summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-08-19proxy: Alocate auth tokens in struct authtok_convLukas Slebodnik1-0/+20
Struct sss_auth_token became opaque in commit 9acfb09f7969a69f58bd45c856b01700541853ca. All ocasions of "struct sss_auth_token" was replaced with pointer to this struct, but proper initialization of auth_tokens was missing in struct authtok_conv. Resolves: https://fedorahosted.org/sssd/ticket/2046
2013-08-11mmap_cache: Check if slot and name_ptr are not invalid.Michal Zidek5-2/+73
This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
2013-08-11ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2-0/+30
Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
2013-08-09AD: Cast SASL callbacks to propper typeOndrej Kos1-1/+3
The initialization of ad_sasl_callbacks raised an incompatible pointer type warning. This was caused because the cyrus-sasl API hasa changed. The callback function list needs to be cast now.
2013-08-09Remove unused constantJakub Hrozek1-2/+0
2013-08-09Use the correct resolv timeoutJakub Hrozek1-1/+1
2013-08-08Enable removing nonexisting dn in sdap_handle_account_infoLukas Slebodnik1-1/+1
Change was introduced in commit ca344fde
2013-08-08PAM: Set negcache if user is not found after provider checkJakub Hrozek1-0/+10
2013-08-08PAM: Check negcache when searching for fully qualified users, tooJakub Hrozek1-0/+8
2013-08-08NSS: Clear cached netgroups if a request comes in from the sss_cacheLukas Slebodnik4-0/+55
In order for sss_cache to work correctly, we must also signal the nss responder to invalidate the hash table requests. https://fedorahosted.org/sssd/ticket/1759
2013-08-08NSS: allow removing entries from netgroup hash tableLukas Slebodnik3-1/+32
There is a timed desctructor in the nss responder that, when the entry timeout passes, removes the netgroup from the hash table while the netgroup is freed. This patch adds a hash delete callback so that if the netgroup is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
2013-08-08Fix memory context for hash entriesSumit Bose1-2/+4
In sdap_nested_group_populate_users() username and orignal_dn are allocated on a temporary memory context. If the corresponding user is not found in the cache both are added to a hash which is later on returned to the caller. To avoid a use-after-free when the hash entries are looked up both must be reassigned to the memory context of the hash.
2013-08-07add simple access provider init testPavel Březina2-0/+99
2013-08-07simple access provider: allow fully qualified namesPavel Březina1-46/+95
https://fedorahosted.org/sssd/ticket/2026
2013-08-07Fix memory context for a state memberSumit Bose1-1/+1
primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
2013-08-07Add script make_srpm.sh to dist tarball.Lukas Slebodnik1-0/+1
2013-08-06sssd_ad: Add hackish workaround for sasl ad_compatSimo Sorce1-0/+41
This tries to set the ad_compat option for sasl, by working around the openldap/sasl initialization as openldap does not allow us to pass down to sasl our own getopt callback. Resolves: https://fedorahosted.org/sssd/ticket/2040
2013-08-06Add a commit templateSimo Sorce1-0/+9
Explanation: In order to use a common style when creating commits a commit template will be helpful espcially to new developers. The commit template can be activated with the following command: git config commit.template .git-commit-template When this is done any new commit will use the template as the default commit message.
2013-08-05sudo: print better debug message when a rule has multiple cn valuesPavel Březina1-1/+5
2013-08-05sudo: skip rule on error instead of failing completelyPavel Březina1-1/+3
https://fedorahosted.org/sssd/ticket/2031
2013-08-05SSH: Ensure that cmd_ctx->name will not be NULL.Lukas Slebodnik1-4/+6
If cmd_ctx->name was not initialized by sss_parse_name then copy of name will be used. https://fedorahosted.org/sssd/ticket/1970 Coverity ID: 11647
2013-07-31Fix netgroup lookup when using fully qualified namePavel Březina1-2/+2
2013-07-29Netgroups should ignore the 'use_fully_qualified_names' settingStephen Gallagher2-8/+13
Netgroups often have memberNisNetgroup entries included in them that will never process correctly if we require fully-qualified names on the nested lookup. This patch alters the behavior of netgroup lookups to check *all* domains for an unqualified netgroup name, instead of only the ones not requiring fully- qualified names. https://fedorahosted.org/sssd/ticket/2013
2013-07-29Remove unused memory contextLukas Slebodnik1-6/+6
2013-07-29Use GID if subdomain is not MPGJakub Hrozek1-1/+8
https://fedorahosted.org/sssd/ticket/2032 In non-MPG subdomains (such as those that manage their IDs manually with POSIX attributes), we need to set the GID ourself.
2013-07-29Clarify that getnamebysid currently works only with ipa/ad id_providerOndrej Kos1-1/+3
https://fedorahosted.org/sssd/ticket/2035
2013-07-25resolv-tests failing with memory leakMichal Zidek1-2/+4
Wait for c-ares to finish before checking for memory leaks. https://fedorahosted.org/sssd/ticket/1899
2013-07-25Prevent using uninitialized "group_name" in done section.Lukas Slebodnik1-1/+1
Coverity ID: 11927
2013-07-25Fix two minor typosYuri Chornoivan2-2/+2
2013-07-24Bumping the version for the 1.11 beta3 releaseJakub Hrozek1-1/+1
2013-07-24Updating translations for the 1.11 beta2 releaseJakub Hrozek36-3928/+4584
2013-07-24Every time release allocated memory in function py_sss_getgrouplistLukas Slebodnik1-0/+2
Coverity: 11922
2013-07-24Lower timeout to contact DNS serverMichal Zidek1-1/+1
c-ares timeout to wait for response from DNS server before moving to next DNS server is lowered from 5s to 2s. Partially solves https://fedorahosted.org/sssd/ticket/1966
2013-07-24Set default DNS resolution timeout to 6 seconds.Michal Zidek2-3/+3
Partially solves ticket: https://fedorahosted.org/sssd/ticket/1966 To avoid the problem mentioned in the ticket above, option dns_discovery_domain must be set properly.
2013-07-24LDAP: Use domain-specific name where appropriateJakub Hrozek5-112/+159
The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
2013-07-23Fix possible dereference of a NULL pointer.Lukas Slebodnik1-1/+1
We check if function ipa_get_ad_id_ctx returns NULL, but function ipa_get_ad_id_ctx could never return NULL. This issue was found by scan-build.
2013-07-23pysss: prevent crashing when group is unresolvableAlexander Bokovoy1-2/+13
In unlikely case that an NSS module returns a reference to a group and we are unable to resolve it shortly after that, make sure these groups are skipped.
2013-07-23Remove unused constant.Michal Zidek1-2/+0
2013-07-23KRB5: Do not send PAC in server modeJakub Hrozek5-7/+27
The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
2013-07-22SUDO: realloc with sizeof(uint32_t) when adding uint32_tJakub Hrozek1-1/+1
2013-07-22pysss: add pysss.getgrouplist(username)Alexander Bokovoy1-0/+59
getgrouplist(3) call is missing from Python older than Python 3.3 Introduce supplementary binding to provide getgrouplist as part of pysss interface. Since getgrouplist() can be run against any domain, place it at top module rather than pysss.local namespace. pysss.getgrouplist(username) -> tuple(group list as strings)
2013-07-22build: fix dependencies for pysss moduleAlexander Bokovoy1-0/+1
https://fedorahosted.org/sssd/ticket/2025
2013-07-22Fix autotols warnings: macro xyz not found in libraryLukas Slebodnik1-4/+2
2013-07-22Fix warnings: uninitialized variableLukas Slebodnik4-6/+5
2013-07-22Remove unused memory context from function unpack_authtokLukas Slebodnik1-3/+3
2013-07-19Fix the default FQDN formatJakub Hrozek2-3/+3
Commit 52ae806bd17c3c00d70bd1aed437f10f5ae51a1c changed the default FQDN format by accident to the one we only ever user internally. This commit fixes the mistake.
2013-07-19TOOLS: Update all services with sss_debuglevelOndrej Kos1-2/+7
https://fedorahosted.org/sssd/ticket/2007 PAC, SSH, SUDO and AUTOFS services' debug levels weren't modified when sss_debuglevel tool was used.
2013-07-19AD: Set the bool value same as default value in optsJakub Hrozek3-4/+74
https://fedorahosted.org/sssd/ticket/2023 When the option values are copied using dp_opt_copy_map, the .val member is used if it's not NULL. At the same time, the bool options are never NULL, unlike integers or strings that can have special NULL-like values such as NULL_STRING. This effectively means that when copying a bool option, the .val member is always used. But in the AD maps, some .val fields were set differently from the .def_val fields. The effect was that when the AD subdomain provider was initialized from IPA subdomain provider using only the defaults, some options (notably referral chasing) were set to a value that didn't make sense for the AD provider. This patch makes sure that for all boolean option, the .val is always the same as .def_val.
2013-07-19IPA: warn if full_name_format is customized in server modeJakub Hrozek3-1/+20
https://fedorahosted.org/sssd/ticket/2009 If the IPA server mode is on and the SSSD is running on the IPA server, then the server's extdom plugin calls getpwnam_r to read info about trusted users from the AD server and return them to the clients that called the extended operation. The SSSD returns the subdomain users fully-qualified, ie "user@domain" by default. The format of the fully qualified name is configurable. However, the extdom plugin returns the user name without the domain component. With this patch, when ipa_server_mode is on, warn if the full_name_format is set to a non-default value. That would prompt the admin to change the format if he changed it to something exotic.
2013-07-19Add mising argument required by format stringLukas Slebodnik2-3/+4
generated by cgit (git 2.34.1) at 2024-11-16 09:59:35 +0000