summaryrefslogtreecommitdiff
path: root/src/providers/ldap/sdap.c
AgeCommit message (Collapse)AuthorFilesLines
2013-09-20LDAP: Use primary cn to search netgroupLukas Slebodnik1-0/+11
Resolves: https://fedorahosted.org/sssd/ticket/2075
2013-07-24LDAP: Use domain-specific name where appropriateJakub Hrozek1-0/+51
The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
2013-06-28LDAP: Add utility function sdap_copy_mapJakub Hrozek1-0/+40
The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-07LDAP: new SDAP domain structureJakub Hrozek1-28/+30
Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
2013-05-23Adding option to disable retrieving large AD groups.Lukas Slebodnik1-8/+18
This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
2013-05-23Removing unused functions.Lukas Slebodnik1-28/+0
This patch remove unused functions sdap_parse_user and sdap_parse_group
2013-04-09LDAP: Always fail if a map can't be foundJakub Hrozek1-4/+2
2013-02-26sysdb: try dealing with binary-content attributesJan Engelhardt1-5/+3
https://fedorahosted.org/sssd/ticket/1818 I have here a LDAP user entry which has this attribute loginAllowedTimeMap:: AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA In the function sysdb_attrs_add_string(), called from sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is the wrong thing to do. The result of strlen is then used to populate the .v_length member of a struct ldb_val - and this will set it to zero in this case. (There is also the problem that there may not be a '\0' at all in the blob.) Subsequently, .v_length being 0 makes ldb_modify(), called from sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End result is that users do not get stored in the sysdb, and programs like `id` or `getent ...` show incomplete information. The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave fine, but that may not mean that is the absolute lower boundary of introduction of the problem.
2013-01-09AD: replace GID/UID, do not add another oneJakub Hrozek1-0/+31
The code would call sysdb_attrs_add_uint32 which added another UID or GID to the ID=0 we already downloaded from LDAP (0 is the default value) when ID-mapping an entry. This led to funky behaviour later on when we wanted to process the ID.
2012-10-15LDAP: Check validity of naming_contextJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1581 If the namingContext attribute had no values or multiple values, then our code would dereference a NULL pointer.
2012-09-26LDAP: Handle empty namingContexts values safelyStephen Gallagher1-0/+8
Certain LDAP servers can return an empty string as the value of namingContexts. We need to treat these as NULL so that we can fail gracefully. https://fedorahosted.org/sssd/ticket/1542
2012-09-24AD: Detect domain controller compatibility versionStephen Gallagher1-0/+30
2012-09-20SSSD fails to store users if any of the requested attribute is empty.Michal Zidek1-0/+6
https://fedorahosted.org/sssd/ticket/1440
2012-06-30Fix segfault when sudo is not configured.Simo Sorce1-1/+2
Sudo support is optional, when it is not configured sudorules_map is not initialized and dereferencing it will cause a segmentation fault.
2012-06-29ldap provider: add sudo usn valuePavel Březina1-0/+5
2012-06-13LDAP: Auto-detect support for the ldap match ruleStephen Gallagher1-2/+5
This patch extends the RootDSE lookup so that we will perform a second request to test whether the match rule syntax can be used. If both groups and initgroups are disabled in the configuration, this lookup request can be skipped.
2012-05-31Add support for filtering atributesJan Zeleny1-1/+19
This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
2012-05-14Fixed two minor memory leaksJan Zeleny1-1/+4
2012-05-10LDAP: Handle very large Active Directory groupsStephen Gallagher1-26/+46
Active Directory 2008R2 allows only 1500 group members to be retrieved in a single lookup. However, when we hit such a situation, we can take advantage of the ASQ lookups, which are not similarly limited. With this patch, we will add any members found by ASQ that were not found by the initial lookup so we will end with a complete group listing. https://fedorahosted.org/sssd/ticket/783
2012-05-10LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher1-5/+26
This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
2012-04-18Prevent printing NULL from DEBUG messagesJakub Hrozek1-4/+9
2012-02-13Add missing breaks to switch statementsStephen Gallagher1-0/+1
Coverity #12525 and #12524
2012-02-07LDAP: Add support for SSH user public keysJan Cholasta1-2/+18
2012-02-05AUTOFS: LDAP providerJakub Hrozek1-1/+12
2012-02-04LDAP: Do not fail if RootDSE check cannot determine search basesStephen Gallagher1-1/+6
https://fedorahosted.org/sssd/ticket/1152
2012-01-31LDAP: Add enumeration support for servicesStephen Gallagher1-0/+5
2012-01-31LDAP: Add support for service lookups (non-enum)Stephen Gallagher1-0/+11
2012-01-23LDAP: Improve debugging for sdap_parse_derefStephen Gallagher1-4/+7
Move the debug statement identifying the DN to an earlier line, so if we get a reply with no attributes, we know which entry is at fault.
2011-12-16SUDO Integration - LDAP configuration optionsPavel Březina1-1/+13
2011-11-23Modified sdap_parse_search_base()Jan Zeleny1-1/+1
2011-11-22Cleanup: Remove unused parametersJakub Hrozek1-2/+0
2011-11-02LDAP: Add parser for multiple search basesStephen Gallagher1-26/+83
2011-09-06sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string()Pavel Březina1-14/+14
https://fedorahosted.org/sssd/ticket/986
2011-05-20OpenLDAP dereference searchesJakub Hrozek1-0/+159
This dereference method is supported at least by OpenLDAP and 389DS/RHDS For more details, see: http://tools.ietf.org/html/draft-masarati-ldap-deref-00
2011-05-20Remove append_attrs_to_arrayJakub Hrozek1-11/+0
This function was not used anywhere
2011-04-19Add value of the last USN to server configurationStephen Gallagher1-0/+15
Related: https://fedorahosted.org/sssd/ticket/734
2011-04-11Initialise srv_opts even if rootDSE is missingSumit Bose1-38/+40
2011-01-31Remove LDAP_DEPRECATEDSumit Bose1-1/+0
2011-01-27Do not fail if attributes are emptySumit Bose1-16/+29
Currently we fail if attributes are empty. But there are some use cases where requested attributes are empty. E.g Active Directory uses an empty member attribute to indicate that a subset of the members are in a range sub-attribute.
2011-01-20Add ldap_tls_{cert,key,cipher_suite} config optionsTyson Whitehead1-0/+27
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
2010-12-14Fix unchecked return value in sdap_parse_entry()Sumit Bose1-1/+5
https://fedorahosted.org/sssd/ticket/712
2010-12-14Fix unchecked return value in sdap_get_msg_dn()Sumit Bose1-1/+6
https://fedorahosted.org/sssd/ticket/712
2010-12-07ldap: Use USN entries if available.Simo Sorce1-3/+55
Otherwise fallback to the default modifyTimestamp indicator
2010-12-07ldap: add checks to determine if USN features are available.Simo Sorce1-1/+83
2010-11-15Fix const cast warning in build_attrs_from_mapStephen Gallagher1-3/+3
2010-11-15Sanitize ldap attributes in the config fileStephen Gallagher1-2/+21
https://fedorahosted.org/sssd/ticket/458
2010-11-05Review comments for namingContexts patchesSumit Bose1-5/+5
2010-11-04Use (default)namingContext to set empty search basesSumit Bose1-0/+103
2010-09-15Check if control is supported before using it.Simo Sorce1-0/+18
2010-09-15Store rootdse supported features in sdap_handlerSumit Bose1-18/+64
generated by cgit (git 2.34.1) at 2024-05-20 02:46:14 +0000