Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
A check for allowed UIDs is added in the common responder code directly
after accept(). If the platform does not support reading the UID of the
peer but allowed UIDs are configured, access is denied.
Currently only the PAC responder sets the allowed UIDs for a socket. The
default is that only root is allowed to access the socket of the PAC
responder.
Fixes: https://fedorahosted.org/sssd/ticket/1382
|
|
|
|
Removes old options and adds new ones.
|
|
|
|
|
|
|
|
|
|
* Allows different user/domain qualified names for different
domains. For example Domain\User or user@domain.
* The global re_expression and full_name_format options remain
as defaults for the domains.
* Subdomains get the re_expression and full_name_format of
their parent domain.
https://bugzilla.redhat.com/show_bug.cgi?id=811663
|
|
https://fedorahosted.org/sssd/ticket/1318
|
|
|
|
documentation-access_provider
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
This option will allow administrators to set a default shell to be
used if a user does not have one set in the identity provider.
https://fedorahosted.org/sssd/ticket/1289
|
|
This option is similar to override_homedir, except that it will
take effect only for users that do not have an explicit home
directory specified in LDAP.
https://fedorahosted.org/sssd/ticket/1250
|
|
* Previously only the side effect was described.
|
|
New option pwd_expiration_warning is introduced which can be set per
domain and can override the value specified by the original
pam_pwd_expiration_warning.
If the value of expiration warning is set to zero, the filter isn't
apllied at all - if backend server returns the warning, it will be
automatically displayed.
Default value for Kerberos: 7 days
Default value for LDAP: don't apply the filter
Technical note: default value when creating the domain is -1. This is
important so we can distinguish between "no value set" and 0. Without
this possibility it would be impossible to set different values for LDAP
and Kerberos provider.
|
|
https://fedorahosted.org/sssd/ticket/1203
|
|
subdomain_homedir - if set, it contains default value, can be overriden
in further processing
|
|
|
|
|
|
|
|
|
|
https://fedorahosted.org/sssd/ticket/1119
|
|
|
|
|
|
|
|
It is a low-level developer option not indended to be consumed by users
https://fedorahosted.org/sssd/ticket/1174
|
|
This code will now attempt first to see if it has privilege to set
the value as specified, and if not it will fall back to the
previous behavior. So on systems with the CAP_SYS_RESOURCE
capability granted to SSSD, it will be able to ignore the
limits.conf hard limit.
https://fedorahosted.org/sssd/ticket/1197
|
|
|
|
|
|
|
|
https://fedorahosted.org/sssd/ticket/1116
|
|
New sudo responder option: cache_timeout
https://fedorahosted.org/sssd/ticket/1111
|
|
https://fedorahosted.org/sssd/ticket/1016
|
|
|
|
https://fedorahosted.org/sssd/ticket/1109
|
|
|
|
|
|
https://fedorahosted.org/sssd/ticket/918
|
|
|
|
https://fedorahosted.org/sssd/ticket/956
|
|
Adds a configure option to set the distribution default as well as
an sssd.conf option to override it.
https://fedorahosted.org/sssd/ticket/980
|
|
https://fedorahosted.org/sssd/ticket/925
Modified sssd and sssd.conf man pages to reflect new levels.
Added new man include: include/debug_levels.xml
|
|
There may be users in LDAP that have a valid but unwelcome shell
set in their account. This adds a blacklist of shells that should
always be replaced by the fallback_shell.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
https://fedorahosted.org/sssd/ticket/742
|
|
https://fedorahosted.org/sssd/ticket/551
|
|
https://fedorahosted.org/sssd/ticket/742
|
|
|
|
|
|
Also adds an option to limit how often we check the ID provider,
so that conversations with multiple PAM requests won't update the
cache multiple times.
https://fedorahosted.org/sssd/ticket/749
|