327ff44f80d6681c261494e4432404e9ba Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Do not build libsss_ad_common.la as libraryLukas Slebodnik2015-09-241-18/+15
| | | | | | | | | | | | libsss_ad_common.la was a dynamic library and was linked just with unit tests. It was a workaroud because module libsss_ad.so cannot be linked with tests without portability issues. But it was addted to pkglib_LTLIBRARIES and therefore it was installed with other libraries. This patch changed it and libsss_ad_test.la (old name libsss_ad_common.la) will be compiled only for unit tests (check_LTLIBRARIES) and will not be installed with command "make install". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Remove unused variable CHECK_OBJLukas Slebodnik2015-09-241-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-06 20:52:52 +0000