summaryrefslogtreecommitdiff
path: root/src/providers/ipa
AgeCommit message (Collapse)AuthorFilesLines
2013-01-21Remove domain from be_req structureSimo Sorce4-60/+45
2013-01-21Pass domain not be_req to access check functionsSimo Sorce1-1/+1
2013-01-21Do not pass NULL to ipa_subdomain_retrieve()Simo Sorce1-18/+20
2013-01-21Move hbac_ctx_is_offline()Simo Sorce2-7/+6
2013-01-21Remove hbac_ctx_sdap_id_[ctx|op]()Simo Sorce2-18/+6
2013-01-21Remove hbac_ctx_ev()Simo Sorce2-10/+3
2013-01-21Remove hbac_ctx_be()Simo Sorce3-12/+4
2013-01-21Remove hbac_ctx_sysdb()Simo Sorce2-12/+4
2013-01-21Remove sysdb argument from hbac_get_cached_rules()Simo Sorce3-9/+6
2013-01-21Remove sysdb arg from [ipa_]hbac_sysdb_save()Simo Sorce3-36/+25
Also make ipa_hbac_save_list() static
2013-01-21Remove sysdb arg from ipa_hbac_service_info_send()Simo Sorce3-5/+0
2013-01-21Remove sysdb arg from hbac_*host_attrs_to_rule()Simo Sorce3-11/+4
2013-01-21Remove sysdb arg from hbac_service_attrs_to_rule()Simo Sorce3-5/+2
2013-01-21Remove sysdb argument from hbac_user_attrs_to_rule()Simo Sorce3-6/+4
2013-01-21Remove unused structureSimo Sorce1-6/+0
2013-01-21Remove sysdb argument from ipa_host_info_send()Simo Sorce5-9/+3
2013-01-21Remove sysdb as a be request structure memberSimo Sorce3-7/+7
The sysdb context is already available through the 'domain' context.
2013-01-21Remove sysdb as a be context structure memberSimo Sorce5-13/+13
The sysdb context is already available through the 'domain' structure.
2013-01-15Add domain to some subdomain functionsSimo Sorce1-2/+7
2013-01-15Add domain arguments to sysdb ssh functionsSimo Sorce1-1/+2
2013-01-15Add domain argument to sysdb selinux functionsSimo Sorce3-4/+9
2013-01-15Add domain arg to sysdb_search/delete_netgroup()Simo Sorce1-1/+1
2013-01-15Add domain argument to sysdb_search_groups()Simo Sorce1-1/+1
2013-01-15Add domain arg to sysdb_search_users()Simo Sorce3-1/+5
2013-01-15Add domain argument to sysdb_search_custom()Simo Sorce7-8/+22
Also changes sysdb_search_custom_by_name()
2013-01-15Add domain argument to sysdb_store_custom()Simo Sorce1-1/+1
2013-01-15Add domain argument to sysdb_store_group()Simo Sorce1-3/+2
Also remove sysdb_store_domgroup()
2013-01-15Add domain argument to sysdb_store_user()Simo Sorce1-5/+4
Also remove sysdb_store_domuser()
2013-01-15Add domain arguments to sysdb_add_inetgroup fns.Simo Sorce1-1/+1
2013-01-15Add domain to sysdb_search_user_by_name()Simo Sorce3-4/+8
Also remove unused sysdb_search_domuser_by_name()
2013-01-15Make sysdb_custom_subtree_dn() require a domain.Simo Sorce2-2/+2
2013-01-15Make sysdb_custom_dn() require a domain.Simo Sorce2-5/+9
2013-01-15Remove the sysdb_ctx_get_domain() function.Simo Sorce1-1/+4
We are deprecating sysdb->domain so kill the function that gives access to this member as we should stop relying on it being available (or correct).
2013-01-10Change pam data auth tokens.Simo Sorce1-5/+1
Use the new authtok abstraction and interfaces throught the code.
2013-01-08IPA: Rename IPA_CONFIG_SELINUX_DEFAULT_MAPJakub Hrozek3-4/+6
It is not a map, but a default context. The name should reflect that.
2013-01-08SELINUX: Process maps even when offlineJakub Hrozek1-226/+429
Changes the ipa_get_selinux{send,recv} request so that it only delivers data and moves processing to the IPA selinux handler.
2013-01-08SYSDB: Remove duplicate selinux definesJakub Hrozek1-0/+1
2013-01-02failover: Protect against empty host namesMichal Zidek1-1/+1
Added new parameter to split_on_separator that allows to skip empty values. The whole function was rewritten. Unit test case was added to check the new implementation. https://fedorahosted.org/sssd/ticket/1484
2012-12-04Use an entry type mask macro to filter entry typesSimo Sorce2-3/+3
Avoids hardcoding magic numbers everywhere and self documents why a mask is being applied.
2012-12-04Streamline ipa_account_info handlerSimo Sorce1-74/+55
In particular note that we merge ipa_account_info_netgroups_done() and ipa_account_info_users_done() into a single fucntion called ipa_account_info_done() that handles both cases We also remove the auxiliary function ipa_account_info_complete() that unnecessarily violates the tevent_req style and instead use a new function named ipa_account_info_error_text() to generate error text.
2012-12-04Fix tevent_req style for get_netgroup in ipa_idSimo Sorce1-80/+71
Also do not intermix two tevent_req sequences
2012-12-04Fix ipa_subdomain_id names and tevent_req styleSimo Sorce3-52/+36
2012-12-02IPA: Handle bad results from c-ares lookupStephen Gallagher1-1/+11
In some situations, the c-ares lookup can return NULL instead of a list of addresses. In this situation, we need to avoid dereferencing NULL. This patch adds a log message and sets the count to zero so it is handled appropriately below.
2012-11-20fix SIGSEGV in IPA provider when ldap_sasl_authid is not setPavel Březina1-1/+1
https://fedorahosted.org/sssd/ticket/1657 IPA_HOSTNAME is not stored in ipa_opts->id options so it the option was always NULL here. This caused SIGSEGV when accessed by strchr() in subsequent function.
2012-11-20LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek1-1/+0
https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
2012-11-19LDAP: Provide a common sdap_set_sasl_options init functionJakub Hrozek1-47/+8
The AD and IPA initialization functions shared the same code. This patch moves the code into a common initialization function.
2012-11-19Do not save HBAC rules in subdomain subtreeSumit Bose2-13/+16
Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the configured domain apply to all users it is sufficient to save them once in the subtree of the configured domain. Since most of the sysdb operations during a HBAC request are related to the HBAC rules and related data this patch does not change the default sysdb context but only create a special context to look up subdomain users.
2012-11-19Refactor the way subdomain accounts are savedSimo Sorce1-4/+50
The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
2012-11-14Run IPA subdomain provider if IPA ID provider is configuredSumit Bose1-1/+67
To make configuration easier the IPA subdomain provider should be always loaded if the IPA ID provider is configured and the subdomain provider is not explicitly disabled. But to avoid the overhead of regular subdomain requests in setups where no subdomains are used the IPA subdomain provider should behave differently if configured explicit or implicit. If the IPA subdomain provider is configured explicitly, i.e. 'subdomains_provider = ipa' can be found in the domain section of sssd.conf subdomain request are always send to the server if needed. If it is configured implicitly and a request to the server fails with an indication that the server currently does not support subdomains at all, e.g. is not configured to handle trust relationships, a new request will be only send to the server after a long timeout or after a going-online event. To be able to make this distinction this patch save the configuration status to the subdomain context. Fixes https://fedorahosted.org/sssd/ticket/1613
2012-11-12subdomains: check request type on one place onlyPavel Březina1-6/+0
The check is now held only in ipa_get_subdomain_account_info_send().
generated by cgit (git 2.34.1) at 2024-11-18 11:48:05 +0000