summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-12-18sudo: do full refresh when data provider is back onlinePavel Březina2-7/+75
https://fedorahosted.org/sssd/ticket/1689 Add a online callback if the first full refresh fails due to the provider beeing offline so we can perform the refresh as soon as possible.
2012-12-18sudo: schedule another full refresh in short interval if the first failsPavel Březina2-0/+28
https://fedorahosted.org/sssd/ticket/1689 If the first full refresh of sudo rules fails because the data provider is offline, we will schedule another one in 2, 4, ... minutes.
2012-12-18check dp error in sdap_sudo_full_refresh_done()Pavel Březina1-3/+8
https://fedorahosted.org/sssd/ticket/1689
2012-12-18add sdap_sudo_schedule_refresh()Pavel Březina2-43/+77
Reduces amount of code duplication.
2012-12-18try primary server after retry_timeout + 1 seconds when switching to backupPavel Březina4-2/+14
https://fedorahosted.org/sssd/ticket/1679 The problem is when we are about to reset the server status, we don't get through the timeout (30 seconds) because the "switch to primary server" task is scheduled 30 seconds after fall back to a backup server. Thus the server status remains "not working" and is resetted after another 30 seconds. We need to make sure that the server status is tried after the timeout period. retry_timeout is currently hardcoded to 30, thus the change in man page.
2012-12-18RESOLV: Do not steal the resulting hostent on errorJakub Hrozek1-2/+3
https://fedorahosted.org/sssd/ticket/1706
2012-12-18Set cloexec flag for log filesJakub Hrozek1-0/+11
https://fedorahosted.org/sssd/ticket/1708 The services kept the fd to /var/log/sssd/sssd.log open. I don't think there's any point in keeping the logfiles open after exec-ing for the child, so I set the CLOEXEC flag.
2012-12-17MEMBEROF: silence compilation warningsJakub Hrozek1-15/+15
src/ldb_modules/memberof.c: In function ‘mbof_get_ghost_from_parent_cb’: src/ldb_modules/memberof.c:3085: warning: declaration of ‘dup’ shadows a global declaration /usr/include/unistd.h:528: warning: shadowed declaration is here src/ldb_modules/memberof.c: In function ‘mbof_inherited_mod’: src/ldb_modules/memberof.c:3253: warning: declaration of ‘dup’ shadows a global declaration /usr/include/unistd.h:528: warning: shadowed declaration is here src/ldb_modules/memberof.c: In function ‘mbof_fill_vals_array’: src/ldb_modules/memberof.c:3786: warning: declaration of ‘index’ shadows a global declaration /usr/include/string.h:489: warning: shadowed declaration is here
2012-12-17PROXY: fix groups cachingOndrej Kos1-0/+6
https://fedorahosted.org/sssd/ticket/1685 Properly react on deleting group which was not found in sysdb.
2012-12-15let ldap_chpass_uri failover work when using same hostnamePavel Březina1-11/+4
https://fedorahosted.org/sssd/ticket/1699 We want to continue with the next server on all errors, not only on ETIMEDOUT. This particullar ticket was dealing with ECONNREFUSED.
2012-12-14sssd_pam: Cleanup requests cache on sbus reconectSimo Sorce1-1/+4
The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
2012-12-14Allow mmap calls to gracefully return absent ctxSimo Sorce1-0/+25
This is to allow to freely call mc functions even if initialization failed. They will now gracefully fail instead of segfaulting.
2012-12-13MAN: Fix the title of sssd-sudoJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1710
2012-12-13sudo: support generalized time formatPavel Březina2-13/+34
https://fedorahosted.org/sssd/ticket/1712 The timestamp doesn't have to be in the form yyyymmddHHMMSSZ any more. It can be in any form of generalized time format.
2012-12-13tools: sss_userdel and groupdel remove entries from memory cacheMichal Zidek3-0/+55
https://fedorahosted.org/sssd/ticket/1659
2012-12-13sssd_nss: Remove entries from memory cache if not found in sysdbMichal Zidek1-0/+23
Functions nss_cmd_getXXnam remove entries from memory cache if not found in sysdb cache of a local domain.
2012-12-13sudo: include primary group in user group listPavel Březina1-1/+41
https://fedorahosted.org/sssd/ticket/1677
2012-12-13sysdb_get_sudo_user_info() initialize attrs on declarationPavel Březina1-4/+3
2012-12-13Add a macro to copy with barriersSimo Sorce1-17/+30
We have 2 places where we memcpy memory and need barriers protection. Use a macro so we can consolidate code in one place. Second fix for: https://fedorahosted.org/sssd/ticket/1694
2012-12-12SYSDB: More debugging during the conversion to ghost usersJakub Hrozek1-0/+9
We've been hitting situations where the sysdb conversion failed. Unfortunately, the current code doesn't include enough debugging info to pinpoint the failing entries. This patch adds more DEBUG statements for each processed entry.
2012-12-11sudo: don't get stuck in rules and smart refresh when offlinePavel Březina1-4/+14
https://fedorahosted.org/sssd/ticket/1682 The problem was in following code: if (ret != EOK || state->dp_error != DP_ERR_OK || state->error != EOK) { tevent_req_error(req, ret); return; } In situation when data provider error occurs (e.g. when offline), ret == EOK but dp_error != DP_ERR_OK and we take the true branch. This results in calling tevent_req_error(req, EOK). Unfortunately, with EOK tevent_req_error only returns false, but does not trigger callback and this tevent request hangs forever, because no tevent_req_done(req) is called.
2012-12-11NSS: Fix the error handler in sss_mc_create_fileJakub Hrozek1-10/+16
https://fedorahosted.org/sssd/ticket/1704 The function is short enough so that we can simply stick with return and release resources before returning as appropriate.
2012-12-11sudo manpage: clarify that sudoHost may contain wildcards and not regular ↵Pavel Březina2-2/+2
expression https://fedorahosted.org/sssd/ticket/1690
2012-12-10MEMBEROF: Fix copy-n-paste errorJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1703
2012-12-10LDAP: remove dead assignmentJakub Hrozek1-1/+0
2012-12-10SYSDB: Move misplaced assignmentJakub Hrozek1-2/+1
2012-12-10PAC: check the return value of diff_git_listsJakub Hrozek1-0/+4
2012-12-10let krb5_kpasswd failover workPavel Březina1-3/+7
https://fedorahosted.org/sssd/ticket/1680 There were two errors: 1. kr->kpasswd_srv was never set 2. bad service name (KERBEROS) was provided when setting port status, thus the port status never changed
2012-12-10SSH: Reject requests for authorized keys of rootJan Cholasta1-0/+5
https://fedorahosted.org/sssd/ticket/1687
2012-12-10PROXY: fix negative cacheOndrej Kos1-20/+24
https://fedorahosted.org/sssd/ticket/1685 The PROXY provider wasn't storing credentials to negative cache due to bad return value. This was delegated from attempt to delete these credentials from local cache. Therefore ENOENT is replaced as EOK.
2012-12-07Bump the version and reset release back to 0Jakub Hrozek2-2/+2
2012-12-07SUDO: strdup the input variableJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1701
2012-12-06sudo: print rule name if notBefore or notAfter attribute is missingPavel Březina1-1/+1
...and if sudo_timed = true. https://fedorahosted.org/sssd/ticket/1688 A comma was missing in attribute list. This caused concatenation of the two attributes so we requested one attribute called "objectClasscn". This doesn't affect functionality, only debug messages.
2012-12-05MAN: Move ssh_known_hosts_timeout documentation to the correct sectionJan Cholasta1-12/+12
2012-12-05Fix comment on wrong lineSimo Sorce1-1/+1
2012-12-05RESOLV: return ENOENT if the address list is emptyJakub Hrozek1-0/+8
2012-12-05MEMBEROF: Keep inherited ghost users around on modify operationJakub Hrozek2-34/+637
https://fedorahosted.org/sssd/ticket/1652 It is possible to simply reset the list of ghost users to a different one during a modify operation. It is also actually how we update entries that are expired in the SSSD cache. In this case, we must be careful and retain the ghost users that are not native to the group we are processing but are rather inherited from child groups. The intention of the replace operation after all is to set the list of direct members of that group, not direct and indirect.
2012-12-05MEMBEROF: Implement the modify operation for ghost usersJakub Hrozek2-36/+715
Similar to the add and delete operation, we also need to propagate the changes of the ghost user attribute to the parent groups so that if a nested group updates memberships, its parents also get the membership updated.
2012-12-05MEMBEROF: Split the add ghost operation into a separate functionJakub Hrozek1-17/+73
This new function will be reused by the modify operation later
2012-12-05MEMBEROF: Split the del ghost attribute op into a reusable functionJakub Hrozek1-12/+22
This new function is going to be reused by the modify operation
2012-12-05MEMBEROF: split processing the member modify into a separate functionJakub Hrozek1-47/+73
This will allow to process ghost users in a similar fashion
2012-12-05MEMBEROF: Implement delete operation for ghost usersJakub Hrozek2-7/+362
https://fedorahosted.org/sssd/ticket/1668 The memberof plugin did only expand the ghost users attribute to parents when adding a nested group, but didn't implement the reverse operation. This bug resulted in users being reported as group members even after the direct parent went away as the expanded ghost attributes were never removed from the parent entry. When a ghost entry is removed from a group, all its parent groups are expired from the cache by setting the expire timestamp to 1. Doing so would force the SSSD to re-read the group next time it is requested in order to make sure its members are really up-to-date.
2012-12-05LDAP: Continue adjusting group membership even if there is nothing to addJakub Hrozek1-2/+1
https://fedorahosted.org/sssd/ticket/1695
2012-12-05Add memory barrier to mmap cache client code loopSimo Sorce1-0/+3
Fixes https://fedorahosted.org/sssd/ticket/1694
2012-12-05Always append rctx as private dataSimo Sorce1-1/+1
This is used for the new calls back from the data provider.
2012-12-05Add backchannel NSS provider query on initgr callsSimo Sorce1-0/+165
This is needed in order to assure the memcache is properly and promptly cleaned up if a user memberships change on login. The list of the current groups for the user is sourced before it is updated and sent to the NSS provider to verify if it has changed after the update call has been made.
2012-12-05Hook for mmap cache update on initgroup callsSimo Sorce4-0/+148
This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
2012-12-05Hook to perform a mmap cache update from sssd_nssSimo Sorce4-0/+124
This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
2012-12-05mmap cache: public functions to invalidate recordsSimo Sorce2-0/+135
These functions can be called from the nss responder to invalidate records that have ceased to exist or that need to be refreshed the first time an application needs them.
2012-12-04link sss_ssh_authorizedkeys and sss_ssh_knownhostsproxy with -lpthreadTimo Aaltonen1-0/+2
There used to be an overlinked dependency that's gone now, so to fix a build error add CLIENT_LIBS to sss_ssh_knownhostsproxy_LDFLAGS. v2: Fix sss_ssh_authorizedkeys linking as well.
generated by cgit (git 2.34.1) at 2024-11-28 11:27:19 +0000