summaryrefslogtreecommitdiff
path: root/src/providers/ad/ad_subdomains.c
AgeCommit message (Collapse)AuthorFilesLines
2013-09-27AD: talk to GC first even for local domain objectsJakub Hrozek1-1/+7
Related: https://fedorahosted.org/sssd/ticket/2070 Since we are recommending to configure the POSIX attributes so that they are replicated to the Global Catalog, we can start connecting to the GC by default even for local users. If the object is not matches in the GC, there is a possibility to fall back to LDAP.
2013-09-27ipa_server_mode: write capaths to krb5 include fileSumit Bose1-1/+1
If there are member domains in a trusted forest which are DNS-wise not proper children of the forest root the IPA KDC needs some help to determine the right authentication path. In general this should be done internally by the IPA KDC but this works requires more effort than letting sssd write the needed data to the include file for krb5.conf. If this functionality is available for the IPA KDC this patch might be removed from the sssd tree. Fixes https://fedorahosted.org/sssd/ticket/2093
2013-09-27IPA: store forest name for forest member domainsSumit Bose1-1/+1
In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
2013-09-20AD: Failure to get flat name is not fatalJakub Hrozek1-3/+0
https://fedorahosted.org/sssd/ticket/2067 Some AD or AD-like servers do not contain the netlogon attribute in the master domain name. Instead of failing completely, we should just abort the master domain request and carry on. The only functionality we miss would be getting users by domain flat name.
2013-09-18AD: async request to retrieve master domain infoJakub Hrozek1-213/+22
Adds a reusable async request to download the master domain info.
2013-09-17util: add sss_idmap_talloc[_free]Pavel Březina1-11/+3
Remove code duplication.
2013-08-28SYSDB: Store enumerate flag for subdomainJakub Hrozek1-2/+2
2013-08-28DB: remove unused realm parameter from sysdb_master_domain_add_infoJakub Hrozek1-1/+1
The parameter was not used at all.
2013-06-28AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek1-65/+1
Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28Save mpg state for subdomainsSumit Bose1-1/+3
The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
2013-06-27AD: Write out domain-realm mappingsJakub Hrozek1-0/+7
This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
2013-06-12Use the correct talloc context when creating AD subdomainsJakub Hrozek1-1/+1
sdom was only ever guaranteed to be set when a new domain was being created. sditer is a valid pointer in both cases, so just use that.
2013-06-07AD: Store trusted AD domains as subdomainsJakub Hrozek1-2/+364
https://fedorahosted.org/sssd/ticket/364 Looks up trusted domain objects in the LDAP and stores them as AD subdomains. Currently only trusted domains that run NT5 or newer from the same forest are looked up and stored.
2013-06-07LDAP: new SDAP domain structureJakub Hrozek1-1/+3
Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
2013-06-07LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek1-1/+1
With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
2013-05-22Fix return code for AD subdomain requestSumit Bose1-1/+3
2013-05-15Fix segfault in AD Subdomains ModuleLukas Slebodnik1-0/+2
In function ad_subdomains_get_netlogon_done: If variable "reply_count" is zero then variable "reply" will not be initialized. Therefore we should not continue.
2013-05-07AD: read flat name and SID of the AD domainSumit Bose1-0/+522
For various features either the flat/short/NetBIOS domain name or the domain SID is needed. Since the responders already try to do a subdomain lookup when and known domain name is encountered I added a subdomain lookup to the AD provider which currently only reads the SID from the base DN and the NetBIOS name from a reply of a LDAP ping. The results are written to the cache to have them available even if SSSD is started in offline mode. Looking up trusted domains can be added later. Since all the needed responder code is already available from the corresponding work for the IPA provider this patch fixes https://fedorahosted.org/sssd/ticket/1468
generated by cgit (git 2.34.1) at 2024-11-18 01:30:21 +0000