summaryrefslogtreecommitdiff
path: root/src/providers/ad
AgeCommit message (Collapse)AuthorFilesLines
2013-10-04AD: properly intitialize GC from ad_server optionSumit Bose1-1/+1
2013-09-27AD: talk to GC first even for local domain objectsJakub Hrozek2-7/+18
Related: https://fedorahosted.org/sssd/ticket/2070 Since we are recommending to configure the POSIX attributes so that they are replicated to the Global Catalog, we can start connecting to the GC by default even for local users. If the object is not matches in the GC, there is a possibility to fall back to LDAP.
2013-09-27ipa_server_mode: write capaths to krb5 include fileSumit Bose1-1/+1
If there are member domains in a trusted forest which are DNS-wise not proper children of the forest root the IPA KDC needs some help to determine the right authentication path. In general this should be done internally by the IPA KDC but this works requires more effort than letting sssd write the needed data to the include file for krb5.conf. If this functionality is available for the IPA KDC this patch might be removed from the sssd tree. Fixes https://fedorahosted.org/sssd/ticket/2093
2013-09-27IPA: store forest name for forest member domainsSumit Bose1-1/+1
In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
2013-09-24Include header file in implementation module.Lukas Slebodnik2-0/+2
Declarations of public functions was in header files, but header files was not included in implementation file.
2013-09-20AD: Failure to get flat name is not fatalJakub Hrozek3-68/+86
https://fedorahosted.org/sssd/ticket/2067 Some AD or AD-like servers do not contain the netlogon attribute in the master domain name. Instead of failing completely, we should just abort the master domain request and carry on. The only functionality we miss would be getting users by domain flat name.
2013-09-18AD: Download master domain info when enumeratingJakub Hrozek3-1/+200
https://fedorahosted.org/sssd/ticket/2068 With the current design, downloading master domain data was tied to subdomains refresh, triggered by responders. But because enumeration is a background task that can't be triggered on its own, we can't rely on responders to download the master domain data and we need to check the master domain on each enumeration request.
2013-09-18AD: async request to retrieve master domain infoJakub Hrozek4-214/+414
Adds a reusable async request to download the master domain info.
2013-09-17util: add sss_idmap_talloc[_free]Pavel Březina1-11/+3
Remove code duplication.
2013-09-11Fix formating of variables with type: size_tLukas Slebodnik1-2/+2
2013-09-05AD: Rename parametrized #defineJakub Hrozek1-3/+3
2013-09-05ad srv: prefer servers that are in the same domain as clientPavel Březina1-0/+89
https://fedorahosted.org/sssd/ticket/2001
2013-09-02Fix czech specific character in my namePavel Březina2-2/+2
2013-08-28SYSDB: Store enumerate flag for subdomainJakub Hrozek1-2/+2
2013-08-28LDAP: Make sdap_id_setup_tasks reusable for subdomainsJakub Hrozek1-1/+1
Instead of always performing the setup for the main domain, the setup can now be performed for subdomains as well.
2013-08-28DB: remove unused realm parameter from sysdb_master_domain_add_infoJakub Hrozek1-1/+1
The parameter was not used at all.
2013-08-28krb5: Fetch ccname template from krb5.confStephen Gallagher1-1/+1
In order to use the same defaults in all system daemons that needs to know how to generate or search for ccaches we introduce ode here to take advantage of the new option called default_ccache_name provided by libkrb5. If set this variable we establish the same default for all programs that surce it out of krb5.conf therefore providing a consistent experience across the system. Related: https://fedorahosted.org/sssd/ticket/2036
2013-08-19AD: Use the correct include guardJakub Hrozek1-3/+3
2013-08-09AD: Cast SASL callbacks to propper typeOndrej Kos1-1/+3
The initialization of ad_sasl_callbacks raised an incompatible pointer type warning. This was caused because the cyrus-sasl API hasa changed. The callback function list needs to be cast now.
2013-08-06sssd_ad: Add hackish workaround for sasl ad_compatSimo Sorce1-0/+41
This tries to set the ad_compat option for sasl, by working around the openldap/sasl initialization as openldap does not allow us to pass down to sasl our own getopt callback. Resolves: https://fedorahosted.org/sssd/ticket/2040
2013-07-23KRB5: Do not send PAC in server modeJakub Hrozek1-0/+1
The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
2013-07-19AD: Set the bool value same as default value in optsJakub Hrozek1-4/+4
https://fedorahosted.org/sssd/ticket/2023 When the option values are copied using dp_opt_copy_map, the .val member is used if it's not NULL. At the same time, the bool options are never NULL, unlike integers or strings that can have special NULL-like values such as NULL_STRING. This effectively means that when copying a bool option, the .val member is always used. But in the AD maps, some .val fields were set differently from the .def_val fields. The effect was that when the AD subdomain provider was initialized from IPA subdomain provider using only the defaults, some options (notably referral chasing) were set to a value that didn't make sense for the AD provider. This patch makes sure that for all boolean option, the .val is always the same as .def_val.
2013-06-28IPA: Look up AD users directly if IPA server mode is onJakub Hrozek2-2/+13
https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
2013-06-28AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek1-65/+1
Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28AD: initialize failover with custom realm, domain and failover serviceJakub Hrozek3-28/+41
This is needed so we can initialize failover using IPA realm and on-the-fly discovered DNS domain. The subdomains discovered on-thefly will use the subdomain name for realm, domain and failover service to avoid conflicts. Subtaks of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28AD: decouple ad_id_ctx initializationJakub Hrozek3-102/+285
The IPA subdomain code will perform lookups on its own in the server mode. For this, the AD provider must offer a way to initialize the ad_id_ctx for external consumers. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28Save mpg state for subdomainsSumit Bose1-1/+3
The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
2013-06-28Replace new_subdomain() with find_subdomain_by_name()Sumit Bose1-3/+2
new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
2013-06-28Add now options ldap_min_id and ldap_max_idSumit Bose1-0/+2
Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
2013-06-27AD: Write out domain-realm mappingsJakub Hrozek1-0/+7
This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
2013-06-26AD: kinit with the local DC even when talking to a GCJakub Hrozek2-4/+21
We tried to use the GC address even for kinit which gave us errors like: "Realm not local to KDC while getting initial credentials". This patch adds a new AD_GC service that is only used for ID lookups, any sort of Kerberos operations are done against the local servers.
2013-06-26Use forest for GC SRV lookupsSumit Bose1-12/+40
https://fedorahosted.org/sssd/ticket/1973
2013-06-17handle ERR_ACCOUNT_EXPIRED properlyPavel Březina1-0/+4
https://fedorahosted.org/sssd/ticket/1953
2013-06-17Fix allocation checkJakub Hrozek1-1/+1
2013-06-14AD: Remove ad_options->auth options referenceJakub Hrozek1-1/+0
The options are stored in ad_options->auth_ctx->opts, this member was completely unused and confusing.
2013-06-14AD: Fix segfault in DEBUG messageJakub Hrozek1-1/+1
2013-06-12Use the correct talloc context when creating AD subdomainsJakub Hrozek1-1/+1
sdom was only ever guaranteed to be set when a new domain was being created. sditer is a valid pointer in both cases, so just use that.
2013-06-11Fix allocation check in the AD providerJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1976
2013-06-10A new option krb5_use_kdcinfoJakub Hrozek2-14/+27
https://fedorahosted.org/sssd/ticket/1883 The patch introduces a new Kerberos provider option called krb5_use_kdcinfo. The option is true by default in all providers. When set to false, the SSSD will not create krb5 info files that the locator plugin consumes and the user would have to set up the Kerberos options manually in krb5.conf
2013-06-10providers: refresh expired netgroupsPavel Březina1-0/+10
https://fedorahosted.org/sssd/ticket/1713
2013-06-07AD: Store trusted AD domains as subdomainsJakub Hrozek1-2/+364
https://fedorahosted.org/sssd/ticket/364 Looks up trusted domain objects in the LDAP and stores them as AD subdomains. Currently only trusted domains that run NT5 or newer from the same forest are looked up and stored.
2013-06-07AD ID lookups - choose GC or LDAP as appropriateJakub Hrozek1-1/+262
https://fedorahosted.org/sssd/ticket/1557 Some lookups should be performed from GC only -- for example trusted users are only present in the Global Catalog, while some lookups should be performed from LDAP only as not all objects or attributes are replicated to Global Catalog. This patch adds a generic failover mechanism for identity lookups in the AD provider that allows to choose the appropriate source and even fail over to the other source if available.
2013-06-07AD: Add additional service to support Global Catalog lookupsJakub Hrozek3-33/+178
When fixed host names of AD servers are configured in the config file, we can't know (unlike when service discovery is at play) if the servers are Global Catalogs or not. This patch adds a private data to servers read from the config file that denote whether the server can be tried for contacting the Global Catalog port or just LDAP. The GC or LDAP URIs are generated based on contents of this private data structure. Because SSSD sticks to a working server, we don't have to disable or remove the faulty GC servers from the list.
2013-06-07LDAP: new SDAP domain structureJakub Hrozek2-6/+15
Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
2013-06-07LDAP: Pass in a connection to ID functionsJakub Hrozek1-1/+1
Instead of using the default connection from the sdap_id_ctx, allow the caller to specify which connection shall be used for this particular request. Again, no functional change is present in this patch, just another parameter is added.
2013-06-07LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2-27/+22
With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
2013-06-07Do not obfuscate calls with booleansJakub Hrozek1-7/+21
Instead of using boolean variables to denote whether the call is adding a primary or a secondary server, use a function wrapper that tells what it's doing by its name.
2013-05-28AD dyndns: extract the host name from URIJakub Hrozek1-9/+31
2013-05-27Fix dyndns timer initializationJakub Hrozek2-2/+9
The dyndns init function was starting the timer even if the updates were set to False. This patch splits the init of dynamic updates and the timer into two functions so that the back end can start the updates separately from reading the options.
2013-05-23Adding option to disable retrieving large AD groups.Lukas Slebodnik1-0/+1
This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
generated by cgit (git 2.34.1) at 2024-05-17 06:59:10 +0000