| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
- allow unspecified value in struct pam_data to be NULL
- check if domain structure is initialized in pam_reply
|
|
|
|
Refactoring the confdb so that the setup code can be linked
separately from the access API. This is being done so that our
plugins do not need to link against the collection and ini_config
libraries.
|
|
|
|
- if PAM_USER==root return PAM_USER_UNKNOWN
- pam_sss now can handle to following options:
- use_first_pass: forces the module to use a previous stacked modules
password and will never prompt the user
- use_authtok: when password changing enforce the module to set the new
password to the one provided by a previously stacked password module
- forward_pass: store the passwords collected by the module as pam items for
modules called later in the stack
|
|
|
|
Use tevent signal handling facilities for handlong SIGTERM and SIGINT in the monitor.
Remove pidfile on SIGTERM and SIGINT.
Make sssd single-instance by checking if we suceeded in signaling the process in the pidfile.
|
|
|
|
|
|
|
|
In the event that the configuration was corrupt the first time the
SSSD is started, it would write in the special data for attributes
and indexes, but it would fail before writing the version.
Subsequent reloads (even with correct configuration files) would
fail, since they would try again to write the attributes and
indexes and fail since they were already present.
|
|
|
|
|
|
|
|
|
|
Make shadow-utils base path configurable
Use default values for params, allow configuring them
|
|
|
|
|
|
|
|
|
|
This fixes a bug with legacy backends where the cached password would be cleared
on a user update.
Using a different attribute we make sure a userPassword coming from the remote
backend does not interfere with a cachedPassword (and vice versa).
|
|
|
|
|
|
If the data provider is not yet available when NSS and PAM start,
they will generate a segmentation fault when trying to configure
their automatic reconnection to the Data Provider. I've now added
code in sss_dp_init() to detect whether the dp_ctx is NULL and
return EIO.
|
|
|
|
|
|
ldap backend
|
|
When a user from a domain served by the proxy backend changes his
password with passwd the passwd command asks for the old password,
but it is not validated by the pam_chauthtok call in the proxy
backend, because it is running as root.
If the request is coming the unpriviledged socket we now call
pam_authenticate explicitly before pam_chauthtok.
|
|
The domain name is no longer send as an element on its own, but
if set as a member of the response array. If the user was not found
pd->domain is NULL and strlen will seg-fault.
|
|
- added range check for supplied UIDs and GIDs
- initialize pc_gid to 0 to trigger gid generation
|
|
Other pam modules which are called after pam_sss might want to
reuse the given password so that the user is not bothered with
multiple password prompt. When pam_sss is configured with the
option 'forward_pass' it will use pam_set_item to safe the
password for other pam modules.
|
|
see https://fedorahosted.org/sssd/ticket/25
|
|
Apply suggested fixes by Simo after code review
* return statements no longer use () unless it's an expression
* remove all use of assert() in library
* use bool,true,false instead of int,TRUE,FALSE
* add check for NULL hash table in public entry points
* example code in header file now a seperate file
* assure consistent use of unsigned long data type
* add more debugging support
* break out generation of integer key into convert_key() function
* table parameters now tunable rather than hardcoded
* table can now accept custom alloc()/free() functions
* add function create_table_ex() to pass extra table parameters
* remove MUL(), DIV(), MOD() macros
* hash statistics now separate struct which can be queried
* test program now accepts tuning parameters, iteration count; has better error checking and reporting
fix min/max load factor comman line args in test program
|
|
It needs a gpg key for signing the tarball.
|
|
|
|
Realized that I need to differentiate
sections and attributes. To do this the
line numbers for sections will be negative.
|
|
There was a confusion about the functions that were
recently added. They are incomplete. New added
comments make it clear.
|
|
There is controversy about the inlines so they are removed.
|
|
Force a user lookup against the users domain provider.
If a user domain is not specified search though all non fully qualifying
domains.
Perform authentication against the corrent domain auth backend, based on the
user's domain found in the lookup if one was not
specified.
Also move the NSS-DP functions in COMMON-DP as they are reused by the PAM
responder too now.
|
|
This patch addresses several issues:
a) Cleaning unit test to match coding standard
b) Replace tabs with spaces - I do not know where they came
but there were some.
c) Allowing to read file and keep aside a collection
of K-V pairs where key is the key in the INI file and value is the
line number on which line the key apears.
d) There will be different kinds of errors so
error printing function was abstracted.
g) Placeholders for other printing functions have been introduced.
|
|
Add code to check if the file has changed since the last update was performed.
Avoid dumping and reloading the config ldb if the modification time of the
configuration file has not changed at all.
|
|
We need to stop parsing domains as soon as a caaandidate is found and let the
callback search additional domains if the id is not found.
Should fix ticket #21
|
|
Tried to use the INI interface and saw that
the list of parsing errors can be not NULL
but the actual data is cleaned.
|
|
The read_line() function used an internal buffer allocated on stack
as temporary storage for a line read from file, then returned it.
read_line() now gets a buffer from the caller.
Fixed memory leaks in INI and Collection found by valgrind.
|
|
Also convert all places where we were using custom code to parse
config arguments.
And fix a copy&paste error in nss_get_config
|
|
Previously, every DP client was allowed to set its own "retries"
option. This option was ambiguous, and useless. All DP clients
will now use a global option set in the services config called
"reconnection_retries"
|
|
Also remove the [services/infopipe] section, since we're not
shipping InfoPipe yet, and that would be confusing.
|
|
|
|
|
