| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
There were unused functions still being compiled. This will
suppress them until we turn live configuration updates back on.
|
|
|
|
Instead of waiting an arbitrary timeout, start all providers first, and wait for
all of them to reply to the monitor before starting other services.
Add a timeout handler so that services are started even if one of the providers
fails to actually register back to the monitor.
Also fixes services destructors
delist_service was overriding the natural svc destructor.
remove the offending code and make the svc_destructor always try
to remove a service from the service list, if the service is not
listed it will just be a noop.
|
|
Turn the backend process into data provider servers
Make Frontends (pam, nss) directly attach to the backends
|
|
Use this new utility call to ensure that the config file is safe
to read from.
|
|
Introduces a new option --debug-to-files which makes SSSD output its
debug information to a file instead of stderr, which is still the
default.
Also introduces a new confdb option debug_to_files which does the same,
but can be specified per-service in the config file.
The logfiles are stored in /var/log/sssd by default.
Changes the initscript to log to files by default.
|
|
This converts a great many configuration options to the new
standard format.
|
|
The backends do not honor the reloadConfig SBUS message right now,
so if an admin changes the sssd.conf file, it will update only the
monitor, potentially leaving the SSSD as a whole in a bad state.
This patch will simply comment out monitor_config_file() for the
time being until https://fedorahosted.org/sssd/ticket/91 is fixed.
|
|
When a laptop is suspended it may be dormant for hours.
Do not check just the kast time a ping was successful, keep a counter with the
failed pings instead.
|
|
This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d.
Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made
use of the SYSLOG_ERROR() macro, so those portions of that code
also needed to be reverted.
|
|
This is just a band-aid until ELAPI is fully functional and ready to
use.
|
|
|
|
We were talloc_free()-ing the cdb_file string too early.
|
|
We will now parse the config file and validate the confdb contents
before processing the rest of the monitor startup. This will allow
us to return an appropriate error code to the shell if the
configuration is invalid.
|
|
Because the confdb always operates synchronously, it maintains its
own private event context internally. The event context argument
passed to it is never used, so we'll remove it to avoid confusion.
|
|
The special persistent local database retains the original name.
All other backends now have their own cache-NAME.ldb file.
|
|
The data provider backends stored a name value besides the domain
name to identify themselves to the data provider. This was the name
of the id provider. Currently the backends can have different
providers for id, authentication etc. So the name may be missleading.
Also when there are more domains with the same id provider the name
is not enough to identify the backend but the domain name is. As a
consequence the backend name is removed completely and only the
domain name is used for identification.
|
|
|
|
Remove redundant reconnection code that was interfeering with the sbus
reconnection code.
Consolidate include files for sbus relates operations.
Make pamsrv code similar to nsssrv code.
|
|
Simply delay anything other service by 1 second only at startup.
|
|
Let services identify themselves voiluntarily as the first operation
instead of polling from the monitor.
Also consolidate some common functions and make them available as monitor
helpers.
|
|
Our configuration specifies the monitor config timeout as seconds,
but we were passing it directly to dbus commands that require
milliseconds. Fixing this in get_monitor_config(). Also, the
default value of -1 for the timeout resulted in a timeout much too
short to be useful, so I'm making it 10s instead.
This fix solves the problem where a busy backend (for example, one
that is enumerating a large number of LDAP entries) would fail to
respond to the ping in time.
|
|
Make as much as possible static, and remove use of talloc_reference and
allocation/deallocation of memory when not necessary.
Fix also responder use of rctx->conn, was mistakenly used for both
monitor and dp connections.
|
|
This reduce code duplication as it allows to use one set of watch and timeout
functions, and at the same time also allow not to use a secondary structure just
to unify these functions.
|
|
Rationalize and rename connection names in preparatoin for merging of server and
connection structures.
|
|
Simplify code by removing stuff that is never used or redundant.
|
|
1) Forgot to check for successful allocation
2) Used the wrong mem_ctx when allocating a timer event.
|
|
use '--debug-timestamps' at the command line
or set 'debug-timestamps = TRUE' in the configuration file.
|
|
|
|
This patch updates the monitor_config_file() functions so that
they can monitor any number of files and invoke a specified
callback whenever they are modified.
When inotify is available, we will add an additional watch
descriptor to the inotify file descriptor.
When inotify is not available, the polling function will simply
loop to check each file in the monitor list.
When changes are discovered in resolv.conf, the monitor will send
a "resInit" signal to all of its known children. They are only
required to handle this function if they need updated DNS
information. Services that do not implement resInit should return
DBUS_ERROR_UNKNOWN_METHOD (rather than timing out) with no ill
effects.
|
|
1) Some text editors will create a new file and move it into place
on top of the existing file. When this happens, the kernel issues
an IN_IGNORE inotify event and automatically removes the watch
descriptor for that file. We'll handle the event and create a new
watch descriptor for the new file. We will attempt to rewatch the
file six times at five-second intervals.
2) Some scripts may append new data to the config file in several
steps (such as calling echo "foo" >> sssd.conf several times). In
order to handle these scripts safely, we'll defer processing of
inotify events for one second after the first is detected. This
should be ample time for the remainder of the script to complete.
|
|
See ticket #37 in sssd track.
|
|
|
|
There was a typo in the confdb setup portion of the
monitor_process_init that was attempting to use the wrong cdb
object to initialize.
This patch also adds some missing talloc_free() calls on error.
|
|
There is a potential race condition where the monitor may attempt
to signal a reload of a child process before the communication
sbus channel is available. If this happens, we will just exit this
function and let the monitor kill and restart the child process.
|
|
We were stealing the memory context of only the first value in
the linked-list of domains (and also services). This patch adds a
memory context to hold the lists so that can be stolen along with
all of the entries.
|
|
|
|
Actually use the buffer not it's location on the stack.
|
|
|
|
The local provider needs no backend, so we'll create a special
provider entry for it called "local" that will not attempt to
retrieve provider configuration but will remain in the service
list so it can be updated when the config file changes.
|
|
|
|
|
|
Refactoring the confdb so that the setup code can be linked
separately from the access API. This is being done so that our
plugins do not need to link against the collection and ini_config
libraries.
|
|
Use tevent signal handling facilities for handlong SIGTERM and SIGINT in the monitor.
Remove pidfile on SIGTERM and SIGINT.
Make sssd single-instance by checking if we suceeded in signaling the process in the pidfile.
|
|
In the event that the configuration was corrupt the first time the
SSSD is started, it would write in the special data for attributes
and indexes, but it would fail before writing the version.
Subsequent reloads (even with correct configuration files) would
fail, since they would try again to write the attributes and
indexes and fail since they were already present.
|
|
Also convert all places where we were using custom code to parse
config arguments.
And fix a copy&paste error in nss_get_config
|
|
Previously, every DP client was allowed to set its own "retries"
option. This option was ambiguous, and useless. All DP clients
will now use a global option set in the services config called
"reconnection_retries"
|
|
|
|
The SSSD now links with the ini_config and collection libraries
in the common directory.
The monitor will track changes to the /etc/sssd/sssd.conf file
using inotify on platforms that support it, or polled every 5
seconds on platforms that do not.
At startup or modification of the conf file, the monitor will
purge the existing confdb and reread it completely from the conf
file, to ensure that there are no lingering entries. It does this
in a transaction, so there should be no race condition with the
client services.
A new option has been added to the startup options for the SSSD.
It is now possible to specify an alternate config file with the
-c <file> at the command line.
|
|
Fixes requested during code review
|
