summaryrefslogtreecommitdiff
path: root/src/providers/ipa
AgeCommit message (Collapse)AuthorFilesLines
2013-06-28Add ipa_idmap_init()Sumit Bose3-1/+275
Use the sdap_idmap context for the IPA provider as well. https://fedorahosted.org/sssd/ticket/1961
2013-06-28Add now options ldap_min_id and ldap_max_idSumit Bose1-0/+2
Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
2013-06-27SSH: When host is removed from LDAP, remove it from the cache as wellJan Cholasta1-1/+8
https://fedorahosted.org/sssd/ticket/1949
2013-06-27AD: Write out domain-realm mappingsJakub Hrozek1-164/+3
This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
2013-06-25krb5: do not send pac for IPA users from the local domainSumit Bose1-0/+1
So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
2013-06-24IPA: Do not download or store the member attribute of host groupsJakub Hrozek2-2/+0
https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
2013-06-17handle ERR_ACCOUNT_EXPIRED properlyPavel Březina1-0/+4
https://fedorahosted.org/sssd/ticket/1953
2013-06-16subdomains: touch krb5.conf when creating new domain-realm mappingsPavel Březina1-0/+8
https://fedorahosted.org/sssd/ticket/1815
2013-06-12Fix minor typosYuri Chornoivan1-1/+1
2013-06-10A new option krb5_use_kdcinfoJakub Hrozek2-12/+25
https://fedorahosted.org/sssd/ticket/1883 The patch introduces a new Kerberos provider option called krb5_use_kdcinfo. The option is true by default in all providers. When set to false, the SSSD will not create krb5 info files that the locator plugin consumes and the user would have to set up the Kerberos options manually in krb5.conf
2013-06-10providers: refresh expired netgroupsPavel Březina1-0/+10
https://fedorahosted.org/sssd/ticket/1713
2013-06-07Move domain_to_basedn outside IPA subtreeJakub Hrozek2-65/+0
The utility function will be reused to guess search base from the base DN of AD trusted domains.
2013-06-07LDAP: new SDAP domain structureJakub Hrozek2-12/+19
Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
2013-06-07LDAP: Pass in a connection to ID functionsJakub Hrozek1-1/+1
Instead of using the default connection from the sdap_id_ctx, allow the caller to specify which connection shall be used for this particular request. Again, no functional change is present in this patch, just another parameter is added.
2013-06-07LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek8-15/+11
With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
2013-06-07Do not obfuscate calls with booleansJakub Hrozek1-7/+21
Instead of using boolean variables to denote whether the call is adding a primary or a secondary server, use a function wrapper that tells what it's doing by its name.
2013-05-30Add utility functions for formatting fully-qualified namesJakub Hrozek1-4/+4
Instead of using printf-like functions directly, provide two wrappers that would encapsulate formatting the fully-qualified names. No functional change is present in this patch.
2013-05-28IPA: Check for ENOMEMJakub Hrozek1-0/+3
2013-05-27Fix dyndns timer initializationJakub Hrozek2-2/+8
The dyndns init function was starting the timer even if the updates were set to False. This patch splits the init of dynamic updates and the timer into two functions so that the back end can start the updates separately from reading the options.
2013-05-27IPA: read user and group SIDSumit Bose1-2/+2
To allow mapping of SIDs to names or POSIX IDs and back the related attributes must be read from the FreeIPA directory server.
2013-05-27IPA: Always initialize ID mappingSumit Bose1-4/+10
Because we now always want to store SIDs in the IPA provider, we also need to always initialize the ID mapping context.
2013-05-23Adding option to disable retrieving large AD groups.Lukas Slebodnik1-0/+1
This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
2013-05-20Remove unneeded parameter of setup_child and namespace itJakub Hrozek1-1/+1
setup_child() was accepting a parameter it didn't use. Also the function name was too generic, so I added a sdap prefix.
2013-05-14Fix broken build with selinux.Lukas Slebodnik2-2/+4
Header file selinux/selinux.h was removed in commit 245cc346 from file ipa_selinux.c, because it breaks build without selinux. But new error was introduced. This patch fixes compilation with selinux and include header file selinux/selinux.h only if both macros exist HAVE_SELINUX and HAVE_SELINUX_LOGIN_DIR. Now ipa_selinux.c should be correctly built with and without selinux.
2013-05-13Fixes compilation without selinux.Lukas Slebodnik1-1/+0
Compilation fail if ./configure is called with arguments --with-selinux --with-semanage and selinux header files are not installed. We didn't not catch this in fedora, because krb5-devel depends on libselinux-devel, but other distribution can package it differently. And API from selinux.h is not used in file ipa_selinux.c
2013-05-03Split out the common code from timed DNS updatesJakub Hrozek1-60/+12
2013-05-03dyndns: new option dyndns_authJakub Hrozek2-0/+2
This options is mostly provided for future expansion. Currently it is undocumented and both IPA and AD dynamic DNS updates default to GSS-TSIG. Allowed values are GSS-TSIG and none.
2013-05-03dyndns: new option dyndns_force_tcpJakub Hrozek1-0/+1
https://fedorahosted.org/sssd/ticket/1831 Adds a new option that can be used to force nsupdate to only use TCP to communicate with the DNS server.
2013-05-03dyndns: New option dyndns_update_ptrJakub Hrozek2-1/+4
https://fedorahosted.org/sssd/ticket/1832 While some servers, such as FreeIPA allow the PTR record to be synchronized when the forward record is updated, other servers, including Active Directory, require that the PTR record is synchronized manually. This patch adds a new option, dyndns_update_ptr that automatically generates appropriate DNS update message for updating the reverse zone. This option is off by default in the IPA provider. Also renames be_nsupdate_create_msg to be_nsupdate_create_fwd_msg
2013-05-03dyndns: new option dyndns_refresh_intervalJakub Hrozek4-1/+114
This new options adds the possibility of updating the DNS entries periodically regardless if they have changed or not. This feature will be useful mainly in AD environments where the Windows clients periodically update their DNS records.
2013-05-03Convert IPA-specific options to be back-end agnosticJakub Hrozek5-28/+123
This patch introduces new options for dynamic DNS updates that are not specific to any back end. The current ipa dyndns options are still usable, just with a deprecation warning.
2013-05-03Refactor dynamic DNS updatesJakub Hrozek2-1164/+75
Provides two new layers instead of the previous IPA specific layer: 1) dp_dyndns.c -- a very generic dyndns layer on the DP level. Its purpose it to make it possible for any back end to use dynamic DNS updates. 2) sdap_dyndns.c -- a wrapper around dp_dyndns.c that utilizes some LDAP-specific features like autodetecting the address from the LDAP connection. Also converts the dyndns code to new specific error codes.
2013-05-03Add SID related lookups to IPA subdomainsSumit Bose2-29/+213
This patch add the functionality to handle lookup by SIDs and lookups for SIDs to the subdomain branch of the IPA ID provider.
2013-05-03SUDO: IPA providerLukas Slebodnik3-0/+84
This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733
2013-05-02Use struct to hold different types of request parametersSumit Bose4-26/+48
Currently the POSIX ID or the user name are passed in different parameters to some calls. The method will get cumbersome and error-prone if new parameters like, e.g. the SID, are added. This patch adds a union to hold the different kind of parameters.
2013-05-02Remove unused attribute listSumit Bose3-14/+1
2013-05-02IPA SRV plugin: improve debuggingPavel Březina1-0/+6
2013-05-02IPA SRV plugin: use fo_discover_servers requestPavel Březina1-105/+20
2013-04-29selinux: if no domain matches, make the debug message louderJakub Hrozek1-3/+3
2013-04-29Make IPA SELinux provider aware of subdomain usersSumit Bose3-2/+41
Fixes https://fedorahosted.org/sssd/ticket/1892
2013-04-22Allow usage of enterprise principalsSumit Bose1-0/+1
Enterprise principals are currently most useful for the AD provider and hence enabled here by default while for the other Kerberos based authentication providers they are disabled by default. If additional UPN suffixes are configured for the AD domain the user principal stored in the AD LDAP server might not contain the real Kerberos realm of the AD domain but one of the additional suffixes which might be completely randomly chooses, e.g. are not related to any existing DNS domain. This make it hard for a client to figure out the right KDC to send requests to. To get around this enterprise principals (see http://tools.ietf.org/html/rfc6806 for details) were introduced. Basically a default realm is added to the principal so that the Kerberos client libraries at least know where to send the request to. It is not in the responsibility of the KDC to either handle the request itself, return a client referral if he thinks a different KDC can handle the request or return and error. This feature is also use to allow authentication in AD environments with cross forest trusts. Fixes https://fedorahosted.org/sssd/ticket/1842
2013-04-10DNS sites support - add IPA SRV pluginPavel Březina5-5/+369
https://fedorahosted.org/sssd/ticket/1032
2013-04-10DNS sites support - use SRV DNS lookup plugin in all providersPavel Březina1-0/+10
https://fedorahosted.org/sssd/ticket/1032 We set a plugin during an initialization of ID provider, which is an authoritative provider for a plugin choice. The plugin is set only once. When other provider is initalized (e.g. id = IPA, sudo = LDAP), we do not overwrite the plugin. Since sssm_*_id_init() is called from all module constructors, this patch relies on the fact, that ID provider is initialized before all other providers.
2013-04-10Allow using flatname for subdomain home dir templateJakub Hrozek1-1/+2
https://fedorahosted.org/sssd/ticket/1609
2013-04-04dyndns: Fix initializing sdap_id_ctxJakub Hrozek1-1/+1
2013-04-03Centralize resolv_init, remove resolv context listJakub Hrozek1-8/+1
2013-04-03Init failover with be_res optionsJakub Hrozek1-20/+7
2013-04-03Allow setting krb5_renew_interval with a delimiterAriel Barria1-1/+1
https://fedorahosted.org/sssd/ticket/902 changed the data type the krb5_renew_interval to string. function krb5_string_to_deltat is used to convert and allow delimiters
2013-04-02Making the authtok structure really opaque.Lukas Slebodnik1-1/+1
Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
2013-03-27selinux: Remove unused parameterJakub Hrozek1-1/+0
https://fedorahosted.org/sssd/ticket/1848
generated by cgit (git 2.34.1) at 2024-11-05 08:11:26 +0000