Age | Commit message (Collapse) | Author | Files | Lines | |
---|---|---|---|---|---|
2010-12-07 | Replace krb5_kdcip by krb5_server in LDAP provider | Sumit Bose | 2 | -7/+10 | |
2010-12-07 | Add support for FAST in krb5 provider | Sumit Bose | 5 | -13/+344 | |
2010-12-07 | Refactor krb5_child to make helpers more flexible | Sumit Bose | 1 | -20/+36 | |
2010-12-03 | Allow krb5 lifetime values without a unit | Sumit Bose | 1 | -36/+65 | |
2010-12-03 | Add support for automatic Kerberos ticket renewal | Sumit Bose | 7 | -1/+420 | |
2010-12-03 | krb5_child returns TGT lifetime | Sumit Bose | 3 | -0/+57 | |
2010-12-03 | Add krb5_lifetime option | Sumit Bose | 3 | -2/+38 | |
2010-12-03 | Add krb5_renewable_lifetime option | Sumit Bose | 3 | -2/+42 | |
2010-12-03 | Check authtok type for krb5 auth and chpass | Sumit Bose | 1 | -0/+12 | |
2010-12-03 | Add a renew task to krb5_child | Sumit Bose | 1 | -0/+87 | |
2010-12-03 | Send authtok_type to krb5_child | Sumit Bose | 2 | -2/+6 | |
2010-12-01 | Allow protocol fallback for SRV queries | Jakub Hrozek | 1 | -1/+1 | |
https://fedorahosted.org/sssd/ticket/691 | |||||
2010-11-04 | Call krb5_child to check access permissions | Sumit Bose | 1 | -4/+121 | |
2010-11-04 | Make handle_child_* request public | Sumit Bose | 3 | -325/+429 | |
I took the opportunity to move everything related to the handling of the krb5_child into a separate file and cleaned the interfaces and related structures a bit. | |||||
2010-11-04 | Add krb5_kuserok() access check to krb5_child | Sumit Bose | 1 | -17/+73 | |
2010-11-04 | Make krb5_setup() public | Sumit Bose | 3 | -6/+8 | |
2010-11-04 | Add krb5_get_simple_upn() | Sumit Bose | 3 | -6/+30 | |
2010-11-04 | Add infrastructure for Kerberos access provider | Sumit Bose | 4 | -26/+184 | |
2010-11-04 | Store krb5 auth context for other targets | Sumit Bose | 1 | -1/+2 | |
2010-11-01 | Fix two return value checks | Sumit Bose | 1 | -2/+2 | |
2010-11-01 | Fix incorrect free of req in krb5_auth.c | Stephen Gallagher | 1 | -1/+1 | |
2010-10-19 | Option krb5_server is now used to store a list of KDCs instead of krb5_kdcip. | Jan Zeleny | 3 | -2/+48 | |
For the time being, if krb5_server is not found, still falls back to krb5_kdcip with a warning. If both options are present in config file, krb5_server has a higher priority. Fixes: #543 | |||||
2010-10-13 | Initialize kerberos service for GSSAPI | Jakub Hrozek | 2 | -1/+7 | |
2010-09-28 | Suppress some 'may be used uninitialized' warnings | Sumit Bose | 1 | -6/+12 | |
Additionally the handling of errno and the errno_t return value of functions is fixed in krb5_common.c. | |||||
2010-09-23 | Use new MIT krb5 API for better password expiration warnings | Sumit Bose | 1 | -0/+51 | |
2010-09-08 | Dead assignments cleanup in providers code | Jan Zeleny | 1 | -1/+0 | |
Dead assignments were deleted. Also prototype of function sdap_access_decide_offline() has been changed, since its return code was never used. Ticket: #586 | |||||
2010-09-02 | Fixed potential comparison of undefined variable | Jan Zeleny | 1 | -0/+1 | |
If the allocation on line 678 failed, the value of ret was undefined in following comparison. ENOMEM is now assigned before the comparison. Ticket: #578 | |||||
2010-06-30 | Add dns_discovery_domain option | Jakub Hrozek | 1 | -1/+1 | |
The service discovery used to use the SSSD domain name to perform DNS queries. This is not an optimal solution, for example from the point of view of authconfig. This patch introduces a new option "dns_discovery_domain" that allows to set the domain part of a DNS SRV query. If this option is not set, the default behavior is to use the domain part of the machine's hostname. Fixes: #479 | |||||
2010-06-16 | Standardize on correct spelling of "principal" for krb5 | Stephen Gallagher | 2 | -4/+4 | |
https://fedorahosted.org/sssd/ticket/542 | |||||
2010-06-14 | Remove krb5_changepw_principal option | Jakub Hrozek | 4 | -42/+22 | |
Fixes: #531 | |||||
2010-06-10 | Properly handle read() and write() throughout the SSSD | Stephen Gallagher | 1 | -7/+18 | |
We need to guarantee at all times that reads and writes complete successfully. This means that they must be checked for returning EINTR and EAGAIN, and all writes must be wrapped in a loop to ensure that they do not truncate their output. | |||||
2010-06-09 | Add a missing initializer | Sumit Bose | 1 | -1/+1 | |
2010-06-06 | Initialize pam_data in Kerberos child. | Sumit Bose | 1 | -1/+1 | |
2010-05-27 | Refactor krb5 SIGTERM handler installation | Sumit Bose | 3 | -14/+39 | |
2010-05-27 | Add callback to remove krb5 info files when going offline | Sumit Bose | 4 | -40/+156 | |
2010-05-27 | Refactor krb5_finalize() | Sumit Bose | 1 | -12/+27 | |
2010-05-27 | Revert "Create kdcinfo and kpasswdinfo file at startup" | Sumit Bose | 2 | -41/+1 | |
This reverts commit f3c31d11bf365eb6a79c4f698667915a4c81eeb7. | |||||
2010-05-26 | Fix handling of ccache file when going offline | Sumit Bose | 2 | -32/+76 | |
The ccache file was removed too early if system is offline but the backend was not already marked offline. Now we remove the ccache file only if the successfully got a new one and it is not the same as the old one. | |||||
2010-05-26 | Add support for delayed kinit if offline | Sumit Bose | 6 | -27/+425 | |
If the configuration option krb5_store_password_if_offline is set to true and the backend is offline the plain text user password is stored and used to request a TGT if the backend becomes online. If available the Linux kernel key retention service is used. | |||||
2010-05-26 | Handle Krb5 password expiration warning | Sumit Bose | 2 | -174/+195 | |
2010-05-26 | Try all servers during Kerberos auth | Jakub Hrozek | 1 | -23/+104 | |
The Kerberos backend would previously try only the first server and if it was unreachable, it immediatelly went offline. | |||||
2010-05-16 | Properly set up SIGCHLD handlers | Stephen Gallagher | 2 | -1/+6 | |
Instead of having all-purpose SIGCHLD handlers that try to catch every occurrence, we instead create a per-PID handler. This will allow us to specify callbacks to occur when certain children exit. | |||||
2010-05-16 | New version of IPA auth and password migration | Sumit Bose | 1 | -2/+2 | |
The current version modified some global structures to be able to use Kerberos and LDAP authentication during the IPA password migration. This new version only uses tevent requests. Additionally the ipaMigrationEnabled attribute is read from the IPA server to see if password migration is allowed or not. | |||||
2010-05-16 | Make Kerberos authentication a tevent_req | Sumit Bose | 2 | -215/+345 | |
To allow other providers to include Kerberos authentication the main part is put into a tevent request. | |||||
2010-05-07 | Use service discovery in backends | Jakub Hrozek | 3 | -6/+27 | |
Integrate the failover improvements with our back ends. The DNS domain used in the SRV query is always the SSSD domain name. Please note that this patch changes the default value of ldap_uri from "ldap://localhost" to "NULL" in order to use service discovery with no server set. | |||||
2010-05-07 | Create kdcinfo and kpasswdinfo file at startup | Sumit Bose | 2 | -1/+41 | |
2010-05-07 | Clean up kdcinfo and kpasswdinfo files when exiting | Stephen Gallagher | 3 | -2/+57 | |
2010-04-26 | Display a message if a password reset by root fails | Sumit Bose | 1 | -0/+7 | |
2010-04-12 | sysdb: convert sysdb_get_user_attr | Simo Sorce | 1 | -38/+13 | |
2010-04-12 | Remove remaining use of sysdb_transaction_send | Simo Sorce | 1 | -103/+49 | |