summaryrefslogtreecommitdiff
path: root/server/responder/pam
AgeCommit message (Collapse)AuthorFilesLines
2009-11-09Fix segfault on unknown user/domainStephen Gallagher1-2/+2
2009-11-09Fix tevent_req error checking.Simo Sorce1-6/+1
When possible using a macro that correctly deals with tstate
2009-10-27Move responsibility for entry expiration timeoutSimo Sorce1-7/+4
The providers are now responsible for determining how long a cached entry is considered valid. The default is the same as before (600s)
2009-10-27Fix segfaultSimo Sorce1-1/+1
Fix copy/paste error that picked up the wrong request structure to pass down. This was causing the talloc code that checks for the right signature to fail and abort as the 2 request structures have different state structures attacched.
2009-10-26Use standard coding practice to set last loginSimo Sorce1-90/+128
This rewrite should also fix a segfault in the code that may happen when exiting in case of error conditions. The previous code was attaching the transaction handle to llreq structure and then calling prepare_reply() from within the request handlers which could ultimately free the preq and llreq and handle before the transaction request was actually completed by tevent.
2009-10-22Add support for offline auth cache timeoutStephen Gallagher4-3/+192
This adds a new option (offline_credentials_expiration) to the [PAM] section of the sssd.conf If the user does not perform an online authentication within the timeout (in days), they will be denied auth once the timeout passes.
2009-10-22Add pam_ctx (similar to nss_ctx) for storing global PAM configStephen Gallagher2-5/+25
2009-10-15Remove two unused functions.Stephen Gallagher1-10/+0
These functions were used when reconnecting to the DP after losing the connection. Since there is no DP any longer, there's no reason to have these functions.
2009-10-15Fix offline authenticationSimo Sorce1-16/+3
The way we were processing errors from the provider caused offline authentication to stop working. Previously the problem was masked by a bug in the data provider that always returned "Success" for any operation no matter what the actual return code was. when DP got removed the bug became evident.
2009-10-09Remove DP processSimo Sorce2-22/+27
Turn the backend process into data provider servers Make Frontends (pam, nss) directly attach to the backends
2009-10-06Remove unused btreemap codeStephen Gallagher1-1/+0
We have converted to using dhash in place of btreemap everywhere in the code.
2009-09-25Send debug messages to logfileJakub Hrozek1-1/+3
Introduces a new option --debug-to-files which makes SSSD output its debug information to a file instead of stderr, which is still the default. Also introduces a new confdb option debug_to_files which does the same, but can be specified per-service in the config file. The logfiles are stored in /var/log/sssd by default. Changes the initscript to log to files by default.
2009-09-25Upgrade confdb to version 2Stephen Gallagher1-5/+4
This converts a great many configuration options to the new standard format.
2009-09-23Revert "Use syslog for logging error conditions in SSSD"Stephen Gallagher5-22/+14
This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d. Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made use of the SYSLOG_ERROR() macro, so those portions of that code also needed to be reverted.
2009-09-21Use syslog for logging error conditions in SSSDJakub Hrozek5-14/+22
This is just a band-aid until ELAPI is fully functional and ready to use.
2009-09-14make cli_pid mandatory and increase version number of pam protocolSumit Bose1-1/+25
2009-09-14Let the PAM client send its PIDSumit Bose1-0/+19
- the client sends the PID as uint32_t and sssd will use uint32_t too - fix a possible type issue where a uint32_t is sent as int32 in internal dbus communication
2009-09-11Add copyright noticesJakub Hrozek1-0/+21
Fixes: #138
2009-09-08Split database in multiple filesSimo Sorce3-5/+41
The special persistent local database retains the original name. All other backends now have their own cache-NAME.ldb file.
2009-08-17Fix reconnection codeSimo Sorce4-48/+57
Remove redundant reconnection code that was interfeering with the sbus reconnection code. Consolidate include files for sbus relates operations. Make pamsrv code similar to nsssrv code.
2009-08-14Refactor responder_dp.cStephen Gallagher1-6/+6
Many of the functions in responder_dp.c were originally NSS- specific and were moved there from the NSS responder code. Since they are now generic to any responder, rename them to sss_dp_*
2009-08-11Change the why DP clients identifySimo Sorce3-53/+16
Mirrors what we have done with the monitor.
2009-08-11Change services identification mechanismSimo Sorce1-72/+5
Let services identify themselves voiluntarily as the first operation instead of polling from the monitor. Also consolidate some common functions and make them available as monitor helpers.
2009-08-11Make child processes exit when parent diesJakub Hrozek1-0/+6
The child processes call prctl() and when their parent process is killed, they are sent SIGTERM using prctl. This is currently Linux-specific, for non-Linuxes, a similar effect is achieved by catching a set of common termination signals and sending SIGTERM to the process group.
2009-08-11Make socket paths a compile-time optionStephen Gallagher1-1/+0
Previously, we had hardcoded the paths for the NSS, PAM and private PAM sockets to /var/lib/sss/pipes. With this patch, we will specify the sockets with --with-pipe-path.
2009-08-10Simplify interfaces initializationSimo Sorce3-30/+37
Make as much as possible static, and remove use of talloc_reference and allocation/deallocation of memory when not necessary. Fix also responder use of rctx->conn, was mistakenly used for both monitor and dp connections.
2009-08-10Cosmetic changesSimo Sorce2-21/+21
Rationalize and rename connection names in preparatoin for merging of server and connection structures.
2009-08-10Remove redundant memory contextsSimo Sorce2-5/+5
Simplify code by removing stuff that is never used or redundant.
2009-07-29Address CVE-2009-2410Stephen Gallagher1-1/+1
Fix incorrect error code return in local_handler_callback
2009-07-20Implement resInit for monitor, NSS, PAM, DP and the backendsStephen Gallagher1-0/+20
2009-07-03Rework transaction code to use tevent_reqSimo Sorce1-31/+84
This is part of a set of patches to rewrite sysdb to a hopefully better API, that will also let use use tevent_req async style calls to manipulate our cache.
2009-07-03Rename sysdb_req to sysdb_handle.Simo Sorce2-12/+6
This sysdb_req has always really been a transaction handle and not a request. This is part of a set of patches to rewrite transaction support in sysdb to a hopefully better API, that will also let use use tevent_req async style to manipulate our cache.
2009-07-02check pending_return after dbus_connection_send_with_replySumit Bose1-1/+1
2009-07-02added kerberos backend with tevent_req event handlingSumit Bose1-1/+19
2009-06-08fix detection of authentication against LOCAL domainSumit Bose1-3/+9
2009-05-28special-case NSS calls in PAM codeJakub Hrozek1-2/+2
2009-05-26fix a wrong timeoutSumit Bose1-3/+4
The timeout of the data provider call (in ms) got overwritten by a cache timeout (in s).
2009-05-18Move actual password caching into sysdbSimo Sorce4-126/+2
Convert auth modules to do the caching themselves
2009-05-18Prevent accepting blank passwordsSimo Sorce1-0/+7
2009-05-18Fix crypt functions to not use static buffers.Simo Sorce2-18/+16
Also fix style, clarify, and simplify some logic.
2009-05-15added new pam client protocolSumit Bose1-1/+132
2009-05-15added more flexible handling of client protocolSumit Bose1-1/+12
- allow different protocol versions for PAM and NSS - support more than one protocol version in the responder
2009-05-14added check for NULL valuesSumit Bose2-9/+1
- allow unspecified value in struct pam_data to be NULL - check if domain structure is initialized in pam_reply
2009-04-28handle other pam calls when offlineSumit Bose1-0/+10
2009-04-28Use different attribute for cached passwords change timeSumit Bose1-2/+2
2009-04-28change PAM timeout the match NSS timeSumit Bose2-3/+1
2009-04-27Use different attribute for cached passwordsSimo Sorce1-3/+3
This fixes a bug with legacy backends where the cached password would be cleared on a user update. Using a different attribute we make sure a userPassword coming from the remote backend does not interfere with a cachedPassword (and vice versa).
2009-04-27fix for pam proxy chauthtokSumit Bose1-0/+1
When a user from a domain served by the proxy backend changes his password with passwd the passwd command asks for the old password, but it is not validated by the pam_chauthtok call in the proxy backend, because it is running as root. If the request is coming the unpriviledged socket we now call pam_authenticate explicitly before pam_chauthtok.
2009-04-23removed length of unused element from packet size calculationSumit Bose1-1/+1
The domain name is no longer send as an element on its own, but if set as a member of the response array. If the user was not found pd->domain is NULL and strlen will seg-fault.
2009-04-22fix for a seq fault when pam_reply_delay is called.Sumit Bose1-2/+2
see https://fedorahosted.org/sssd/ticket/25
generated by cgit (git 2.34.1) at 2024-11-07 13:32:49 +0000