freeipa.git/daemons/ipa-otpd, branch webui_isolate

Add main guards to a couple of Python scripts

2016-11-24T15:35:43+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti

Build: add missing KRB5_LIBS to daemons/ipa-otpd

2016-10-18T08:47:59+00:00

It was working accidentally because krb5 libs are part of OPENLDAP_LIBS.

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Move ipa-otpd to $libexecdir/ipa

2016-10-13T18:55:14+00:00

This is more consistent with the other daemons.

Reviewed-By: Martin Basti

Properly handle LDAP socket closures in ipa-otpd

2016-10-06T08:35:25+00:00

In at least one case, when an LDAP socket closes, a read event is fired
rather than an error event. Without this patch, ipa-otpd silently
ignores this event and enters a state where all bind auths fail.

To remedy this problem, we pass error events along the same path as read
events. Should the actual read fail, we exit.

https://bugzilla.redhat.com/show_bug.cgi?id=1377858
https://fedorahosted.org/freeipa/ticket/6368

Reviewed-By: Alexander Bokovoy

Migrate from #ifndef guards to #pragma once

2016-05-29T12:04:45+00:00

Using a pragma instead of guards is easier to write, less error prone
and avoids name clashes (a source of very subtle bugs). This pragma
is supported on almost all compilers, including all the compilers we
care about: https://en.wikipedia.org/wiki/Pragma_once#Portability.

This patch does not change the autogenerated files: asn1/asn1c/*.h.

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Ensure that ipa-otpd bind auths validate an OTP

2016-05-26T16:47:05+00:00

Before this patch, if the user was configured for either OTP or password
it was possible to do a 1FA authentication through ipa-otpd. Because this
correctly respected the configuration, it is not a security error.

However, once we begin to insert authentication indicators into the
Kerberos tickets, we cannot allow 1FA authentications through this
code path. Otherwise the ticket would contain a 2FA indicator when
only 1FA was actually performed.

To solve this problem, we have ipa-otpd send a critical control during
the bind operation which informs the LDAP server that it *MUST* validate
an OTP token for authentication to be successful. Next, we implement
support for this control in the ipa-pwd-extop plugin. The end result is
that the bind operation will always fail if the control is present and
no OTP is validated.

https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Sumit Bose

Don't error when find_base() fails if a base is not required

2016-01-12T11:28:44+00:00

We always have to call find_base() in order to force libldap to open
the socket. However, if no base is actually required then there is
no reason to error out if find_base() fails. This condition can arise
when anonymous binds are disabled.

Reviewed-By: Martin Basti

Use six.Stringio instead of StringIO.StringIO

2015-10-07T08:27:20+00:00

The StringIO class was moved to the io module.
(In Python 2, io.StringIO is available, but is Unicode-only.)

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

Move ipa-otpd socket directory

2014-02-11T16:36:19+00:00

https://fedorahosted.org/freeipa/ticket/4167
Reviewed-By: Martin Kosek

Use /usr/bin/python2

2014-01-03T08:46:05+00:00

Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com