freeipa.git/daemons/ipa-kdb, branch fix_ber_scanf

Implement user pre-authentication control with kdcpolicy plugin

2019-09-10T09:33:21+00:00

We created a Kerberos kdcpolicy plugin to enforce user
pre-authentication policy for newly added pkinit and hardened policy.

In the past version of freeIPA, password enforcement exists but was done
by removing key data for a principal while parsing LDAP entry for it.
This hack is also removed and is now also enforced by kdcpolicy plugin
instead.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Add a skeleton kdcpolicy plugin

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Extend the list of supported pre-auth mechanisms in IPA server API

2019-09-10T09:33:21+00:00

As new authentication indicators implemented, we also modified server
API to support those new values. Also, "krbprincipalauthind" attribute
is modified to use a pre-defined set of values instead of arbitrary
strings.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Fix NULL pointer dereference in maybe_require_preauth()

2019-09-05T18:53:55+00:00

ipadb_get_global_config() is permitted to return NULL.

Signed-off-by: Robbie Harwood 
Reviewed-By: Christian Heimes

Log INFO message when LDAP connection fails on startup

2019-09-05T18:53:55+00:00

Since krb5_klog_syslog() always needs parameters from syslog.h, move the
include into ipa_krb5.h.

Signed-off-by: Robbie Harwood 
Reviewed-By: Christian Heimes

kdb: support SMB services on IPA domain members

2019-06-29T08:00:28+00:00

SMB service on IPA domain member will have both ipaIDOjbect and ipaUser
object classes. Such service will have to be treated as a user in order
to issue MS-PAC record for it.

Fixes: https://pagure.io/freeipa/issue/3999
Signed-off-by: Alexander Bokovoy 
Reviewed-By: Rob Crittenden 
Reviewed-By: Christian Heimes

ipa-kdb: reduce LDAP operations timeout to 30 seconds

2018-11-16T21:54:38+00:00

Since LDAP operations used by ipa-kdb driver are synchronous, the
timeout specified here is blocking entire KDC. It is worth reducing the
timeout and since AS REQ processing timeout in KDC is 1 minute, reducing
the timeout for LDAP operations down to 30 seconds allows KDC to
respond promptly in worst case scenario as well.

Fixes: https://pagure.io/freeipa/issue/7217
Reviewed-By: Christian Heimes 
Reviewed-By: Robbie Harwood

ipadb_mspac_get_trusted_domains: NULL ptr deref

2018-11-01T12:56:31+00:00

Fix potential NULL pointer deref in ipadb_mspac_get_trusted_domains().
In theory, dn could be empty and rdn NULL. The man page for ldap_str2dn()
does not guarantee that it returns a non-empty result.

See: https://pagure.io/freeipa/issue/7738
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Don't abuse strncpy() length limitation

2018-10-24T14:11:55+00:00

On two occasions C code abused strncpy()'s length limitation to copy a
string of known length without the trailing NULL byte. Recent GCC is
raising the compiler warning:

  warning: ‘strncpy’ output truncated before terminating nul copying as
  many bytes from a string as its length [-Wstringop-truncation]

Use memcpy() instead if strncpy() to copy data of known size.

See: https://pagure.io/freeipa/issue/7738
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Fix ipadb_multires resource handling

2018-10-24T14:11:55+00:00

* ipadb_get_pwd_policy() initializes struct ipadb_multires *res to NULL.
* ipadb_multires_free() supports NULL as no-op.
* ipadb_multibase_search() consistently frees and NULLs
  struct ipadb_multires **res on error.

See: https://pagure.io/freeipa/issue/7738
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy