summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* nested groups: do not fail if we get one entry twicePavel Březina2014-06-231-4/+6
| | | | | | https://fedorahosted.org/sssd/ticket/2341 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: cleanup redundant #define statementsPavel Reichl2014-06-184-17/+11
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2185 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Rename label in users_get_send/groups_get_sendPavel Reichl2014-06-181-32/+30
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2209 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Fix DEBUG messageJakub Hrozek2014-06-041-2/+2
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Unify usage of function gethostnameLukas Slebodnik2014-06-033-7/+8
| | | | | | | | | | | | man gethostanme says: NOTES SUSv2 guarantees that "Host names are limited to 255 bytes". POSIX.1-2001 guarantees that "Host names (not including the terminating null byte) are limited to HOST_NAME_MAX bytes". On Linux, HOST_NAME_MAX is defined with the value 64, which has been the limit since Linux 1.0 (earlier kernels imposed a limit of 8 bytes). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-022-0/+2
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-022-16/+24
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* SDAP: Add option to disable use of Token-GroupsPavel Reichl2014-06-025-2/+9
| | | | | | | | | | | Disabling use of Token-Groups is mandatory if expansion of nested groups is not desired (ldap_group_nesting_level = 0) for AD provider. Resolves: https://fedorahosted.org/sssd/ticket/2294 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Make nesting_level = 0 to ignore nested groupsPavel Reichl2014-06-021-7/+34
| | | | | | | | | | Make ldap_group_nesting_level = 0 to ignore group nesting entirely. Resolves: https://fedorahosted.org/sssd/ticket/2294 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: fix - find primary group by gidPavel Reichl2014-06-021-1/+0
| | | | | | | | | | Remove premature call of tevent_req_done() from sdap_get_initgr_done(). Request is correctly marked as done at sdap_get_initgr_pgid(). Resolves: https://fedorahosted.org/sssd/ticket/2334 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: Fix some failure modes in ad_gpo.cYassir Elley2014-05-301-9/+18
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* Don't use macro _XOPEN_SOURCE for function strptimeLukas Slebodnik2014-05-271-2/+2
| | | | | | | | | We detect all necessary feature macros in configure script using AC_USE_SYSTEM_EXTENSIONS or AC_GNU_SOURCE. This patch replaces all definitions of macro _XOPEN_SOURCE with header file config.h Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Implement org.freedesktop.DBus.Properties.GetAll for primitive typesJakub Hrozek2014-05-271-2/+56
| | | | | | | | | | | | This patch implements the GetAll method of the org.freedesktop.DBus.Properties interface by iterating over the available getters and putting all the results into a single getter. The patch includes a unit test that exercies all currently supported array types. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Don't use macro _XOPEN_SOURCE for extra featuresLukas Slebodnik2014-05-261-2/+2
| | | | | | | | | | | | | | We defined macro _XOPEN_SOURCE before time.h, because we need function strptime The problem is with undef after including header time.h The macro _XOPEN_SOURCE can be defined on some platforms and undef can cause problems. We detect all necessary feature macros in configure script using AC_USE_SYSTEM_EXTENSIONS or AC_GNU_SOURCE. It is better to include header file config.h instead of defining macro _XOPEN_SOURCE Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: Remove dependency on libsamba-securityYassir Elley2014-05-233-27/+585
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Initialize user_map_cnt in server modeJakub Hrozek2014-05-221-0/+1
| | | | | | | | | | | user_map_cnt was initialized when all the traditional back ends are initialized. However, for the server mode, we simply copy the defaults and the count was left zeroed, which led to crashes. Down the road, we should consider tying the map and the attribute count together (see ticket #2336) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ipa subdomains provider: make sure search by SID works for homedirAlexander Bokovoy2014-05-211-5/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Implemented LDAP component of GPO-based access controlYassir Elley2014-05-1313-45/+2652
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Do not remove non-root domains when looking up root domainJakub Hrozek2014-05-131-3/+22
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2322 When the AD subdomains code looked up the root domain subsequently (after the domain list was already populated), the non-root domains might have been removed along with their respective tasks, because the root domain lookup only ever matched a single root domain. This could cause havoc especially during login when different lookups for different domains might be going on during user group refresh. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Check the LDAP handle before using itJakub Hrozek2014-05-121-0/+13
| | | | | | | | | | As the connection code is async-driven, the LDAP handle might be invalidated before SSSD attempts to use it. Similar to commit 5fe6ca5e339fd345119752e996c14edf8db57660, this patch adds a NULL check for the LDAP handle and aborts the request instead of crashing. Resolves: https://fedorahosted.org/sssd/ticket/2305
* ipa_selinux: Put SELinux map order related variables into structureMichal Zidek2014-05-121-31/+37
| | | | | | | | | | | Small change to make the code more readable. The relation between order, order_array and order_count is more obvious when they are grouped in structure. resolves: https://fedorahosted.org/sssd/ticket/2304 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make LDAP extra attributes available to IPA and ADSumit Bose2014-05-025-48/+59
| | | | | | | https://fedorahosted.org/sssd/ticket/2073 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-0216-15/+212
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fix off-by-one bug in sdap_copy_optsJakub Hrozek2014-05-021-1/+4
| | | | | | | | The sdap_copy_opts function copied all the arguments except for the sentinel. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD Provider: bugfix use-after-freePavel Reichl2014-04-301-2/+7
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2322 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD Provider: bug-fix uninitialized variablePavel Reichl2014-04-301-1/+2
| | | | | | ad_subdomains_refresh() always set value to output parameter 'changes' if EOK is returned. Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Remove unused 'force' parameter from the subdomain handlerJakub Hrozek2014-04-221-6/+2
| | | | | | | | | | | | | The force argument was unused and made the code more complex than required. Moreover, the force argument would have made the subdomain handler behave differently than other identity domains -- when the front end decides it's time to update the domains, the back end should just update them. Handling multiple concurrent requests from multiple responders (typically after startup) is handled at the generic back end level (see be_queue_request). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sbus: Add type-safe DBus method handlers and finish functionsStef Walter2014-04-193-11/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Type safe method handlers allow methods not to have to do tedious unwrapping and wrapping of DBus method call messages or replies. Arguments of the following DBus types are supported in type-safe method handlers. In addition arrays of these are supported. y: uint8_t b: bool (but no arrays, yet) n: int16_t q: uint16_t i: int32_t u: uint32_t x: int64_t t: uint64_t d: double s: char * (utf8 string) o: char * (object path) As an exception, arrays of booleans are not supported, but could be added later. Other more complex types could be added later if desired. If a method has other argument types, then it must be marked as having a raw handler (see below). Internally each method can have a type specific invoker function which unpacks the incoming arguments and invokes the method handler with the correct arguments. Each method also has a finish which accepts the type-safe out arguments (ie: return values) and builds the reply message. Like other request 'finish' functions, these free the request talloc context, and are to be used in place of sbus_request_finish() or friends. Raw method handlers parse their own method arguments, and prepare their own reply (ideally using sbus_request_finish() helpers). They can also do strange things like have variable arguments. To mark a DBus method as having a raw method handler use the following annotation: <annotation name="org.freedesktop.sssd.RawHandler" value="true"/> Raw methods do not have invokers or finish functions. I've left all of the internal peer to peer communication using raw method handlers. No code changes here.
* KRB5: Go offline in case of generic errorPavel Reichl2014-04-171-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2313
* KRB: do not check ccache directory for GIDPavel Reichl2014-04-171-7/+4
|
* SDAP: augmented logging for group savingPavel Reichl2014-04-141-1/+21
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: Shorter retry time for failed SRVPavel Reichl2014-04-143-2/+17
| | | | | | | | | | | Until now there was only one timeout used to re-resolve SRV queries. This patch adds new (shorter) timeout that will be used for queries that previously failed. Resolves: https://fedorahosted.org/sssd/ticket/1885 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD Provider: Fix crash looking up forest on Samba 4Stephen Gallagher2014-04-101-1/+2
| | | | | | | | | | | We were assuming that the forest had been looked up by netlogon, but this is not available on Samba 4 domains. We need to check that the forest is NULL and force the lookup. Resolves: https://fedorahosted.org/sssd/ticket/2311 Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5_child: Fix use after free in debug messageLukas Slebodnik2014-04-082-11/+16
| | | | | | | | | | debug_prg_name is used in debug_fn and it was allocated under talloc context "kr". The variable "kr" was removed before the last debug messages in function main. It is very little change that it will be overridden. It is possible to see this issue with exported environment variable TALLOC_FREE_FILL=255 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Fix warning zero-length gnu_printf format stringLukas Slebodnik2014-04-071-1/+1
| | | | | | | There is a warning if nsupdate does not support realm. warning: zero-length gnu_printf format string [-Wformat-zero-length] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_child: Remove unused krb5_context from set_changepw_optionsLukas Slebodnik2014-04-071-4/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove dead code from ipa_get_selinux_recvMichal Zidek2014-04-071-38/+23
| | | | | | | | The 'else' branches in ipa_get_selinux_recv are never executed (and even if they were, the result would be the same as if the true branches were taken). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Possible null dereference in SELinux codeMichal Zidek2014-04-041-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AUTOFS: terminate array after the last entryLukas Slebodnik2014-04-041-1/+2
| | | | | | | | | | | | | | | | If LDAP entries have more then one attribute "automountKey" automount map will be skipped and error message will be printed to log files and sssd_be will crash. DEBUG(SSSDBG_MINOR_FAILURE, "Malformed entry, skipping\n"); The output array with automount maps will contain uninitialized pointers because array was terminated after the expected count of entries and not after the last successfully retrieved entry Resolves: https://fedorahosted.org/sssd/ticket/2288 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Re-add the InfoPipe serverJakub Hrozek2014-04-042-0/+3
| | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2072 This commit only adds the responder and the needed plumbing. No DBus related code is in yet.
* IPA: Fix SELinux mapping order memory hierarchyJakub Hrozek2014-04-031-8/+8
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2300 The list of SELinux mapping orders was allocated on tmp_ctx and parsed into an array. The array itself was correctly allocated on mem_ctx but its contents remained on tmp_ctx, leading to a use-after-free error. This patch fixes the memory hierarchy so that both the array and its contents are allocated on mem_ctx.
* AD: connect to forest root when downloading the list of subdomainsJakub Hrozek2014-04-021-9/+362
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2285 Only the forest root has the knowledge about all the domains in the forest, the forest leaves only see themselves and the forest root. This patch switches to connecting to the forest root for downloading the trusted domains instead of the server we are connected to. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Use function sysdb_attrs_get_el in safe wayLukas Slebodnik2014-03-311-10/+7
| | | | | | | | | | | | | | | | | | | | Function sysdb_attrs_get_el can enlarge array of ldb_message_element in "struct sysdb_attrs" if attribute is not among available attributes. Array will be enlarged with function talloc_realloc but realloc can move array to another place in memory therefore ldb_message_element should not be used after next call of function sysdb_attrs_get_el sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_USER, &user_found); sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_HOST, &host_found); With netgroups, it is common to omit user or host from netgroup triple. There is very high probability that realloc will be called. it is possible pointer user_found can refer to the old area after the second call of function sysdb_attrs_get_el. Resolves: https://fedorahosted.org/sssd/ticket/2284 Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-262-3/+30
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* krb5-child: add revert_changepw_options()Sumit Bose2014-03-211-0/+22
| | | | | | | | | | After changing the Kerberos password krb5-child will try to get a fresh TGT with the new password. This patch tries to make sure the right gic options are used. Resolves: https://fedorahosted.org/sssd/ticket/2289 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option()Sumit Bose2014-03-211-16/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5-child: extract lifetime settings into set_lifetime_options()Sumit Bose2014-03-211-36/+55
| | | | | | | | Additionally the lifetime option flags are unset if there are no explicit settings to make sure the defaults from krb5.conf are used even if other values were set manually in between. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_child: remove unused option lifetime_str from k5c_setup_fast()Sumit Bose2014-03-211-6/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: log message - wrong permissions on ccache dirPavel Reichl2014-03-181-2/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2037 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* refactor calls of sss_parse_namePavel Reichl2014-03-182-4/+2
| | | | | | | sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-30 09:43:34 +0000