summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* TESTS: Amend sysdb_view tests for the FQDN schemaJakub Hrozek2016-07-071-49/+77
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Start converting the sysdb views tests to the fqname formatMichal Zidek2016-07-071-14/+35
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Fix sysdb tests to work with the new formatJakub Hrozek2016-07-071-767/+797
| | | | | | | | | | The sysdb tests now user the qualified name to store users and groups. To avoid the sysdb interface being tied too tightly to our specific format, all names are constructed using a function, not hardcoded. Just swapping the functions that create or parse the names for a different format should not make the test fail. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: First pass on converting the sysdb tests to the fqname formatMichal Zidek2016-07-071-97/+206
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Fix the ldap_id_cleanup test for using qualified names in sysdbMichal Zidek2016-07-071-6/+32
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Store SID members during AD initgroups with a qualified nameMichal Zidek2016-07-071-1/+6
| | | | | | | | This is to be consistent with how we name groups normally. We rename the groupnames when resolving the groups by ID anyway, but if we fail to do so, at least be consistent. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Save user and group aliases qualifiedMichal Zidek2016-07-075-8/+30
| | | | | | | When saving users or groups, qualify their names. Otherwise (currently netgroups), store a plain username. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Search functions don't need to construct per-domain namesJakub Hrozek2016-07-072-19/+4
| | | | | | | The names are all internally qualified already, no need to distinguish between subdomain users and main domain users. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: add_name_and_aliases_for_name_override no longer needs to special ↵Jakub Hrozek2016-07-071-40/+5
| | | | | | | | | | case subdomain users All user and group names use the same unified format in the cache, so there's no need to special-case subdomains and create different names for the main domain and a subdomain. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search functions don't need to construct per-domain namesMichal Zidek2016-07-071-30/+3
| | | | | | | All user and group names are standardized to be fully qualified, so there's no need to provide per-domain names anymore. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: convert sysdb_group_membership_mod to operate on qualified namesMichal Zidek2016-07-071-2/+22
| | | | | | | This patch infers the member domain from the FQDN to allow the function to add group members from different domains. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add a utility function sss_output_nameJakub Hrozek2016-07-073-0/+79
| | | | | | | | | | Adds a convenience function that will help reduce the amount of code duplication in the responders. All responders need to parse the username from the internal format, lower-case the name, if the domain is case-insensitive and then replace spaces if the responder is configured to do so. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add a utility function to create a list of qualified namesJakub Hrozek2016-07-073-0/+72
| | | | | | | Adds a convenience wrapper around sss_create_fqname that qualifies a list of names into the format used internally in sssd. Reviewed-by: Sumit Bose <sbose@redhat.com>
* TESTS: Add a test for sss_create_internal_fqnameJakub Hrozek2016-07-071-0/+29
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add function to create internal fqnameMichal Zidek2016-07-072-0/+31
| | | | | | | Add function to create internal fqname in format shortname@domname where domain portion is lowercased. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add a test for sss_parse_internal_fqnameJakub Hrozek2016-07-071-6/+69
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add function to parse internal fqname formatMichal Zidek2016-07-074-0/+64
| | | | | | | | Add lightweight function to parse internal fqname format (shortname@domain). This function does not require the sss_names to be initialized. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove misleading commentMichal Zidek2016-07-071-1/+0
| | | | | | | Function entry_has_objectclass is not used just for users. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA/AD: globally set krb5 canonicalization flagSumit Bose2016-07-065-11/+65
| | | | | | | | | | | If Kerberos principal canonicalization is configured in SSSD, currently it is the default for the IPA provider, a configuration snippet is generated for the system-wide libkrb5 configuration so that all kerberized applications will use canonicalization by default. Resolves https://fedorahosted.org/sssd/ticket/3041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add sss_write_krb5_snippet_common()Sumit Bose2016-07-061-23/+47
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* localauth: make plugin non-authoritative on failuresSumit Bose2016-07-061-1/+6
| | | | | | | | | | | | According to the documentation in localauth_plugin.h "aname will be considered authorized if at least one module returns 0 and all other modules return KRB5_PLUGIN_NO_HANDLE." So it is safe to always return KRB5_PLUGIN_NO_HANDLE because a different plugin has to return 0 to allow access to the given principal. Resolves https://fedorahosted.org/sssd/ticket/2788 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* localauth: remove enable_only sssd from config snippetSumit Bose2016-07-061-2/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2788 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Use ldb_result as output in sysdb_search_ts_{users,groups}Lukas Slebodnik2016-07-064-38/+53
| | | | | | | | | | | | | Passing address of unsigned to the output argument size_t causes access out of boundaries for type unsigned and and wrong data on big endian. It looks like functions sysdb_search_ts_{users,groups} need to store results in structure ldb_result anyway for further processing. Therefore it will be better to convert output arguments size_t* + ldb_message*** into structure ldb_result and avoid using additional helper variable with type size_t before each invocation of these functions. Reviewed-by: Sumit Bose <sbose@redhat.com>
* test_sysdb_ts_cache: Do not use wrong pointer for output argumentLukas Slebodnik2016-07-061-2/+5
| | | | | | | | | | | | | | | | | | The function sysdb_search_groups expects pointer to size_t as an output argument msgs_count. However, struct ldb_result has type unsigned for element count. The size of unsigned is lower then size of size_t on some platforms. Therefore we should not cast to pointer to size_t if we want to write count of messages into struct ldb_result -> count. The valgrind did not detect write out of boundary for the element count because it is the 1st element in structure ldb_result. It didn't cause any problem on little endian because the most significant part of size_t was properly stored to type unsigned. We firstly store to output argument _msgs_count and then to output argument _msgs in the function sysdb_cache_search_entry therefore element msgs was not damaged and contained correct data. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sssctl: remove also ccachePavel Březina2016-07-061-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: restart SSSD when removing cachePavel Březina2016-07-061-21/+40
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3066 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Change the default rfc2307 autofs attribute mappingsJakub Hrozek2016-07-063-11/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2858 The default attribute mappings we used to have: ldap_autofs_map_object_class automountMap ldap_autofs_map_name ou ldap_autofs_entry_object_class automount ldap_autofs_entry_key cn ldap_autofs_entry_value automountInformation Was wrong. Instead, this patch switches to: ldap_autofs_map_object_class nisMap ldap_autofs_map_name nisMapName ldap_autofs_entry_object_class nisObject ldap_autofs_entry_key cn ldap_autofs_entry_value nisMapEntry Which are attributes that are available with servers running the default rfc2307 schema. In addition, this patch adds a syslog and DEBUG message that warns administrators to double-check their configuration. We don't warn when the autofs provider is set to AD, because that one is already correct. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Remove leading spaces from elements programlistingLukas Slebodnik2016-07-052-7/+6
| | | | | | | | | | | | | | | | | | Docbook documentatin for the programlisting elemnt says: Description: A ProgramListing is a verbatim environment for program source or source fragment listings. ProgramListings are often placed in Examples or Figures so that they can be cross-referenced from the text. Processing Expectations: Formatted as a displayed block. This element is displayed "verbatim"; whitespace and linebreaks within this element are significant. ProgramListings are usually displayed in a fixed width font. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DOC: Fix few typos in doxygen commentsLukas Slebodnik2016-07-052-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | src/confdb/confdb.h:572: warning: argument 'memctx' of command @param is not found in the argument list of confdb_get_sub_sections(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, const char *section, char ***sections, int *num_sections) src/confdb/confdb.h:592: warning: The following parameters of confdb_get_sub_sections(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, const char *section, char ***sections, int *num_sections) are not documented: src/lib/idmap/sss_idmap.h:315: warning: argument 's_cv' of command @param is not found in the argument list of sss_idmap_add_auto_domain_ex(struct sss_idmap_ctx *ctx, const char *domain_name, const char *domain_sid, struct sss_idmap_range *range, const char *range_id, uint32_t rid, bool external_mapping, idmap_store_cb cb, void *pvt) src/lib/idmap/sss_idmap.h:94: warning: The following parameters of sss_idmap_add_auto_domain_ex(struct sss_idmap_ctx *ctx, const char *domain_name, const char *domain_sid, struct sss_idmap_range *range, const char *range_id, uint32_t rid, bool external_mapping, idmap_store_cb cb, void *pvt) are not documented: Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Fix uninitialized pointer read (UNINIT)Lukas Slebodnik2016-07-041-1/+1
| | | | | | | | | | | | | | | | We try to release sdap_handle in the function sdap_cli_connect_recv. Therefore we might try to release memory which does not belong to us due to uninitialized pointer. 2070 if (gsh) { 6. read_parm: Reading a parameter value. 2071 if (*gsh) { 2072 talloc_zfree(*gsh); 2073 } Found by Coverity Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* MAN: Update documentation of sss_cacheLukas Slebodnik2016-07-041-1/+1
| | | | | | | | | sss_cache -E can invalidate sudo rules since sssd 1.14 alpha. Related to: https://fedorahosted.org/sssd/ticket/2081 Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a ↵Jakub Hrozek2016-07-014-5/+26
| | | | | | | | | | | | | | | | | | | | local user If an IPA client uses the SSH integration and a local user logs in with SSH, the sss_ssh_authorizedkeys looks up their keys in the SSH responder, which doesn't find the user and returns ENOENT. The sss_ssh_authorizedkeys reports a failure on any error, including ENOENT which produced a confusing error message in the logs. This patch adds a new error code that handles users that are not found by SSSD but exist on the system and also special cases root with the same error code. Therefore, logging in as a local user no longer prints an error message. Resolves: https://fedorahosted.org/sssd/ticket/3003 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Fix warning sign-compareLukas Slebodnik2016-07-011-2/+3
| | | | | | | | | | | | | | | | | | | python3.5 CFLAGS contains warning Wsign-compare and file confdb_setup.c was added to SSSD_TOOLS_OBJ which is required for python3-sss (pysss.so) src/confdb/confdb_setup.c: In function 'confdb_purge': src/confdb/confdb_setup.c:95:15: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] for(i=0; i<res->count; i++) { ^ src/confdb/confdb_setup.c: In function 'confdb_init_db': src/confdb/confdb_setup.c:219:25: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] if (ret <= 0 || ret >= sizeof(timestr)) { ^ cc1: all warnings being treated as errors Reviewed-by: Michal Židek <mzidek@redhat.com>
* config: Fix filename matching regexMichal Židek2016-07-011-1/+1
| | | | | | | | Configuration file snippets must end with suffix .conf. We wrongly allowed any suffixes that begin with .conf (for example .conf.back). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Fix warning Wmissing-bracesLukas Slebodnik2016-07-011-1/+2
| | | | | | | | | | | | | | | | | | | Older versions of gcc does not like initialisation of struct sigevent because the first member of structure is union (sigval_t) src/util/util_watchdog.c: In function 'setup_watchdog': src/util/util_watchdog.c:77:12: warning: missing braces around initializer [-Wmissing-braces] struct sigevent sev = { 0 }; ^ src/util/util_watchdog.c:77:12: warning: (near initialization for 'sev.sigev_value') [-Wmissing-braces] src/util/util_watchdog.c:77:12: warning: initialization makes integer from pointer without a cast src/util/util_watchdog.c:77:12: warning: (near initialization for 'sev.sigev_value.sival_int') Reviewed-by: Sumit Bose <sbose@redhat.com>
* Secrets: Fix format stringLukas Slebodnik2016-07-011-1/+1
| | | | | | | | | | | | | | | body->length has type size_t and not long unsigned. size_t does not have the same size on 64 bit and 32 bit platform src/responder/secrets/providers.c: In function 'sec_http_reply_with_body': src/responder/secrets/providers.c:204:25: error: format '%lu' expects argument of type 'long unsigned int', but argument 6 has type 'size_t {aka unsigned int}' [-Werror=format=] "HTTP/1.1 %d %s\r\n" "Content-Type: %s\r\n" "Content-Length: %lu\r\n" ^ Reviewed-by: Sumit Bose <sbose@redhat.com>
* Updating the translations for the 1.14 beta releaseJakub Hrozek2016-06-2917-37/+1135
|
* MAN: Include idmap_sss.8.xml in the manpage sourcesJakub Hrozek2016-06-291-0/+1
| | | | Reviewed-by: N/A, one-liner before release
* Monitor: Add mode to generate confdb onlySimo Sorce2016-06-292-3/+22
| | | | | | | | | | With this mode we can add socket activated services and have systemd pre exec sssd to genrate the configuration file w/o starting the whole sssd if not necessary. https://fedorahosted.org/sssd/ticket/2243 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Secrets: Add local container entries supportSimo Sorce2016-06-291-7/+102
| | | | | | | | | | The protocol requires a user to creat a container efore trying to store an entry in it. Do the same in the local provider so that no surprises arise when admins route request to a remote storage server. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Local secrets provider Content-Type handlingSimo Sorce2016-06-293-8/+68
| | | | | | | | | | | | | Properly handle and enforce ithe presence of the content-type header in the local and proxy providers to conform to the Custoida protocol. Avoids different behavior between the local provider and a remote server that may cause developers to have an application working against the local storage and then fail when the administrator configures a remote storage. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Secrets: Add Proxy backendSimo Sorce2016-06-299-60/+1199
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Secrets: Add encryption at restSimo Sorce2016-06-2910-232/+1131
| | | | | | | Generates a master key file if it doesn't exist and encrypts secrets using the master key contained in the file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add initial providers infrastructure.Simo Sorce2016-06-295-59/+1058
| | | | | | | | | Also adds support for the basic LOCAL provider that stores data on the local machine. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Secrets: Add initial responder code for secrets serviceSimo Sorce2016-06-296-12/+754
| | | | | | | | | | | | | Start implementing the Secrets Service Reponder core. This commit implements stratup and basic conenction handling and HTTP parsing (using the http-parser library). Signed-off-by: Simo Sorce <simo@redhat.com> Related: https://fedorahosted.org/sssd/ticket/2913 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Fall back to non-strict http parser, if strict is not availableJakub Hrozek2016-06-291-1/+6
| | | | | | | | Some platforms (like Debian), don't ship http-parser-strict at all, but only the non-strict variant. Fall back to the non-strict library if the strict variant is not found. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Secrets: m4 macros for jansson and http-parserChristian Heimes2016-06-292-0/+30
| | | | | | | | | | Prepares autoconf for the new Secrets Provider dependencies Related: https://fedorahosted.org/sssd/ticket/2913 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Secrets: Add autoconf macros to build with secretsSimo Sorce2016-06-291-0/+42
| | | | | | | | | Prepares autoconf for the new Secrets Provider Related: https://fedorahosted.org/sssd/ticket/2913 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ConfDB: Add helper function to get "subsections"Simo Sorce2016-06-292-0/+118
| | | | | | | | | | | | | The secrets database will have "subsections", ie sections that are in the "secrets" namespace and look like this: [secrets/<path>] This function allows to source any section under secrets/ or under any arbitrary sub-path. Related: https://fedorahosted.org/sssd/ticket/2913 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Responders: Add support for socket activationSimo Sorce2016-06-293-2/+76
| | | | | | | | | | Add helper that uses systemd socket activation if available to accept a pre-listining socket at startup. Related: https://fedorahosted.org/sssd/ticket/2913 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-05 16:13:17 +0000