freeipa.git/daemons, branch fix_ber_scanf

extdom: use sss_nss_*_timeout calls

2019-09-12T07:48:13+00:00

Use nss calls with timeout in extdom plugin

Reviewed-By: Alexander Bokovoy

extdom: plugin doesn't use timeout in blocking call

2019-09-12T07:48:13+00:00

Expose nss timeout parameter. Use sss_nss_getorigbyname_timeout
instead of sss_nss_getorigbyname

Reviewed-By: Alexander Bokovoy

extdom: plugin doesn't allow @ in group name

2019-09-12T07:48:13+00:00

Old implementation handles username and group names with
one common call. Character @ is used in the call to detect UPN.

Group name can legaly contain this character and therefore the
common approach doesn't work in such case.

Also the original call is less efficient because it tries to resolv
username allways then it fallback to group resolution.

Here we implement two new separate calls for resolving users and
groups.

Fixes: https://bugzilla.redhat.com/1746951
Reviewed-By: Alexander Bokovoy

Implement user pre-authentication control with kdcpolicy plugin

2019-09-10T09:33:21+00:00

We created a Kerberos kdcpolicy plugin to enforce user
pre-authentication policy for newly added pkinit and hardened policy.

In the past version of freeIPA, password enforcement exists but was done
by removing key data for a principal while parsing LDAP entry for it.
This hack is also removed and is now also enforced by kdcpolicy plugin
instead.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Add a skeleton kdcpolicy plugin

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Extend the list of supported pre-auth mechanisms in IPA server API

2019-09-10T09:33:21+00:00

As new authentication indicators implemented, we also modified server
API to support those new values. Also, "krbprincipalauthind" attribute
is modified to use a pre-defined set of values instead of arbitrary
strings.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Fix NULL pointer dereference in maybe_require_preauth()

2019-09-05T18:53:55+00:00

ipadb_get_global_config() is permitted to return NULL.

Signed-off-by: Robbie Harwood 
Reviewed-By: Christian Heimes

Log INFO message when LDAP connection fails on startup

2019-09-05T18:53:55+00:00

Since krb5_klog_syslog() always needs parameters from syslog.h, move the
include into ipa_krb5.h.

Signed-off-by: Robbie Harwood 
Reviewed-By: Christian Heimes

ipa-extdom-extop: test timed out getgrgid_r

2019-08-19T08:20:57+00:00

Simulate getgrgid_r() timeout when packing list of groups user is a
member of in pack_ber_user().

Related: https://pagure.io/freeipa/issue/8044
Reviewed-By: Alexander Bokovoy

extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT

2019-08-19T08:20:57+00:00

A return code LDAP_NO_SUCH_OBJECT will tell SSSD on the IPA client to
remove the searched object from the cache. As a consequence
LDAP_NO_SUCH_OBJECT should only be returned if the object really does
not exists otherwise the data of existing objects might be removed form
the cache of the clients causing unexpected behaviour like
authentication errors.

Currently some code-paths use LDAP_NO_SUCH_OBJECT as default error code.
With this patch LDAP_NO_SUCH_OBJECT is only returned if the related
lookup functions return ENOENT. Timeout related error code will lead to
LDAP_TIMELIMIT_EXCEEDED and LDAP_OPERATIONS_ERROR is used as default
error code.

Fixes: https://pagure.io/freeipa/issue/8044
Reviewed-By: Alexander Bokovoy