summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-otpd
Commit message (Collapse)AuthorAgeFilesLines
* Use RemoveOnStop to cleanup systemd socketsNathaniel McCallum2017-02-171-1/+1
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-241-15/+21
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: add missing KRB5_LIBS to daemons/ipa-otpdPetr Spacek2016-10-181-2/+2
| | | | | | | It was working accidentally because krb5 libs are part of OPENLDAP_LIBS. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move ipa-otpd to $libexecdir/ipaTimo Aaltonen2016-10-132-2/+3
| | | | | | This is more consistent with the other daemons. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle LDAP socket closures in ipa-otpdNathaniel McCallum2016-10-062-13/+10
| | | | | | | | | | | | | | In at least one case, when an LDAP socket closes, a read event is fired rather than an error event. Without this patch, ipa-otpd silently ignores this event and enters a state where all bind auths fail. To remedy this problem, we pass error events along the same path as read events. Should the actual read fail, we exit. https://bugzilla.redhat.com/show_bug.cgi?id=1377858 https://fedorahosted.org/freeipa/ticket/6368 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-291-4/+1
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Ensure that ipa-otpd bind auths validate an OTPNathaniel McCallum2016-05-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | Before this patch, if the user was configured for either OTP or password it was possible to do a 1FA authentication through ipa-otpd. Because this correctly respected the configuration, it is not a security error. However, once we begin to insert authentication indicators into the Kerberos tickets, we cannot allow 1FA authentications through this code path. Otherwise the ticket would contain a 2FA indicator when only 1FA was actually performed. To solve this problem, we have ipa-otpd send a critical control during the bind operation which informs the LDAP server that it *MUST* validate an OTP token for authentication to be successful. Next, we implement support for this control in the ipa-pwd-extop plugin. The end result is that the bind operation will always fail if the control is present and no OTP is validated. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Don't error when find_base() fails if a base is not requiredNathaniel McCallum2016-01-121-4/+5
| | | | | | | | | We always have to call find_base() in order to force libldap to open the socket. However, if no base is actually required then there is no reason to error out if find_base() fails. This condition can arise when anonymous binds are disabled. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.Stringio instead of StringIO.StringIOPetr Viktorin2015-10-071-2/+3
| | | | | | | | | The StringIO class was moved to the io module. (In Python 2, io.StringIO is available, but is Unicode-only.) Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move ipa-otpd socket directoryNathaniel McCallum2014-02-112-3/+3
| | | | | https://fedorahosted.org/freeipa/ticket/4167 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Use /usr/bin/python2Xiao-Long Chen2014-01-031-1/+1
| | | | | | | | | | | | Part of the effort to port FreeIPA to Arch Linux, where Python 3 is the default. FreeIPA hasn't been ported to Python 3, so the code must be modified to run /usr/bin/python2 https://fedorahosted.org/freeipa/ticket/3438 Updated by pviktori@redhat.com
* Remove CFLAGS duplication.Jan Cholasta2013-12-061-2/+2
| | | | https://fedorahosted.org/freeipa/ticket/3896
* Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file.Jan Cholasta2013-12-061-1/+1
| | | | | | Remove explicitly specified hardening flags from LDFLAGS in ipa-otpd. https://fedorahosted.org/freeipa/ticket/3896
* Use hardening flags for ipa-optd.Jan Cholasta2013-12-021-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/4010
* Add the krb5/FreeIPA RADIUS companion daemonNathaniel McCallum2013-05-1712-0/+1680
This daemon listens for RADIUS packets on a well known UNIX domain socket. When a packet is received, it queries LDAP to see if the user is configured for RADIUS authentication. If so, then the packet is forwarded to the 3rd party RADIUS server. Otherwise, a bind is attempted against the LDAP server. https://fedorahosted.org/freeipa/ticket/3366 http://freeipa.org/page/V3/OTP
generated by cgit (git 2.34.1) at 2025-09-02 04:26:47 +0000