summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Inherit ID limits of parent domains if setJakub Hrozek2013-10-241-3/+5
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2123 Previously, the subdomains were always unbound even if the administrator limited the ranges with min_id/max_id. This could have posed problems when running programs that scan the whole ID space, such as "groupadd -r".
* sdap_get_generic_ext_send: check if we a re still connectedSumit Bose2013-10-221-0/+7
| | | | | | | | | | | | | | At the beginning of a LDAP request we check if we are connecte and have a valid sdap handle. But for some requests more than one LDAP operation, typically a search, is needed. Due to the asynchronous handling of LDAP request it might be possible that a second request might detect a server error and close the connection while the first request just finished one LDAP search and wants to start a new LDAP search. This patch tries to make sure that there is a valid sdap handle before sending a LDAP search to the server. Fixes https://fedorahosted.org/sssd/ticket/2126
* IPA: add callback to reset subdomain timeoutsSumit Bose2013-10-221-0/+23
| | | | Fixes https://fedorahosted.org/sssd/ticket/2030
* Add unconditional online callbacksSumit Bose2013-10-224-0/+39
| | | | | | | | | Currently online callbacks are only executed if the backend was offline before. This patch add a new class of callback which are always called if the backend gets a request to go online. They can be used e.g. to reset timeouts until a more sophisticated method (OpenLMI, sssctl) is available.
* UTIL: Move sss_parse_name_for_domains declaration to util.hJakub Hrozek2013-10-222-5/+5
|
* Remove duplicate declarationJakub Hrozek2013-10-221-4/+0
|
* IPA: Do not enable IPA sites in server modeJakub Hrozek2013-10-221-17/+20
| | | | | When running in IPA server mode, the IPA sites should be ignored and the SSSD should only connect to the local server.
* Remove unused constantsJakub Hrozek2013-10-221-3/+0
|
* Include external headers with #include <foo.h>Jakub Hrozek2013-10-2221-50/+66
| | | | | | I find it more readable to include headers from outside the sssd tree with <foo.h>, not "foo.h". The latter should be used for in-tree headers only.
* IPA: Remove unused memory context.Lukas Slebodnik2013-10-221-3/+1
| | | | | Parameter mem_ctx was unused in static function get_password_migration_flag_recv
* krb5: Use right function to free data.Lukas Slebodnik2013-10-221-1/+2
| | | | | | | In function create_empty_cred, krb5_creds was aloocated using calloc, but krb5_free_creds was used to remove this creds in done section. Therefore clang static analyzer repoted this as warning: Potential leak of memory pointed to by 'cred'
* PROXY: Fix memory hierarchy when enumerating servicesJakub Hrozek2013-10-211-1/+7
|
* nss: wait for initial subdomains request to finishPavel Březina2013-10-171-0/+14
| | | | | | | | | | | | AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes. We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider. Resolves: https://fedorahosted.org/sssd/ticket/2092
* tests: Silence alignment warning in tests.Michal Zidek2013-10-171-5/+9
|
* sdap_async_sudo_hostinfo.c: Use check_ipvX_addrMichal Zidek2013-10-171-38/+24
|
* dyndns: Use check_ipvX_addr functionsMichal Zidek2013-10-171-45/+6
|
* util: Add functions to check if IP addresses is specialMichal Zidek2013-10-173-0/+194
| | | | | Added functions to check if given IP address is a special address (broadcast, multicast...).
* krb5: Remove warning dereference of a null pointerLukas Slebodnik2013-10-171-4/+2
| | | | | | | | | Variable kr->creds is initialized in function krb5_get_init_creds_password. It does not make sense to check kr->creds for null, because we have already checked return value of function krb5_get_init_creds_password. Resolves: https://fedorahosted.org/sssd/ticket/2112
* sdap_idmap: properly handle ranges for external mappingsSumit Bose2013-10-171-24/+44
| | | | | | | | | | | Currently we relied on the fact that external ID mapping is used as default fallback in case of an error and did not properly add subdomains with external ID mapping to the idmap library. If debugging is enabled this leads to irritating debug messages for every user or group lookup. With this patch this subdomains are added to the idmap library. Fixes https://fedorahosted.org/sssd/ticket/2105
* sdap_idmap: add sdap_idmap_get_configured_external_range()Sumit Bose2013-10-171-13/+36
|
* idmap: allow ranges with external mapping to overlapSumit Bose2013-10-172-5/+71
| | | | | | | | | | | If POSIX IDs are managed externally e.g. by AD it might be possible that the IDs are centrally manages for the whole forest. Hence there might not be a single ID range for each member domain in the forest but only a single ID range for the whole forest. This means that we have to allow collisions if ID ranges in this case. Unit tests are added to make sure that the collisions are only allowed for external mappings.
* idmap: fix a memory leak if a collision is detectedSumit Bose2013-10-171-6/+7
|
* idmap: add internal function to free a domain structSumit Bose2013-10-171-4/+15
|
* KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD userJakub Hrozek2013-10-172-0/+9
| | | | | | | If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack.
* dlopen-tests: Check the result of asprintfBenjamin Franzke2013-10-171-1/+2
| | | | | According to asprintf(3) the content off errmsg is undefined on error, lets set it to NULL.
* IPA server mode: properly initialize ext_groupsSumit Bose2013-10-161-1/+2
|
* LDAP: Set default value for dyndns update to falseLukas Slebodnik2013-10-151-1/+1
| | | | | | | | In some cases, local boolean variable "do_update" could be used without proper initialisation. Clang static analyser warning: "Assigned value is garbage or undefined" It was not a big problem, because non-zero value for boolean variable mean true.
* Add CIFS idmap pluginBenjamin Franzke2013-10-154-0/+373
| | | | https://fedorahosted.org/sssd/ticket/1534
* MAN: Fix refsect-idJakub Hrozek2013-10-115-5/+5
| | | | | | The refsect id was copied from sssd.conf(5) and was wrong. Fixing the refsect might help us if we ever generate other formats from XML and certainly wouldn't hurt.
* INI: Disable line-wrapping functionalityJakub Hrozek2013-10-111-1/+1
| | | | | | | Supporting the latest INI release brought an incompatible change. Lines beginning with a whitespace were treated as continuation of the previous line. This patch reverts to ignoring the whitespace as we did previously so that the existing configurations keep working.
* LDAP: handle SID requests if noexist_delete is setSumit Bose2013-10-101-0/+10
| | | | Fixes https://fedorahosted.org/sssd/ticket/2116
* krb5: fix warning may be used uninitializedLukas Slebodnik2013-10-101-0/+1
|
* MAN: Reflow debug_levels.xmlStephen Gallagher2013-10-071-13/+20
| | | | | | Many lines in debug_levels.xml violated our line-length conventsions. This patch provides no functional changes, it simply brings those lines into compliance.
* MAN: Clarify debug level documentationStephen Gallagher2013-10-071-6/+20
| | | | | | | Originally, we planned to deprecate the decimal values for the debug levels, but that has proven to be too difficult for most users to understand. Instead, we will document both the simple decimal and complex bitmask values and recommend the use of the decimal values.
* krb5: Fix unit testsJakub Hrozek2013-10-072-85/+46
|
* krb5: Remove ability to create public directoriesSimo Sorce2013-10-073-71/+37
| | | | | | | | | Setting up public directories is the job of the admin, and current sssd syntax can't express the actual intention of the admin with regrads to which parts of the path should be public or private. Resolves: https://fedorahosted.org/sssd/ticket/2071
* AD: properly intitialize GC from ad_server optionSumit Bose2013-10-041-1/+1
|
* SYSDB: Fix incorrect DEBUG messageStephen Gallagher2013-10-041-1/+1
| | | | | | | | A bad comparison resulted in the sysdb_sudo_check_time() function always printing a debug message saying that the time matched. Resolves: Coverity Issue #12031
* sudo: improve time restrictions debug messagesPavel Březina2013-10-012-0/+15
|
* sudo: allow specifying only one time restrictionPavel Březina2013-10-011-47/+34
| | | | https://fedorahosted.org/sssd/ticket/2100
* MAN: Document that POSIX attributes must be replicated to GCJakub Hrozek2013-09-271-0/+5
| | | | | | Currently the AD provider relies on the presence of the POSIX attributes in the Global Catalog. This patch mentiones the fact in the sssd-ad(5) manual page.
* AD: talk to GC first even for local domain objectsJakub Hrozek2013-09-272-7/+18
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 Since we are recommending to configure the POSIX attributes so that they are replicated to the Global Catalog, we can start connecting to the GC by default even for local users. If the object is not matches in the GC, there is a possibility to fall back to LDAP.
* LDAP: Allow searching subdomain during RFC2307bis initgroupsJakub Hrozek2013-09-271-9/+11
| | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 Until now, the POSIX-compliant initgroups would only be able to search the parent domain. Since we want to allow using POSIX attributes from AD subdomains as well, we should allow searching a custom sdap_domain.
* LDAP: Require ID numbers when ID mapping is offJakub Hrozek2013-09-272-7/+77
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 When searching for users and groups without the use of ID mapping, make sure the UIDs and GIDs are included in the search. This will make the SSSD seemigly "miss" entries when searching in Global Catalog in the scenario where the POSIX attributes are not replicated to the GC.
* KRB5: Use the correct domain when authenticating with cached passwordJakub Hrozek2013-09-271-4/+4
|
* KRB5: Return ERR_NETWORK_IO when trusted AD server can't be resolvedJakub Hrozek2013-09-271-0/+1
|
* Do not return DP_ERR_FATAL in case of successSumit Bose2013-09-271-1/+5
|
* ipa_server_mode: write capaths to krb5 include fileSumit Bose2013-09-274-4/+56
| | | | | | | | | | | | If there are member domains in a trusted forest which are DNS-wise not proper children of the forest root the IPA KDC needs some help to determine the right authentication path. In general this should be done internally by the IPA KDC but this works requires more effort than letting sssd write the needed data to the include file for krb5.conf. If this functionality is available for the IPA KDC this patch might be removed from the sssd tree. Fixes https://fedorahosted.org/sssd/ticket/2093
* IPA: store forest name for forest member domainsSumit Bose2013-09-278-16/+158
| | | | | In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
* IPA: Ignore dns_discovery_domain in server modeJakub Hrozek2013-09-261-0/+36
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2079 If the dns_discovery_domain is set in the server mode, then the current failover code will use it to discover the AD servers as well. This patch resets the discovery domain unless the admin configured SRV resolution for IPA servers manually. In the case he did, we try to warn him that service discovery of AD servers will most likely fail.
generated by cgit (git 2.34.1) at 2025-09-13 22:28:17 +0000