summaryrefslogtreecommitdiff
path: root/src/providers/ldap/sdap_async_initgroups.c
AgeCommit message (Collapse)AuthorFilesLines
2013-09-27LDAP: Allow searching subdomain during RFC2307bis initgroupsJakub Hrozek1-9/+11
Related: https://fedorahosted.org/sssd/ticket/2070 Until now, the POSIX-compliant initgroups would only be able to search the parent domain. Since we want to allow using POSIX attributes from AD subdomains as well, we should allow searching a custom sdap_domain.
2013-09-27LDAP: Require ID numbers when ID mapping is offJakub Hrozek1-4/+55
Related: https://fedorahosted.org/sssd/ticket/2070 When searching for users and groups without the use of ID mapping, make sure the UIDs and GIDs are included in the search. This will make the SSSD seemigly "miss" entries when searching in Global Catalog in the scenario where the POSIX attributes are not replicated to the GC.
2013-09-26sysdb: get_sysdb_grouplist() can return either names or dnPavel Březina1-16/+49
We need to work with distinguish names when processing cross-domain membership, because groups and users may be stored in different sysdb tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
2013-09-11Fix formating of variables with type: size_tLukas Slebodnik1-7/+10
2013-08-19sysdb_add_incomplete_group: store SID string is availableSumit Bose1-8/+17
During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
2013-08-19save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose1-0/+16
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose1-4/+14
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sdap_get_initgr_done: use the right SID to get a GIDSumit Bose1-1/+2
2013-08-07Fix memory context for a state memberSumit Bose1-1/+1
primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
2013-07-24LDAP: Use domain-specific name where appropriateJakub Hrozek1-27/+24
The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
2013-06-28Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose1-7/+13
Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
2013-06-07LDAP: return sdap search return code to IDJakub Hrozek1-2/+2
By default, the LDAP searches delete the entry from cache if it wasn't found during a search. But if a search wants to try both Global Catalog and LDAP, for example, it might be beneficial to have an option to only delete the entry from cache after the last operation fails to prevent unnecessary memberof operations for example.
2013-06-07LDAP: new SDAP domain structureJakub Hrozek1-8/+10
Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
2013-06-07LDAP: Pass in a connection to ID functionsJakub Hrozek1-1/+4
Instead of using the default connection from the sdap_id_ctx, allow the caller to specify which connection shall be used for this particular request. Again, no functional change is present in this patch, just another parameter is added.
2013-03-21LDAP: If deref search fails, try again without derefJan Cholasta1-1/+11
https://fedorahosted.org/sssd/ticket/1660
2013-03-20ldap: Fallback option for rfc2307 schemaSimo Sorce1-2/+15
Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
2013-03-19Removing unused declaration of functions and variable.Lukas Slebodnik1-10/+0
Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
2013-03-13Fix initialization of multiple variablesOndrej Kos1-1/+1
2013-01-21Remove sysdb as a be context structure memberSimo Sorce1-1/+1
The sysdb context is already available through the 'domain' structure.
2013-01-15LDAP: avoid complex realloc logic in save_rfc2307bis_group_membershipsJakub Hrozek1-12/+4
https://fedorahosted.org/sssd/ticket/1761 The function tried to be smart and realloc only when needed, but that only lead to hard-to find bugs where the logic would not allocate the proper space. Remove the reallocation and prefer readability over speed in this case.
2013-01-15Add domain arguemnt to sysdb_get_real_name()Simo Sorce1-1/+2
2013-01-15Add domain arg to sysdb group member functionsSimo Sorce1-5/+7
2013-01-15Add domain arguments to sysdb_add_group functions.Simo Sorce1-2/+2
2013-01-15Add domain to sysdb_search_group_by_name()Simo Sorce1-6/+12
Also remove unused sysdb_search_domgroup_by_name()
2013-01-15Add domain to sysdb_search_user_by_name()Simo Sorce1-10/+22
Also remove unused sysdb_search_domuser_by_name()
2012-12-10LDAP: remove dead assignmentJakub Hrozek1-1/+0
2012-12-05LDAP: Continue adjusting group membership even if there is nothing to addJakub Hrozek1-2/+1
https://fedorahosted.org/sssd/ticket/1695
2012-09-24sdap_add_incomplete_groups(): fix ret may be uninitialized warningPavel Březina1-1/+1
2012-09-24AD: Optimize initgroups lookups with tokenGroupsStephen Gallagher1-4/+20
https://fedorahosted.org/sssd/ticket/1355
2012-08-23Unify usage of sysdb transactionsMichal Zidek1-27/+47
Removing bad examples of usage of sysdb_transaction_start/commit/end functions and making it more consistent (all files except of src/db/sysdb_*.c).
2012-08-21Remove compilation warning: ret may be uninitializedPavel Březina1-0/+2
2012-08-21Process all groups from a single nesting levelJakub Hrozek1-4/+14
https://bugzilla.redhat.com/show_bug.cgi?id=846664 If the first group was cached when processing the nested group membership, we would call tevent_req_done, effectivelly marking the whole nesting level as done.
2012-08-10When ldap_group_nesting_level was reached, the LDAP provider tried to link ↵Michal Zidek1-1/+45
group members with groups outside nesting limit. https://fedorahosted.org/sssd/ticket/1194
2012-06-13LDAP: Auto-detect support for the ldap match ruleStephen Gallagher1-1/+3
This patch extends the RootDSE lookup so that we will perform a second request to test whether the match rule syntax can be used. If both groups and initgroups are disabled in the configuration, this lookup request can be skipped.
2012-06-13LDAP: Add support for AD chain matching extension in initgroupsStephen Gallagher1-9/+20
2012-06-12LDAP: Make sdap_initgr_common_store() non-staticStephen Gallagher1-7/+7
Move it to a private header so it can be reused by other initgroups C files.
2012-06-12LDAP: Add helper function to get list of a user's groups from sysdbStephen Gallagher1-33/+64
2012-06-12LDAP: Fix incorrect switch statement in sdap_get_initgr_done()Stephen Gallagher1-1/+1
SDAP_SCHEMA_AD needs to be calling sdap_initgr_rfc2307bis_recv(), not sdap_initgr_nested_recv(). By coincidence both recv functions happened to be identical, but if one or the other changed, this would break unexpectedly.
2012-05-31Utilize attribute exclusion in LDAP initgroupsJan Zeleny1-3/+33
Previous patch added the possibility to exclude some attributes from a map when building an attribute list to be sent to server. The original reason for this functionality is the code handling LDAP initgroups. In this code, there is no need to fetch members of groups in question. This can save some performance since the list of members can be pretty long in some cases. This case apllies only to RFC2307 and generic RFC2307bis, it doesn't apply for IPA schema.
2012-05-31Add support for filtering atributesJan Zeleny1-10/+10
This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
2012-05-31Ghost members - removed sdap_check_aliases()Jan Zeleny1-7/+0
This function is no longer necessary because we don't have fake user entries any more. The original purpose of this function was to check if there are fake user entries for particular user and, if yes, to update its membership.
2012-05-10LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher1-5/+5
This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
2012-05-03LDAP: Treat groups with unmappable SIDs as non-POSIX groupsStephen Gallagher1-9/+12
2012-05-03LDAP: Add helper function to map IDsStephen Gallagher1-16/+5
This function will also auto-create a new ID map if the domain has not been seen previously.
2012-05-03LDAP: Add helper routine to convert LDAP blob to SID stringStephen Gallagher1-28/+144
2012-03-08Fix nested groups processingJakub Hrozek1-26/+60
Instead of keeping the number of parent groups in "state" and having to reset the count when moving to another group on the same level, keep track of the all groups on a particular level along with their parents and parent count.
2012-03-05Use proper errno codeJakub Hrozek1-1/+1
2012-02-24Modifications to simplify list_missing_attrsJan Zeleny1-1/+1
2012-02-24LDAP: Only use paging control on requests for multiple entriesStephen Gallagher1-6/+12
The paging control can cause issues on servers that put limits on how many paging controls can be active at one time (on some servers, it is limited to one per connection). We need to reduce our usage so that we only activate the paging control when making a request that may return an arbitrary number of results. https://fedorahosted.org/sssd/ticket/1202 phase one
2012-02-23LDAP: Properly assign orig_dnStephen Gallagher1-0/+1
This was only used for properly identifying debug messages.
generated by cgit (git 2.34.1) at 2024-05-17 04:58:48 +0000