summaryrefslogtreecommitdiff
path: root/src/providers/krb5/krb5_utils.h
AgeCommit message (Collapse)AuthorFilesLines
2013-10-07krb5: Remove ability to create public directoriesSimo Sorce1-3/+3
Setting up public directories is the job of the admin, and current sssd syntax can't express the actual intention of the admin with regrads to which parts of the path should be public or private. Resolves: https://fedorahosted.org/sssd/ticket/2071
2013-09-12KRB: Remove unused memory contextLukas Slebodnik1-1/+1
mem_ctx was unused in function get_domain_or_subdomain
2013-09-09krb5: Remove unused ccache backend infrastructureSimo Sorce1-17/+0
Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Unify function to create ccache filesSimo Sorce1-12/+2
Only 2 types (FILE and DIR) need to precreate files or directories on the file system, and the 2 functions were basically identical. Consolidate all in one common function and use that function directly where needed instead of using indirection. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Use new function to validate ccachesSimo Sorce1-4/+2
This function replaces and combines check_for_valid_tgt() and type specific functions that checked for ccache existence by using generic krb5 cache function and executing them as the target user (implicitly validate the target use rcan properly access the ccache). Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: move template check to initializzationSimo Sorce1-1/+1
The randomized template check realy only makes sense for the FILE ccache which is the only one that normally needs to use randomizing chars. Also it is better to warn the admin early rather than to warn 'when it is too late'. So move the check at initialization time when we determine what the template actually is. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Move determination of user being activeSimo Sorce1-2/+1
The way a user is checked for being active does not depend on the ccache type so move that check out of the ccache specific functions. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Replace type-specific ccache/principal checkSimo Sorce1-4/+2
Instead of having duplicate functions that are type custom use a signle common function that also performs access to the cache as the user owner, implicitly validating correctness of ownership. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Use krb5_cc_destroy to remove old ccachesSimo Sorce1-2/+0
This completely replaces the per-ccache-type custom code to remove old cacches and instead uses libkrb5 base doperations (krb5_cc_destroy) and operating as the user owner. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Add helper to destroy ccache as userSimo Sorce1-0/+2
This function safely destroy a ccache given a cache name and user crdentials. It becomes the user so no possible races can compromise the system, then uses libkrb5 functions to properly destroy a ccache, independently of the cache type. Finally restores the original credentials after closing the ccache handlers. Resolves: https://fedorahosted.org/sssd/ticket/2061
2013-09-09krb5: Add calls to change and restore credentialsSimo Sorce1-0/+6
In some cases we want to temporarily assume user credentials but allow the process to regain back the original credentials (normally regaining uid 0). Related: https://fedorahosted.org/sssd/ticket/2061
2013-08-27KRB5: Add support for KEYRING cache typeStephen Gallagher1-0/+2
https://fedorahosted.org/sssd/ticket/2036
2013-08-22KRB5: Add new #define for collection cache typesStephen Gallagher1-2/+2
Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
2013-06-27KRB5: guess UPN for subdomain usersJakub Hrozek1-1/+1
2013-03-19Removing unused declaration of functions and variable.Lukas Slebodnik1-2/+2
Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
2013-01-15Add domain argument to sysdb_get_user_attr()Simo Sorce1-0/+1
2012-10-26krb5_auth: update with correct UPN if neededSumit Bose1-0/+4
The Active Directory KDC handles request case in-sensitive and it might not always to possible to guess the UPN with the correct case. We check if the returned principal has a different case then the one used in the request and updates the principal if needed. This will help using calls from the Kerberos client libraries later on which would otherwise fail because the principal is handled case sensitive by those libraries.
2012-10-26Add new call find_or_guess_upn()Sumit Bose1-0/+5
With the current approach the upn was either a pointer to a const string in a ldb_message or a string created with the help of talloc. This new function always makes it a talloc'ed value. Additionally krb5_get_simple_upn() is enhanced to handle sub-domains as well.
2012-10-26krb5_auth_send: check for sub-domainsSumit Bose1-0/+3
If there is an authentication request for a user from a sub-domain a temporary sysdb context is generated to allow lookups in the corresponding sub-tree in the cache.
2012-10-04Log possibly non-randomizable ccache file templateOndrej Kos1-1/+2
fixes https://fedorahosted.org/sssd/ticket/1533 ccache file template is now checked for appended XXXXXX for use with mkstemp. When those characters are not present, warning is written to log.
2012-06-15KRB5: Auto-detect DIR cache support in configureStephen Gallagher1-4/+11
We can't support the DIR cache features in systems with kerberos libraries older than 1.10. Make sure we don't build it on those systems.
2012-06-14Add support for storing credential caches in the DIR: back endJakub Hrozek1-0/+7
https://fedorahosted.org/sssd/ticket/974
2012-06-14Add a credential cache back end structureJakub Hrozek1-4/+29
To be able to add support for new credential cache types easily, this patch creates a new structure sss_krb5_cc_be that defines common operations with a credential cache, such as create, check if used or remove.
2011-12-21Honor case sensitive flag when creating the ccname templateJakub Hrozek1-1/+1
2011-02-22Check ccache file for renewable TGTs at startupSumit Bose1-0/+3
2010-03-11Add expandable sequences to krb5_ccachedirSumit Bose1-1/+5
As with krb5_ccname_template sequences like %u can be used in the krb5_ccachedir parameter which are expanded at runtime. If the directory does not exist, it will be created. Depending on the used sequences it is created as a public or private directory.
2010-02-18Rename server/ directory to src/Stephen Gallagher1-0/+39
Also update BUILD.txt
generated by cgit (git 2.34.1) at 2024-05-15 17:10:00 +0000