summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* sysdb_get_user_attr: use fqn for subdomain usersPavel Březina2014-10-091-2/+11
| | | | | | | | Name of subdomain users is stored with domain part in the sysdb. We need to use fully qualified names for those user so we can look them up. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Build the sss_rpcidmapd man page conditionallyJakub Hrozek2014-10-091-1/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DP: Print a type as hexadecimal number in debug message.Lukas Slebodnik2014-10-091-1/+1
| | | | | | | | | | | | | | | | | | | | All request from nss responder, start in domain log with debug message in function be_get_account_info e.g. [be_get_account_info] (0x0100): Got request for [4099][1][name=user1] [be_get_account_info] (0x0100): Got request for [4098][1][name=group1] [be_get_account_info] (0x0100): Got request for [4097][1][name=user1] The 1st number is type, which is defined as hexadecimal nuber in header file src/providers/data_provider.h #define BE_REQ_USER 0x0001 #define BE_REQ_GROUP 0x0002 #define BE_REQ_INITGROUPS 0x0003 ... This patch changes formatting from decimal representation to hexadecimal; so you needn't convert it in head while analysing log files. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* BUILD: Use $(MKDIR_P) in Makefile.amJakub Hrozek2014-10-062-13/+20
| | | | | | | | | It was suggested by the Fedora automake maintainer to use the autoconf macro $(MKDIR_P) instead of calling "mkdir -p" directly as the macro is more portable and might actually expand to something else than "mkdir -p" on some platforms (usually it would be a variant of install.sh) Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: move sysdb_get_real_name() from sysdb.c to sysdb_search.cJakub Hrozek2014-10-064-53/+104
| | | | | | | | | | | The sysdb.c should be reserved for utility and setup functions. Search functions belong to sysdb_search.c Keeping functions in specialized modules helps to maintain nice dependencies and in overall makes unit testing easier. Moreover, the function was not unit tested, which needed fixing. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Make internal functions staticJakub Hrozek2014-10-062-16/+13
| | | | | | | Several functions in the monitor.c file were not marked as static even though they were only used inside monitor.c Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: remove unused talloc contextsLukas Slebodnik2014-10-031-11/+8
| | | | | | | Talloc context was not used in functions ad_gpo_parse_gpo_child_response ad_gpo_process_cse_recv, ad_gpo_store_policy_settings. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* GPO: Use argument ndg_flags instead of constantLukas Slebodnik2014-10-031-6/+6
| | | | | | | | | | | | Some internal gpo functions [1] were called just once and with constant NDR_SCALARS as 2nd argument(ndr_flags), but 2nd argument was not used in these functions[1]. They used constant NDR_SCALARS. [1] ndr_pull_security_ace_flags, ndr_pull_security_ace_type, ndr_pull_security_ace_object_flags, ndr_pull_security_acl_revision, ndr_pull_security_descriptor_revision, ndr_pull_security_descriptor_type Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD-GPO resolve conflicting policy settings correctlyYassir Elley2014-10-024-555/+743
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD GPO: Fix incorrect return of EACCESStephen Gallagher2014-10-021-2/+2
| | | | | | | | | | | | In the access providers, we expect to receive ERR_ACCESS_DENIED when access is denied, but we were returning EACCES here. The effect was the same, except that it presented ultimately as a system error instead of a proper denial. Related: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document the domains option of pam_sssJakub Hrozek2014-10-011-0/+27
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam: sub-domain authentication fixSumit Bose2014-10-011-1/+11
| | | | | | | | | | With a recent patch sysdb_getpwnam() was replaced by sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave differently with respect to sub-domain users. As a consequence the PAM responder was not able to resolve users from sub-domains. This patch reverts this change and uses sysdb_getpwnam() again. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* sssd.api.conf: Declare case_sensitive as stringMichal Zidek2014-10-011-1/+1
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2452 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: add support for new extdom plugin versionSumit Bose2014-09-301-87/+802
| | | | | | | | | | | | | | | | | | | Initially the extdom plugin was only used to translate SIDs of AD user and groups to names or POSIX IDs. On IPA clients group memberships were resolved with the help of the PAC in the Kerberos ticket which required that the user has logged in at least once. Home directory and the login shell were auto generated. The new version of the extdom plugin can return the complete list of group memberships of a user and the list of all members of a group. Additionally the gecos field, home directory and login shell are returned together with an optional list of key-value pairs for arbitrary data which is written unmodified to the cache. Fixes https://fedorahosted.org/sssd/ticket/2159 and https://fedorahosted.org/sssd/ticket/2041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-294-3/+79
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-299-3/+299
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Add a missing break statement to the GPO codeJakub Hrozek2014-09-291-1/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD GPO: Fix incorrect sAMAccountName selectionStephen Gallagher2014-09-291-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: make get_primary() a public callStephen Gallagher2014-09-292-3/+13
| | | | | | | This patch changes get_primary() into sss_krb5_get_primary() so it can be used by the AD provider to get the sAMAccountName from the hostname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-294-4/+4
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CI: Don't say Valgrind is ignored in README.mdNikolai Kondrashov2014-09-251-2/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: Add a unit test for matching the secondary objectclassJakub Hrozek2014-09-251-0/+37
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not change SSSD domains in get_domains_headStephen Gallagher2014-09-241-3/+0
| | | | | | | | | | When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain.
* CI: Use default config for mock buildLukas Slebodnik2014-09-221-6/+5
| | | | | | | | | | | | | | | The mock config with name default is usually symbolic link to the configuration file of local architecture. The side effect of this patch is that we will not try to rebuild on old architectures src.rpm for new architectures(fedora). It caused issues with mock tmpfs plugin. Resolves: https://fedorahosted.org/sssd/ticket/2441 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* CI: Remove disabling of Valgrind gdb invocationNikolai Kondrashov2014-09-221-1/+0
| | | | | | | | Remove --vgdb=no option from CI's Valgrind invocation, as default condition for starting gdb (--vgdb-error=999999999) is highly unlikely and therefore this option is unnecessary. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Enforce Valgrind checkNikolai Kondrashov2014-09-221-1/+1
| | | | | | Add check for Valgrind test result to contrib/ci/run. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Suppress all detected Valgrind issuesNikolai Kondrashov2014-09-221-0/+102
| | | | | | | | | | Add suppressions for all issues detected by Valgrind during CI runs. These seem to be false positives, or cannot be fixed. Resolves: https://fedorahosted.org/sssd/ticket/2428 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Add Valgrind suppression supportNikolai Kondrashov2014-09-223-3/+18
| | | | | | | | | | | | | | | | Add an empty Valgrind suppressions file, use it when invoking Valgrind. This prepares for addition of Valgrind suppressions for current false positives and issues that cannot be fixed, preparing for enforcing Valgrind check. Make Valgrind output a suppression for every error and make it output used suppression names and counts at the end of each run. This simplifies discovery and addition of new suppressions and removal of unused ones. Related to https://fedorahosted.org/sssd/ticket/2428 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Don't run dlopen-tests under ValgrindNikolai Kondrashov2014-09-221-1/+2
| | | | | | | | Disable running dlopen-tests under Valgrind as their use of dlclose makes Valgrind drop symbols and produce meaningless backtraces, which cannot be matched with specific suppressions. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Add a test for storing custom attrs with automatic IDJakub Hrozek2014-09-181-0/+51
| | | | Reviewed-by: Daniel Gollub <dgollub@brocade.com>
* MAN: AD is allowed value of subdomains_providerJakub Hrozek2014-09-181-0/+9
| | | | | | https://fedorahosted.org/sssd/ticket/2442 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* TESTS: Add a case-insensitive group search sysdb testJakub Hrozek2014-09-171-8/+25
| | | | | | | A recent fix enabled searching for groups by name in a case-insensitive domain. This patch adds a unit test to check that behaviour. Reviewed-by: Sumit Bose <sbose@redhat.com>
* sysdb: sysdb_search_group_by_name should work like sysdb_search_user_by_nameSumit Bose2014-09-171-43/+42
| | | | | | | | | | | | Currently sysdb_search_group_by_name uses an optimization which might fail in case-insensitive environments. The DN of the group object is generated with the help of the given name. Since the DN is case-sensitive a group lookup will fail if different cases are used. sysdb_search_user_by_name already handles case-insensitive searches well and sysdb_search_group_by_name should use the same scheme. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: Write additional attrs in sysdb_add_userDaniel Gollub2014-09-171-1/+2
| | | | | | | | In the uid=0 case (to obtain new free id) only uidNumber and gidNumber attributes got written, but not the additonal provided attributes like alias or others. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CI: Preserve mock config timestampsNikolai Kondrashov2014-09-161-1/+3
| | | | | | | Preserve timestamps of mock configuration files when customizing them in CI to avoid unnecessary cache rebuilds. This reduces CI run time. Reviewed-by: Michal Židek <mzidek@redhat.com>
* CI: Add missing debian dependencyLukas Slebodnik2014-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | make needn't be installed by default. $ contrib/ci/run install-deps: success 00:16:43 ci-install-deps.log autoreconf: success 00:00:12 ci-autoreconf.log DEBUG BUILD: ci-build-debug configure: success 00:00:13 ci-build-debug/ci-configure.log make-tests: failure 00:00:01 ci-build-debug/ci-make-tests.log FAILURE $ cat ci-build-debug/ci-make-tests.log Start: Mon Sep 8 09:31:43 CEST 2014 + make-check-wrap -j 4 check -- true /tmp/sssd/contrib/ci/make-check-wrap: line 52: make: command not found End: Mon Sep 8 09:31:44 CEST 2014 Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: Free retrieved sid in test_getsidbynameNikolai Kondrashov2014-09-161-1/+5
| | | | | | Free sid retrieved with sss_nss_getsidbyname in test_getsidbyname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free link paths in symlink testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | | Free malloc'd symlink paths in test_symlink and test_follow_symlink tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free compiled regexes in krb5_utils-testsNikolai Kondrashov2014-09-161-0/+2
| | | | | | Free compiled regular expressions after use in krb5_utils-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Free hbac_infoNikolai Kondrashov2014-09-161-9/+41
| | | | | | Free hbac_info structs after use in ipa_hbac-tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-09-161-3/+4
| | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* name2sid: Check negative cache for users and groupsSumit Bose2014-09-161-15/+19
| | | | | | | | | | | | Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-157-29/+117
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add alternative objectClass to group attribute mapsMichal Zidek2014-09-154-1/+7
| | | | | | | | | | | | | In IPA we sometimes need to use posixGroup and sometimes groupOfNames objectclass to query the groups. This patch adds the possibility to specify alternative objectclass in group maps. By default it is only set for IPA. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Always free talloc_reqJakub Hrozek2014-09-101-2/+1
| | | | | | | | On failure, the subreq wasn't freed, which was not a big deal given the parent request would free the subreq anyway, but it's better to follow the usual pattern. Reviewed-by: Simo Sorce <simo@redhat.com>
* Updating version for the 1.12.2 releaseJakub Hrozek2014-09-081-1/+1
|
* Updating translations for the 1.12.1 releaseJakub Hrozek2014-09-0837-18680/+31450
|
generated by cgit (git 2.34.1) at 2025-09-24 22:11:35 +0000