sssd - System Security Services Daemon

Age	Commit message (Collapse)	Author	Files	Lines
2013-09-09	krb5: Remove unused ccache backend infrastructure	Simo Sorce	1	-1/+0
	Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-06-25	krb5: do not send pac for IPA users from the local domain	Sumit Bose	1	-0/+1
	So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
2013-03-08	Add support for krb5 1.11's responder callback.	Nathaniel McCallum	1	-0/+1
	krb5 1.11 adds support for a new method for responding to structured data queries. This method, called the responder, provides an alternative to the prompter interface. This patch adds support for this method. It takes the password and provides it via a responder instead of the prompter. In the case of OTP authentication, it also disables the caching of credentials (since the credentials are one-time only).
2012-12-04	Fix tevent_req style for krb5_auth	Simo Sorce	1	-3/+3
	No functionality changes, just make the code respect the tevent_req style and naming conventions and enhance readability by adding some helper functions.
2012-10-26	Use find_or_guess_upn() where needed	Sumit Bose	1	-1/+1

2012-10-26	krb5_child: send back the client principal	Sumit Bose	1	-0/+1
	In general Kerberos is case sensitive but the KDC of Active Directory typically handles request case in-sensitive. In the case where we guess a user principal by combining the user name and the realm and are not sure about the cases of the letters used in the user name we might get a valid ticket from the AD KDC but are not able to access it with the Kerberos client library because we assume a wrong case. The client principal in the returned credentials will always have the right cases. To be able to update the cache user principal name the krb5_child will return the principal for further processing.
2012-10-26	krb5_auth: check if principal belongs to a different realm	Sumit Bose	1	-0/+1
	Add a flag if the principal used for authentication does not belong to our realm. This can be used to act differently for users from other realms.
2012-06-14	Add a credential cache back end structure	Jakub Hrozek	1	-0/+1
	To be able to add support for new credential cache types easily, this patch creates a new structure sss_krb5_cc_be that defines common operations with a credential cache, such as create, check if used or remove.
2012-06-14	Split parse_krb5_child_response so it can be reused	Jakub Hrozek	1	-0/+11
	krb5-child-test will be another consumer. It also makes the code more readable by splitting a huge function.
2011-12-19	Move child_common routines to util	Stephen Gallagher	1	-1/+1

2010-12-20	Serialize requests of the same user in the krb5 provider	Sumit Bose	1	-0/+6

2010-12-20	Fixes for automatic ticket renewal	Sumit Bose	1	-1/+2
	- do not recreate the ccache file when renewing the TGT - use user principal name as hash key instead of ccfile name - let krb5_child return Kerberos error codes
2010-12-03	Add support for automatic Kerberos ticket renewal	Sumit Bose	1	-0/+5

2010-11-04	Make handle_child_* request public	Sumit Bose	1	-6/+8
	I took the opportunity to move everything related to the handling of the krb5_child into a separate file and cleaned the interfaces and related structures a bit.
2010-11-04	Make krb5_setup() public	Sumit Bose	1	-0/+3

2010-11-04	Add infrastructure for Kerberos access provider	Sumit Bose	1	-0/+8

2010-06-14	Remove krb5_changepw_principal option	Jakub Hrozek	1	-1/+0
	Fixes: #531
2010-05-27	Add callback to remove krb5 info files when going offline	Sumit Bose	1	-40/+0

2010-05-26	Fix handling of ccache file when going offline	Sumit Bose	1	-0/+1
	The ccache file was removed too early if system is offline but the backend was not already marked offline. Now we remove the ccache file only if the successfully got a new one and it is not the same as the old one.
2010-05-26	Add support for delayed kinit if offline	Sumit Bose	1	-0/+10
	If the configuration option krb5_store_password_if_offline is set to true and the backend is offline the plain text user password is stored and used to request a TGT if the backend becomes online. If available the Linux kernel key retention service is used.
2010-05-16	Make Kerberos authentication a tevent_req	Sumit Bose	1	-1/+6
	To allow other providers to include Kerberos authentication the main part is put into a tevent request.
2010-03-12	Add krb5_kpasswd option	Sumit Bose	1	-0/+2

2010-03-11	Add expandable sequences to krb5_ccachedir	Sumit Bose	1	-0/+6
	As with krb5_ccname_template sequences like %u can be used in the krb5_ccachedir parameter which are expanded at runtime. If the directory does not exist, it will be created. Depending on the used sequences it is created as a public or private directory.
2010-02-19	Remove unneeded items from struct pam_data	Sumit Bose	1	-0/+3

2010-02-18	Rename server/ directory to src/	Stephen Gallagher	1	-0/+91
	Also update BUILD.txt