summaryrefslogtreecommitdiff
path: root/server/providers/krb5/krb5_child.c
AgeCommit message (Collapse)AuthorFilesLines
2010-02-18Use macros to hide memcpy callsJakub Hrozek1-53/+14
The memcpy calls introduced in the memalign patches are ugly. This patch hides them behind a set of macros.
2010-02-12Make change password errors more transparentSumit Bose1-18/+60
2010-02-10Fix other memory alignment issuesJakub Hrozek1-14/+17
Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390
2010-02-10Make return values more specific during password changeSumit Bose1-0/+1
- return PAM_AUTHTOK_ERR instead of PAM_SYSTEM_ERR if the password change operation fails - send a message to the user if the system is offline and the password cannot be changed
2010-02-05Internationalize the command-line help messageStephen Gallagher1-3/+3
2010-02-05Enable debug_timestamps by defaultStephen Gallagher1-1/+1
It can be overridden in the sssd.conf or on the commandline with --debug-timestamps=0
2010-02-01Avoid 'PAM' at the beginning of define and enum namesSumit Bose1-3/+4
2010-02-01Rename PAM_USER_INFO to PAM_SYSTEM_INFOSumit Bose1-2/+2
2009-12-18Do not blindly accept zero-length passwordsStephen Gallagher1-7/+13
2009-12-18Fix ldap child memory hierarchy and other issuesSimo Sorce1-40/+43
The timeout handler was not a child of the request so it could fire even though the request was already freed. The code wouldn't use async writes to the children so it could incur in a short write with no way to detect or recover from it. Also fixed style of some helper functions to pass explicit paramters instead of a general structure. Add common code to do async writes to pipes. Fixed async write issue for the krb5_child as well. Fix also sdap_kinit_done(), a return statement was missing and we were mixing SDAP_AUTH and errno return codes in state->result Remove usless helper function that just replicates talloc_strndup()
2009-12-18Handle chauthtok with PAM_PRELIM_CHECK separatelySumit Bose1-11/+25
If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request.
2009-12-08Add dummy credentials to an empty ccache fileSumit Bose1-2/+54
Application like krb5-auth-dialog might get confused if there is a credential cache file without any credentials in it. This patch adds an expired credential where only the client and the server principal are set. The client principal is the user's principal and the server principal corresponds to a TGT principal of the realm the user belongs to.
2009-11-25Split helpers for child processesJakub Hrozek1-24/+1
Moves several functions out of providers/krb5 hierarchy into a separate module so it can be shared by the ldap child.
2009-11-20Add ipa_authSumit Bose1-0/+3
To support IPA DS to Kerberos password migration a seperate authentication target is added. It calls the Kerberos authentication target and in the case of a 'Preauthentication Error' the LDAP authentication target. On success the Kerberos target is called again to request the TGT.
2009-11-20Improve handling of ccache filesSumit Bose1-97/+153
- save current ccache file to sysdb - use the saved ccache file if the user has running processes - create an empty ccache if offline - return enviroment variables if offline
2009-11-20Validate Kerberos credentials with local keytabSumit Bose1-2/+146
2009-11-06Check is ccache structure is initialized before calling krb5_cc_destroySumit Bose1-8/+16
2009-11-05add replacements for missing Kerberos callsSumit Bose1-33/+7
2009-10-22update krb5 option handling to new option schemeSumit Bose1-3/+38
2009-10-15enable debugging of krb5_childSumit Bose1-2/+42
2009-10-12fix a wrong argument to unpack_bufferSumit Bose1-18/+40
- the patch to handle short read introduced a new variable len to store the amount of data read. Instead of using this variable unpack_buffer was called with the old variable ret. Thanks to mnagy@redhat.com for finding this. - this patch also fixes a potential error when the message size is equal to the buffer size.
2009-10-05handle expired password during authenticationSumit Bose1-2/+25
2009-09-25fix possible short reads in kerberos providerSumit Bose1-10/+28
2009-09-24added support for older MIT kerberos versionssbose1-2/+29
- make the build of the locator plugin optional - added a man page for the locator plugin - use krb5.h if krb5/krb5.h cannot be found - added alternatives for missing functions - set -DDBUS_API_SUBJECT_TO_CHANGE if libdbus version is lesser than 1.0.0
2009-09-14fix the wrong usage of an offsetSumit Bose1-1/+1
2009-09-14add krb5ccache_dir and krb5ccname_template optionSumit Bose1-26/+90
The configuration options krb5ccache_dir and krb5ccname_template are added to the Kerberos provider to create the user's credential caches the same way as pam_krb5 does. Due to the design of the sssd and the supported ccache types of MIT Kerberos only files are allowed.
2009-09-11use fork+exec for kerberos helperSumit Bose1-60/+253
2009-09-11add change password target to krb5 backendSumit Bose1-0/+363
generated by cgit (git 2.34.1) at 2025-01-15 14:09:26 +0000