summaryrefslogtreecommitdiff
path: root/server/providers/krb5/krb5_auth.c
AgeCommit message (Collapse)AuthorFilesLines
2010-02-01Avoid 'PAM' at the beginning of define and enum namesSumit Bose1-4/+4
2010-01-11Fix return value when offline and TGT is validSumit Bose1-1/+1
Fixes CVE-2010-0014
2010-01-05Return an error for an unknown PAM requestSumit Bose1-6/+18
2009-12-18Do not blindly accept zero-length passwordsStephen Gallagher1-1/+4
2009-12-18Fix ldap child memory hierarchy and other issuesSimo Sorce1-23/+54
The timeout handler was not a child of the request so it could fire even though the request was already freed. The code wouldn't use async writes to the children so it could incur in a short write with no way to detect or recover from it. Also fixed style of some helper functions to pass explicit paramters instead of a general structure. Add common code to do async writes to pipes. Fixed async write issue for the krb5_child as well. Fix also sdap_kinit_done(), a return statement was missing and we were mixing SDAP_AUTH and errno return codes in state->result Remove usless helper function that just replicates talloc_strndup()
2009-12-18Fix for #344Sumit Bose1-13/+11
Do not handle a missing ccache file as inactive by default, check if there are still active processes of the user.
2009-12-18Do not overwrite valid TGTs when offlineSumit Bose1-42/+87
2009-12-18Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose1-2/+12
If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
2009-12-15Don't consider one address with different port numbers as the sameMartin Nagy1-1/+3
There were two problems with the code. We were using fo_set_server_status() instead of fo_set_port_status() when we failed to connect to a service. This is a problem because if two services use the same server, or we want to use one server with two different ports, marking the whole server as bad is incorrect. The other problem was that be_resolve_server_done() was comparing the hostent structures -- these are, however, equal across multiple server:port pairs with the same server addresses. Fixes: #321
2009-12-09Reduce code duplication between LDAP child and Kerberos childJakub Hrozek1-116/+7
Fixes: #294
2009-12-01Immediately return a krb5 change password request when offlineSumit Bose1-0/+7
2009-11-25Remove unneeded debugging codeSumit Bose1-9/+0
2009-11-25Fix an internal error when cache_credentials=FALSESumit Bose1-1/+4
2009-11-25Split helpers for child processesJakub Hrozek1-143/+1
Moves several functions out of providers/krb5 hierarchy into a separate module so it can be shared by the ldap child.
2009-11-23Read KDC info from file instead from environmentSumit Bose1-10/+51
Then name or IP adress of the KDC is written into the pubconf directory into a file named kdcinfo.REALM. The locator plugin will then read this file and pass the data to the kerberos libraries.
2009-11-20Improve handling of ccache filesSumit Bose1-104/+442
- save current ccache file to sysdb - use the saved ccache file if the user has running processes - create an empty ccache if offline - return enviroment variables if offline
2009-11-20Validate Kerberos credentials with local keytabSumit Bose1-37/+37
2009-11-10Simplify krb5 child handlerSumit Bose1-17/+18
Currently the Kerberos child handler evaluates the siginfo_t structure to wait for a specific child. This scheme is prone to error, especially when there are more than one child process active, and can produce missleading debug message. This patch simplifies the scheme as it waits for any child.
2009-11-09Fix tevent_req error checking.Simo Sorce1-23/+20
When possible using a macro that correctly deals with tstate
2009-10-22update krb5 option handling to new option schemeSumit Bose1-23/+39
2009-10-16Move all krb5 provider init functionsSimo Sorce1-180/+24
Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
2009-10-15enable debugging of krb5_childSumit Bose1-2/+99
2009-10-15Return the dp error from the providersSimo Sorce1-16/+30
2009-10-09use the correct kerberos context for each targetSumit Bose1-4/+33
- when the kerberos provider was used as a chpass_provider but not as auth_provider the backend died
2009-09-25remove krb5_try_simple_upn option and make it a default fallbackSumit Bose1-8/+1
2009-09-25fix possible short reads in kerberos providerSumit Bose1-5/+18
2009-09-25Upgrade confdb to version 2Stephen Gallagher1-7/+10
This converts a great many configuration options to the new standard format.
2009-09-24added support for older MIT kerberos versionssbose1-2/+1
- make the build of the locator plugin optional - added a man page for the locator plugin - use krb5.h if krb5/krb5.h cannot be found - added alternatives for missing functions - set -DDBUS_API_SUBJECT_TO_CHANGE if libdbus version is lesser than 1.0.0
2009-09-23Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher1-2/+2
This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
2009-09-21Use syslog for logging error conditions in SSSDJakub Hrozek1-2/+2
This is just a band-aid until ELAPI is fully functional and ready to use.
2009-09-14added child timeout handlerSumit Bose1-6/+87
2009-09-14add krb5ccache_dir and krb5ccname_template optionSumit Bose1-24/+66
The configuration options krb5ccache_dir and krb5ccname_template are added to the Kerberos provider to create the user's credential caches the same way as pam_krb5 does. Due to the design of the sssd and the supported ccache types of MIT Kerberos only files are allowed.
2009-09-14Make the offline status backend-globalSimo Sorce1-4/+13
Add helpers functions to query/set the offline status per backend. Now all providers share the same offline status.
2009-09-11use fork+exec for kerberos helperSumit Bose1-106/+209
2009-09-11add change password target to krb5 backendSumit Bose1-24/+81
2009-08-28send SSSD_REALM and SSSD_KDCIP environment to the clientSumit Bose1-2/+31
Currently the kerberos locator plugin needs these two variables to be set to find a KDC which is configured in sssd but not in /etc/krb5.conf.
2009-08-24some UPN handling fixesSumit Bose1-23/+11
- making the realm part upper case is now optional and done in the LDAP backend - using a username@realm UPN is now optional
2009-08-21use stored upn if availableSumit Bose1-20/+101
If a user principle name (upn) can be found in sysdb the krb5 backend will use this otherwise is build as username@realm. It is checked that the realm is upper case only.
2009-08-11Make socket paths a compile-time optionStephen Gallagher1-1/+0
Previously, we had hardcoded the paths for the NSS, PAM and private PAM sockets to /var/lib/sss/pipes. With this patch, we will specify the sockets with --with-pipe-path.
2009-08-05Consolidate tevent helpersJakub Hrozek1-16/+0
2009-07-20add infrastructure to handle new backend targetsSumit Bose1-4/+5
2009-07-10let krb5 backend safe valid credentials for offline authenticationSumit Bose1-0/+43
2009-07-03Cleanup warnings in client and server codeSimo Sorce1-3/+0
2009-07-02added kerberos backend with tevent_req event handlingSumit Bose1-0/+567
generated by cgit (git 2.34.1) at 2024-09-08 20:44:28 +0000