summaryrefslogtreecommitdiff
path: root/server/providers
AgeCommit message (Collapse)AuthorFilesLines
2009-11-03Rename sdap_id_map to sdap_attr_mapSimo Sorce5-21/+70
Also start adding some infrastructure to use the USN counter when available. In particular add a place to add generic attrs mapping, ie attributes that are neither user nor group specific.
2009-11-02Make debug message less irritating.Sumit Bose1-2/+2
The 'Unable to load' debug message is now only shown when the backend target is given explicitly in the config file. I the other case we let the caller decided how to handle this error condition.
2009-11-02set ipa_hostname if not given in config fileSumit Bose1-0/+20
2009-10-30Fix segfault when SASL is not used at allSimo Sorce2-2/+4
2009-10-29Add support to get rootDSE from the LDAP server.Simo Sorce6-121/+398
Also fic sdap_get_generic_send() to be a bit more "generic" :-) Also figs bugs within it. This patch allow us 2 good things. A) we check that the server effectively supports GSSAPI auth before we try to use it. B) against IPA it substantially cuts delays when the server is offline because it uses a 5 second async timeout on the connection and doesn't try to do a slow synchronous kinit+sasl_bind if the server is not even available.
2009-10-29Tidy up ipa optionsSimo Sorce5-151/+198
Do not replicate every and each option we may want to set in ipa. Just read out ldap and krb provider options (added reference in the manual too, and removed mention of ipa specific timeout values, use ldap options for that) Avoid calling auth module initialization twice, just pass the auth context to the chpass module too. Add a new ldap option SDAP_SEARCH_BASE, so that a single searching base can be used for both users and groups. the user and group search bases can still be set separately if necessary but they are now optional and set to be identical to SDAP_SEARCH_BASE if not explicitly specified in the configuration.
2009-10-28Kill the ldap connection when we go offlineSimo Sorce1-5/+16
This patch uses a wrapper to kill the ldap connection when we are marked offline. This also makes sure we do not try to reuse a bad connection handler after a fatal error.
2009-10-27Move responsibility for entry expiration timeoutSimo Sorce6-18/+38
The providers are now responsible for determining how long a cached entry is considered valid. The default is the same as before (600s)
2009-10-27Add proper support for IPA/AD schemasSimo Sorce4-202/+574
Nested groups weren't properly handled. Add 2 pass strategy to update groups memberships Stuff work as expected when enumeration is enabled now.
2009-10-27store original DN with cached group objects if availableSumit Bose1-0/+16
2009-10-26Copy option overrides.Simo Sorce1-0/+26
We were not copying IPA named options to the ldap id options list. So the ldap_id provider was always using just the default settings.
2009-10-22Add support for offline auth cache timeoutStephen Gallagher1-0/+1
This adds a new option (offline_credentials_expiration) to the [PAM] section of the sssd.conf If the user does not perform an online authentication within the timeout (in days), they will be denied auth once the timeout passes.
2009-10-22Fix setting the schema in the ipa providerSimo Sorce1-0/+3
2009-10-22update ipa auth options to new option schemeSumit Bose3-110/+133
2009-10-22update krb5 option handling to new option schemeSumit Bose7-125/+273
2009-10-22Fix potential memory leaks in the data providerMartin Nagy1-2/+4
2009-10-22Better offline/enumeration behaviorSimo Sorce1-10/+12
Go offline in case of hard errors too. It makes no sense to keep trying too often when you have bad credentials for example. Also delay starting the enumeration thread so that we finish initializations first (bind to ldap is still a blocking operation and this may interfere with clients/monitor registrations).
2009-10-22added generic LDAP search sdap_get_generic_send/_recvSumit Bose4-0/+304
2009-10-20Start implementing ipa specific options.Simo Sorce5-7/+593
First step generate ldap options from ipa options. Add sssd-ipa man page too.
2009-10-16Always list inputs before outputsSimo Sorce1-8/+11
2009-10-16Add first basic IPA providerSimo Sorce1-0/+233
2009-10-16Move all krb5 provider init functionsSimo Sorce4-193/+261
Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
2009-10-16Move all ldap provider init functionsSimo Sorce5-145/+202
Put all init functions in their own file so that the other files can be reused in other providers w/o having them in the way.
2009-10-15Check for expired passwords in LDAP providerSumit Bose4-23/+425
2009-10-15enable debugging of krb5_childSumit Bose3-4/+142
2009-10-15more implicit provider target settingsSumit Bose1-13/+48
If auth_provider or access_provider is ont set explicitly id_provider is used if it can handle auth or access control requests respectively. If not auth defaults to 'none' and the access_provider is set to 'permit'. The option 'deny' is added for the access_provider to explicitly deny access.
2009-10-15set chpass_provider implicit if not set explicitSumit Bose2-20/+60
- if chpass_provider is not given in the configuration file but an auth_provider and the auth_provider can also handle change password requests it is used as chpass_provider.
2009-10-15Return the dp error from the providersSimo Sorce6-81/+179
2009-10-14Move ldap provider configuration into its own fileSimo Sorce6-189/+252
2009-10-14Make options parser available to all providersSimo Sorce8-294/+366
2009-10-14send a message if a backend target is not configuredSumit Bose1-12/+30
If a backend target is not configured the return code is changed from PAM_SYSTEM_ERR to PAM_MODULE_UNKNOWN and an error message is sent back to the client.
2009-10-14make sdap_id_connect_* independent of sdap_id_ctxSumit Bose3-180/+188
The sdap_id_connect_* request tries to bind to an LDAP server with the default credentials. Only the opts component of the sdap_id_ctx context is used. A new request sdap_cli_connect_* is created which expects only the opts pointer as parameter and not the whole context. This makes it reusable by other providers.
2009-10-13add a replacement if ldap_control_create is missingSumit Bose3-8/+7
2009-10-12fix a wrong argument to unpack_bufferSumit Bose1-18/+40
- the patch to handle short read introduced a new variable len to store the amount of data read. Instead of using this variable unpack_buffer was called with the old variable ret. Thanks to mnagy@redhat.com for finding this. - this patch also fixes a potential error when the message size is equal to the buffer size.
2009-10-09use the correct kerberos context for each targetSumit Bose1-4/+33
- when the kerberos provider was used as a chpass_provider but not as auth_provider the backend died
2009-10-09Remove DP processSimo Sorce7-1259/+241
Turn the backend process into data provider servers Make Frontends (pam, nss) directly attach to the backends
2009-10-09Differentiate between search and network timeoutsSimo Sorce3-5/+7
Network timeouts are used in quick operations like bind. Search timeout is used for operations that can "legally" require more time. Change defaults to 6 and 60 seconds respectively.
2009-10-08add support for server side LDAP password policiesSumit Bose3-11/+125
- password policy request controls are send during bind and change password extended operation - the response control is evaluated to see if the password is expired or will expire, soon
2009-10-06Remove unused btreemap codeStephen Gallagher2-2/+0
We have converted to using dhash in place of btreemap everywhere in the code.
2009-10-05remove redundant talloc_freeSumit Bose1-3/+0
- this patch should fix bug #213, a double free in the sdap timeout handler
2009-10-05handle expired password during authenticationSumit Bose1-2/+25
2009-10-01Fix long timeout on ldap operationSimo Sorce2-5/+14
Always use the network timeout defined in the options. But raise defaults to 60 seconds or enumerations can easily fail.
2009-10-01Initial implementation of sasl bind supportSimo Sorce6-59/+488
Inits krb5 credentials, if sasl mech is GSSAPI. Tested with GSSAPI and host keytab as well as user credentials. Updates also manpages with the new options.
2009-09-25Let backend respond while fetching large resultsSimo Sorce1-2/+11
Timers always come before fd events, wait 5 microseconds between processing operations so that tevent has a chance of cactching an fd event in between. This allows the backend to reply to pings even while processing very large ldap results (importanty especially during the first enumeration).
2009-09-25remove krb5_try_simple_upn option and make it a default fallbackSumit Bose2-9/+1
2009-09-25Send debug messages to logfileJakub Hrozek2-1/+7
Introduces a new option --debug-to-files which makes SSSD output its debug information to a file instead of stderr, which is still the default. Also introduces a new confdb option debug_to_files which does the same, but can be specified per-service in the config file. The logfiles are stored in /var/log/sssd by default. Changes the initscript to log to files by default.
2009-09-25fix possible short reads in kerberos providerSumit Bose2-15/+46
2009-09-25add new config options ldap_tls_cacert and ldap_tls_cacertdirSumit Bose4-67/+72
2009-09-25Upgrade confdb to version 2Stephen Gallagher7-120/+88
This converts a great many configuration options to the new standard format.
2009-09-24added support for older MIT kerberos versionssbose3-7/+37
- make the build of the locator plugin optional - added a man page for the locator plugin - use krb5.h if krb5/krb5.h cannot be found - added alternatives for missing functions - set -DDBUS_API_SUBJECT_TO_CHANGE if libdbus version is lesser than 1.0.0
generated by cgit (git 2.34.1) at 2025-01-04 09:26:34 +0000