sssd - System Security Services Daemon

Age	Commit message (Collapse)	Author	Files	Lines
2010-12-20	Fixes for automatic ticket renewal	Sumit Bose	4	-44/+100
	- do not recreate the ccache file when renewing the TGT - use user principal name as hash key instead of ccfile name - let krb5_child return Kerberos error codes
2010-12-20	Introduce sss_hash_create_ex()	Sumit Bose	2	-6/+29

2010-12-20	Avoid multiple initializations in LDAP provider	Sumit Bose	1	-39/+30
	Currently in a domain where LDAP was used for id and auth the LDAP UIR was added multiple times to the failover code which may cause unwanted delays.
2010-12-20	Add sysdb_has_enumerated and sysdb_set_enumerated helper functions	Stephen Gallagher	3	-0/+192
	Includes a unit test
2010-12-17	Start first enumeration immediately	Stephen Gallagher	3	-3/+47
	Previously, we would wait for ten seconds before starting an enumeration. However, this meant that on the first startup (before we had run our first enumeration) there was a ten-second window where clients would immediately get back a response with no entries instead of blocking until the enumeration completed. With this patch, SSSD will now run an enumeration immediately upon startup. Further startups will retain the ten-second delay so as not to slow down system bootups. https://fedorahosted.org/sssd/ticket/616
2010-12-17	Fix possible NULL-dereference in lookup_netgr_step()	Sumit Bose	1	-1/+1
	https://fedorahosted.org/sssd/ticket/735
2010-12-17	Fix unchecked return value in set_nonblocking	Stephen Gallagher	1	-10/+53
	Also fixes the same problem with set_close_on_exec https://fedorahosted.org/sssd/ticket/713
2010-12-17	Fix wrong test in pam_sss	Simo Sorce	1	-1/+1

2010-12-17	Fix unchecked return value in test_sysdb_attrs_to_list	Stephen Gallagher	1	-3/+6
	https://fedorahosted.org/sssd/ticket/714
2010-12-17	Fix uninitialized value error in set_local_and_remote_host_info	Stephen Gallagher	1	-1/+1
	https://fedorahosted.org/sssd/ticket/725
2010-12-17	Fix unsafe return condition in ipa_access_handler	Stephen Gallagher	1	-1/+6
	https://fedorahosted.org/sssd/ticket/718
2010-12-17	Fix unchecked return value in sss_krb5_verify_keytab_ex	Stephen Gallagher	1	-1/+8
	https://fedorahosted.org/sssd/ticket/711
2010-12-16	Fix segfault for PAM_TEXT_INFO conversations	Stephen Gallagher	1	-1/+1

2010-12-16	Fix invalid sizeof in pidfile	Stephen Gallagher	1	-1/+1
	https://fedorahosted.org/sssd/ticket/730
2010-12-15	Fix uninitialized value error in lookup_netgr_step()	Sumit Bose	1	-146/+181

2010-12-15	Fix memory leak of library handle in proxy	Sumit Bose	2	-18/+26
	https://fedorahosted.org/sssd/ticket/733
2010-12-15	Fix another possible memory leak in sss_nss_recv_rep()	Sumit Bose	1	-8/+19
	https://fedorahosted.org/sssd/ticket/723
2010-12-15	Fix possible memory leak in do_pam_conversation	Sumit Bose	1	-16/+28
	https://fedorahosted.org/sssd/ticket/731
2010-12-15	Fix uninitialized value error in main() in stress-tests.c	Sumit Bose	1	-0/+1
	https://fedorahosted.org/sssd/ticket/732
2010-12-14	Fix possible memory leak in sss_nss_recv_rep()	Sumit Bose	1	-8/+13
	https://fedorahosted.org/sssd/ticket/723
2010-12-14	Fix improper bit manipulation in pam_sss	Sumit Bose	1	-1/+1
	https://fedorahosted.org/sssd/ticket/715
2010-12-14	Fix uninitialized value error in setup_test in fail_over-tests.c	Sumit Bose	1	-0/+1
	https://fedorahosted.org/sssd/ticket/728
2010-12-14	Fix uninitialized value error in sdap_account_expired_shadow()	Sumit Bose	1	-2/+2
	https://fedorahosted.org/sssd/ticket/726
2010-12-14	Fix incorrect return value on failure in check_and_export_options()	Sumit Bose	1	-0/+1
	https://fedorahosted.org/sssd/ticket/722
2010-12-14	Fix incorrect return value on failure in resolve_get_domain_send()	Sumit Bose	1	-0/+1
	https://fedorahosted.org/sssd/ticket/721
2010-12-14	Fix improper NULL check in fo_add_srv_server()	Sumit Bose	1	-1/+2
	https://fedorahosted.org/sssd/ticket/717
2010-12-14	Remove unused newauthtok variable in LOCAL_pam_handler	Sumit Bose	1	-3/+0
	https://fedorahosted.org/sssd/ticket/716
2010-12-14	Fix unchecked return value in sdap_parse_entry()	Sumit Bose	1	-1/+5
	https://fedorahosted.org/sssd/ticket/712
2010-12-14	Fix unchecked return value in sdap_get_msg_dn()	Sumit Bose	1	-1/+6
	https://fedorahosted.org/sssd/ticket/712
2010-12-14	Prevent uninitialized value error in monitor_quit	Stephen Gallagher	1	-0/+1
	https://fedorahosted.org/sssd/ticket/724
2010-12-14	Add missing break statement to sss_hash_create	Stephen Gallagher	1	-0/+1
	https://fedorahosted.org/sssd/ticket/720
2010-12-14	Eliminate possible NULL-dereference in pam_check_user_search	Stephen Gallagher	1	-0/+7
	https://fedorahosted.org/sssd/ticket/719
2010-12-14	Reschedule the fd timeout for secondary lookups	Stephen Gallagher	1	-0/+4
	We were unscheduling the timeout handler after the first lookup (A or AAAA) returned, but not rescheduling it if we went on to check the secondary record type. This resulted in the resolver never returning a result for the secondary lookup, which can mean that logins/screen unlocks after VPN drop or suspend/resume might never complete. Fixes https://fedorahosted.org/sssd/ticket/729
2010-12-14	Fix timeouts for DNS resolver	Stephen Gallagher	1	-1/+1
	options.tries specifies the number of retries. Setting this to zero means to try exactly once. Previously we were always trying twice (internally). We want to simply honor the SSSD configuration and fail over to the next server (or go offline) after one try.
2010-12-13	Add group support to the simple access provider	Stephen Gallagher	5	-29/+262
	This patch adds simple_allow_groups and simple_deny_groups options to the simple access provider. It makes it possible to grant or deny access based on a user's group memberships within the domain. This patch makes one minor change to previous functionality: now all deny rules will supersede allow rules. Previously, if both simple_allow_users and simple_deny_users were set with the same value, the allow would win. https://fedorahosted.org/sssd/ticket/440
2010-12-08	Remove IPA_ACCESS_TIME define	Stephen Gallagher	1	-13/+11

2010-12-08	Bye, bye, ipa_timerules	Sumit Bose	4	-1845/+0
	It was decided that IPA HBAC will move to a different format to specify time ranges in access control rules. The evaluation based on the old format is not needed anymore.
2010-12-08	Remove check_access_time() from IPA access provider	Sumit Bose	2	-70/+0
	It is planned to release IPA 2.0 without time range specifications in the access control rules. To avoid confusion the evaluation is removed from sssd, too.
2010-12-08	Fix a typo in sssd-krb5 man page	Marko Myllynen	1	-1/+1

2010-12-08	Fix build issue with older Kerberos library	Sumit Bose	2	-2/+9

2010-12-07	Replace krb5_kdcip by krb5_server in LDAP provider	Sumit Bose	6	-14/+31

2010-12-07	Mark unavailable Kerberos server as PORT_NOT_WORKING	Sumit Bose	1	-0/+1

2010-12-07	ldap: Use USN entries if available.	Simo Sorce	10	-89/+193
	Otherwise fallback to the default modifyTimestamp indicator
2010-12-07	ldap: add checks to determine if USN features are available.	Simo Sorce	9	-25/+134

2010-12-07	ldap: remove variable that was never assigned nor used	Simo Sorce	2	-10/+0

2010-12-07	Pass sdap_id_ctx in sdap_id_op functions.	Simo Sorce	4	-50/+52

2010-12-07	Add support for FAST in krb5 provider	Sumit Bose	16	-20/+458

2010-12-07	Refactor krb5_child to make helpers more flexible	Sumit Bose	1	-20/+36

2010-12-06	Add ldap_chpass_uri config option	Sumit Bose	10	-9/+91

2010-12-06	Add new account expired rule to LDAP access provider	Sumit Bose	10	-93/+570
	Two new options are added to the LDAP access provider to allow a broader range of access control rules to be evaluated. 'ldap_access_order' makes it possible to run more than one rule. To keep compatibility with older versions the default is 'filter'. This patch adds a new rule 'expire'. 'ldap_account_expire_policy' specifies which LDAP attribute should be used to determine if an account is expired or not. Currently only 'shadow' is supported which evaluates the ldap_user_shadow_expire attribute.