summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-slapi-plugins
Commit message (Collapse)AuthorAgeFilesLines
* extdom: use sss_nss_*_timeout callsTomas Halman2019-09-121-16/+24
| | | | | | Use nss calls with timeout in extdom plugin Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: plugin doesn't use timeout in blocking callTomas Halman2019-09-126-6/+32
| | | | | | | Expose nss timeout parameter. Use sss_nss_getorigbyname_timeout instead of sss_nss_getorigbyname Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: plugin doesn't allow @ in group nameTomas Halman2019-09-123-85/+197
| | | | | | | | | | | | | | | | | Old implementation handles username and group names with one common call. Character @ is used in the call to detect UPN. Group name can legaly contain this character and therefore the common approach doesn't work in such case. Also the original call is less efficient because it tries to resolv username allways then it fallback to group resolution. Here we implement two new separate calls for resolving users and groups. Fixes: https://bugzilla.redhat.com/1746951 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-extdom-extop: test timed out getgrgid_rAlexander Bokovoy2019-08-191-0/+29
| | | | | | | | Simulate getgrgid_r() timeout when packing list of groups user is a member of in pack_ber_user(). Related: https://pagure.io/freeipa/issue/8044 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: unify error code handling especially LDAP_NO_SUCH_OBJECTSumit Bose2019-08-193-22/+61
| | | | | | | | | | | | | | | | | | A return code LDAP_NO_SUCH_OBJECT will tell SSSD on the IPA client to remove the searched object from the cache. As a consequence LDAP_NO_SUCH_OBJECT should only be returned if the object really does not exists otherwise the data of existing objects might be removed form the cache of the clients causing unexpected behaviour like authentication errors. Currently some code-paths use LDAP_NO_SUCH_OBJECT as default error code. With this patch LDAP_NO_SUCH_OBJECT is only returned if the related lookup functions return ENOENT. Timeout related error code will lead to LDAP_TIMELIMIT_EXCEEDED and LDAP_OPERATIONS_ERROR is used as default error code. Fixes: https://pagure.io/freeipa/issue/8044 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-pwd-extop: do not remove MagicRegen mod, replace itAlexander Bokovoy2019-05-281-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | In 2012, ldbm backend in 389-ds started checking entry modification after running betxnpreop plugins by comparing a number of modifications before and after. If that number didn't change, it is considered that plugins didn't modify the list. ipa-pwd-extop actually removed and re-added modification to ipaNTHash if it contained 'MagicRegen' value. This did not work since commit https://pagure.io/389-ds-base/c/6c17ec56076d34540929acbcf2f3e65534060a43 but we were lucky nothing in FreeIPA code actually relied on that except some code paths in ipasam Samba passdb driver. However, Samba didn't reach the point where the code was triggered -- until now. With support to run Samba as a domain member in IPA domain, that code path is triggered for Kerberos service principals of domain members (cifs/client.example.test, ...) and NT hash extraction from Kerberos keys does not work. Fix ipa-pwd-extop to follow recommendations in https://pagure.io/389-ds-base/issue/387#comment-120145 and https://pagure.io/389-ds-base/issue/50369#comment-570696 Fixes: https://pagure.io/freeipa/issue/7953 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Keytab retrieval: allow requesting arcfour-hmac for SMB servicesAlexander Bokovoy2019-05-281-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | With system-wide crypto policy in use, arcfour-hmac encryption type might be removed from the list of permitted encryption types in the MIT Kerberos library. Applications aren't prevented to use the arcfour-hmac enctype if they operate on it directly. Since FreeIPA supported and default encryption types stored in LDAP, on the server side we don't directly use a set of permitted encryption types provided by the MIT Kerberos library. However, this set will be trimmed to disallow arcfour-hmac and other weaker types by default. While the arcfour-hmac key can be generated and retrieved, MIT Kerberos library will still not allow its use in Kerberos protocol if it is not on the list of permitted encryption types. We only need this workaround to allow setting up arcfour-hmac key for SMB services where arcfour-hmac key is used to validate communication between a domain member and its domain controller. Without this fix it will not be possible to request setting up a machine account credential from the domain member side. The latter is needed for Samba running on IPA client. Thus, extend filtering facilities in ipa-pwd-extop plugin to explicitly allow arcfour-hmac encryption type for SMB services (Kerberos principal name starts with cifs/). Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Coverity: fix issue in ipa_extdom_extop.cFlorence Blanc-Renaud2019-03-211-1/+1
| | | | | | | | | | | Coverity found the following issue: Error: BAD_COMPARE (CWE-697): [#def1] freeipa-4.6.5/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c:121: null_misuse: Comparing pointer "threadnumber" against "NULL" using anything besides "==" or "!=" is likely to be incorrect. The comparison is using the pointer while it should use the pointed value. Fixes: https://pagure.io/freeipa/issue/7884 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-extdom-exop: add instance counter and limitSumit Bose2019-03-142-0/+135
| | | | | | | | | | | | | | | | | | | | | The user and group lookups done by the extdom plugin might need some time depending on the state of the service (typically SSSD) handling the requests. To avoid that all worker threads are busy waiting on a connect or a reply from SSSD and no other request can be handled this patch adds an instance counter and an instance limit for the extdom plugin. By default the limit will be around 80% of the number of worker threads. It can be tuned further with the plugin option ipaExtdomMaxInstances which must in set in ipaextdommaxinstances and should have an integer value larger than 0 and lesser than the number of worker threads. If the instance limit is reached the extdom plugin will return LDAP_BUSY for every new request until the number of instance is again below the limit. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Compile IPA modules with C11 extensionsChristian Heimes2019-02-071-2/+2
| | | | | | | | | | | | | | | | | - define __STDC_WANT_LIB_EXT1__ to get C11 extensions like memset_s() for Samba's ZERO_STRUCT() macro, see https://en.cppreference.com/w/c/string/byte/memset - _DEFAULT_SOURCE enables features like htole16() from endian.h, see http://man7.org/linux/man-pages/man3/endian.3.html - _POSIX_C_SOURCE >= 200809 enables features like strndup() from string.h, see http://man7.org/linux/man-pages/man3/strndup.3.html - time_t is no longer implicitly defined, include time.h - typeof() is only available as GNU extension. Use explicit types instead of generic __typeof__(). Fixes: https://pagure.io/freeipa/issue/7858 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-sidgen: make internal fetch_attr helper really internalAlexander Bokovoy2018-12-141-3/+3
| | | | | | | | | | | | | | With 389-ds landing a change for https://pagure.io/389-ds-base/issue/49950, fetch_attr() helper function is exposed in slapi-plugin.h. However, in order to be able to build FreeIPA plugins against older 389-ds versions, prefer using a local variant of it. Rename fetch_attr() to ipa_sidgen_fetch_attr() so that it doesn't conflict at all. Fixes: https://pagure.io/freeipa/issue/7811 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipapwd_pre_mod: NULL ptr derefChristian Heimes2018-11-011-1/+1
| | | | | | | | | In ipapwd_pre_mod, check userpw for NULL before dereferencing its first element. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* has_krbprincipalkey: avoid double freeChristian Heimes2018-11-011-1/+5
| | | | | | | | Set keys to NULL after free rder to avoid potential double free. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't abuse strncpy() length limitationChristian Heimes2018-10-241-1/+1
| | | | | | | | | | | | | | | On two occasions C code abused strncpy()'s length limitation to copy a string of known length without the trailing NULL byte. Recent GCC is raising the compiler warning: warning: ‘strncpy’ output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation] Use memcpy() instead if strncpy() to copy data of known size. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ressource leak in ↵Thomas Woerner2018-10-231-0/+4
| | | | | | | | | | | daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_netlogon.c ipa_cldap_netlogon The leak happens due to using strndup in a for loop to create a temporary string without freeing it in all cases. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Move fips_enabled to a common library to share across different pluginsAlexander Bokovoy2018-08-131-23/+1
| | | | | Related: https://pagure.io/freeipa/issue/7659 Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* ipa-extdom-extop: Update licenses to GPLv3 or later with exceptionsAlexander Bokovoy2018-08-132-28/+58
| | | | | | | | The code in question was supposed to have the same license as the rest of the plugin. Fix it by updating the comment header. Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* In IPA 4.4 when updating userpassword with ldapmodify does not update ↵Thierry Bordaz2018-08-031-4/+0
| | | | | | | | | | | | | | | | | krbPasswordExpiration nor krbLastPwdChange When making ipa-pwd-extop TXN aware, some callbacks are call twice. Particularily ipapwd_pre_add is called during PRE_ADD and TXN_PRE_ADD ipapwd_pre_mod is called during PRE_MOD and TXN_PRE_MOD ipapwd_post_modadd is called during POST_ADD and TXN_POST_ADD ipapwd_post_modadd is called during POST_MOD and TXN_POST_MOD It is not the expected behavior and it results on some skipped updates krbPasswordExpiration and krbLastPwdChange https://pagure.io/freeipa/issue/7601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Cleanup shebang and executable bitChristian Heimes2018-07-051-0/+0
| | | | | | | | | | | | - Add missing executable bits to all scripts - Remove executable bits from all files that are not scripts, e.g. js, html, and Python libraries. - Remove Python shebang from all Python library files. It's frown upon to have executable library files in site-packages. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* Don't try to set Kerberos extradata when there is no principalRob Crittenden2018-05-271-1/+2
| | | | | | | | | This was causing ns-slapd to segfault in the password plugin. https://pagure.io/freeipa/issue/7561 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Hardening of topology plugin to prevent erronous deletion of a replica agreementThierry Bordaz2018-04-271-4/+8
| | | | | | | | | | | | When a segment is deleted, the underlying replica agreement is also deleted. An exception to this is if the status of the deleted segment is "obsolete" (i.e. merged segments) The status should contain only one value, but to be protected against potential bugs (like https://pagure.io/389-ds-base/issue/49619) this fix checks if "obsolete" is in the status values. https://pagure.io/freeipa/issue/7461 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Log errors from NSS during FIPS OTP key importRobbie Harwood2018-03-141-2/+14
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix OTP validation in FIPS modeNathaniel McCallum2018-03-121-2/+45
| | | | | | | | | | NSS doesn't allow keys to be loaded directly in FIPS mode. To work around this, we encrypt the input key using an ephemeral key and then unwrap the encrypted key. https://pagure.io/freeipa/issue/7168 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Silence GCC warning in ipa_extdomChristian Heimes2018-02-231-2/+2
| | | | | | | | | NSS_STATUS_RETURN is an internal value but GCC doesn't know that. ipa_extdom_common.c:103:5: warning: enumeration value ‘NSS_STATUS_RETURN’ not handled in switch [-Wswitch] Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* User must not be able to delete his last active otp tokenFlorence Blanc-Renaud2018-02-151-8/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 389-ds plugin for OTP last token is performing data initialization in its ipa_otp_lasttoken_init method, which is wrong according to the Plug-in Guide: > For example, the init function should not attempt to perform an > internal search or other internal operation, because the all of > the subsystems are not up and running during the init phase. This init method fills a structure containing the configuration of allowed authentication types. As the method is called too early, the method does not find any suffix and leaves the structure empty. Subsequent calls find an empty structure and take the default values (for authentication methods, the default is 1 = password). Because of that, the code consider that the global configuration defines password authentication method, and in this case it is allowed to delete a user's last otp token. The fix implements a SLAPI_PLUGIN_START_FN method that will be called when 389-ds is ready to initialize the plugin data, ensuring that the structure is properly initialized. Fixes: https://pagure.io/freeipa/issue/7012 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Alexey Slaykovsky <alexey@slaykovsky.com>
* ipa-extdom-extop: refactor nsswitch operationsAlexander Bokovoy2017-11-309-165/+983
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactor nsswitch operations in ipa-extdom-extop plugin to allow use of timeout-enabled nsswitch calls provided by libsss_nss_idmap. Standard POSIX nsswitch API has no way to cancel requests which may cause ipa-extdom-extop requests to hang far too long and potentially exhaust LDAP server workers. In addition, glibc nsswitch API iterates through all nsswitch modules one by one and with multiple parallel requests a lock up may happen in an unrelated nsswitch module like nss_files.so.2. A solution to the latter issue is to directly load nss_sss.so.2 plugin and utilize it. This, however, does not solve a problem with lack of cancellable API. With SSSD 1.16.1, libsss_nss_idmap provides a timeout-enabled variant of nsswitch API that is directly integrated with SSSD client side machinery used by nss_sss.so.2. As result, this API can be used instead of loading nss_sss.so.2 directly. To support older SSSD version, both direct loading of nss_sss.so.2 and new timeout-enabled API are supported by this changeset. An API to abstract both is designed to be a mix between internal glibc nsswitch API and external nsswitch API that libsss_nss_idmap mimics. API does not expose per-call timeout. Instead, it allows to set a timeout per nsswitch operation context to reduce requirements on information a caller has to maintain. A choice which API to use is made at configure time. In order to test the API, a cmocka test is updated to explicitly load nss_files.so.2 as a backend. Since use of nss_sss.so.2 would always depend on availablility of SSSD, predictable testing would not be possible without it otherwise. Also, cmocka test does not use nss_wrapper anymore because nss_wrapper overrides higher level glibc nsswitch API while we are loading an individual nsswitch module directly. As result, cmocka test overrides fopen() call used by nss_files.so.2 to load /etc/passwd and /etc/group. An overridden version changes paths to /etc/passwd and /etc/group to a local test_data/passwd and test_data/group. This way we can continue testing a backend API for ipa-extdom-extop with the same data as with nss_wrapper. Fixes https://pagure.io/freeipa/issue/5464 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* libotp: add libraries after objectsChristian Heimes2017-11-211-1/+1
| | | | | | | | | | | | Add dependency on external libraries after dependency on internal objects so the linker can correctly pick up all symbols. https://pagure.io/freeipa/issue/7189 Original patch by Rob Crittenden Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* 389-ds-base crashed as part of ipa-server-intall in ipa-uuidThierry Bordaz2017-11-081-3/+9
| | | | | | | | | | | | | | | | | | Bug Description: When adding an entry, ipa-uuid plugin may generate a unique value for some of its attribute. If the generated attribute is part of the RDN, the target DN is replaced on the fly and the previous one freed. Unfortunately, previous DN may be later used instead of the new one. Fix Description: Make sure to use only the current DN of the operation https://bugzilla.redhat.com/show_bug.cgi?id=1496226 https://pagure.io/freeipa/issue/7227 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_pwd_extop: do not generate NT hashes in FIPS modeSumit Bose2017-06-211-13/+40
| | | | | | | | | | | In FIPS mode NT hashes (aka md4) are not allowed. If FIPS more is detected we disable NT hashes even is the are allowed by IPA configuration. Resolves https://pagure.io/freeipa/issue/7026 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* fix minor spelling mistakesRené Genz2017-05-191-1/+1
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* extdom: improve cert requestSumit Bose2017-03-282-18/+142
| | | | | | | | | | | | | | | Certificates can be assigned to multiple user so the extdom plugin must use sss_nss_getlistbycert() instead of sss_nss_getnamebycert() and return a list of fully-qualified user names. Due to issues on the SSSD side the current version of lookups by certificates didn't work at all and the changes here won't break existing clients. Related to https://pagure.io/freeipa/issue/6826 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* extdom: do reverse search for domain separatorSumit Bose2017-03-281-3/+3
| | | | | | | | | To avoid issues which @-signs in the short user or group names it is better to search for the domain separator starting at the end of the fully-qualified name. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* slapi plugins: fix CFLAGSJan Cholasta2017-03-1516-12/+24
| | | | | | | | | | | | Add explicit NSPR_CFLAGS and NSS_CFLAGS where NSPR_LIBS and NSS_LIBS is used. Use DIRSRV_CFLAGS rather than hardcode -I/usr/include/dirsrv. Append NSPR_CFLAGS to DIRSRV_CFLAGS in ./configure as slapi-plugin.h includes nspr.h. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* IPA Allows Password Reuse with History value defined when admin resets the ↵Thierry Bordaz2016-11-241-9/+14
| | | | | | | | | | | password. When admin reset a user password, history of user passwords is preserved according to its policy. https://fedorahosted.org/freeipa/ticket/6402 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-1617-56/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/topology filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-winsync filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-sidgen filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-pwd-extop filesPetr Spacek2016-11-091-0/+2
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-otp-lasttoken filesPetr Spacek2016-11-091-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-otp-counter filesPetr Spacek2016-11-091-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-exdom-extop filesPetr Spacek2016-11-091-0/+2
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-cldap filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of ipa-slapi-plugins/common filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove non-existing README files from Makefile.amPetr Spacek2016-11-091-1/+0
| | | | | | | | | | | Some Makefile.am files were apparently created by copy-pasting other files. As a result, some Makefiles require non-existing README files. Remove this to fix dist target. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix Makefile.am files to separate source and build directoriesPetr Spacek2016-11-0916-40/+23
| | | | | | | | | | | | | This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: transform util directory to libutil convenience libraryPetr Spacek2016-10-242-5/+2
| | | | | | | | | | | | This is autoconf way of doing things. It should allow us to enable subdir-objects automake option and stay compatible with future versions of automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove traces of mozldap libraryPetr Spacek2016-10-181-1/+1
| | | | | | | | | | | | | | Mozldap is not used for some time now. We can remove all traces of it. AFAIK the complex logic for OpenLDAP detection should not be necessary and -lldap_r -llber options should suffice. Unfortunatelly OpenLDAP package does not ship package config files so we have to hardcode flags. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: modernize crypto library detectionPetr Spacek2016-10-181-2/+2
| | | | | | | | | | Use package config instead of checking headers. Package config is faster because it does not invoke compiler and guarantees proper linking flags because these are provided by package maintainer instead of hardcoded into build system. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-pwd-extop memory leak during passord updateThierry Bordaz2016-08-311-7/+17
| | | | | | | | During an extend op password update, there is a test if the user is changing the password is himself. It uses local Slapi_SDN variable that are not freed Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-10 19:17:56 +0000