summaryrefslogtreecommitdiff
path: root/src/providers/ldap
AgeCommit message (Collapse)AuthorFilesLines
2013-09-11Fix formating of variables with type: longLukas Slebodnik3-8/+11
2013-09-11LDAP: Store cleanup timestamp after initial cleanupJakub Hrozek3-10/+10
When the SSSD changes serves (and hence lastUSN) we perform a cleanup as well. However, after recent changes, we didn't set the cleanup timestamp correctly, which made the lastUSN logic fail.
2013-09-10is_dn(): free dnPavel Březina1-0/+2
2013-09-02Fix czech specific character in my namePavel Březina2-2/+2
2013-08-28LDAP: Make sdap_id_setup_tasks reusable for subdomainsJakub Hrozek3-7/+19
Instead of always performing the setup for the main domain, the setup can now be performed for subdomains as well.
2013-08-28LDAP: Make the cleanup task reusable for subdomainsJakub Hrozek5-42/+73
Instead of always performing the cleanup on the main domain, the task now accepts a sdap_domain structure to perform the cleanup on. This change will make the cleanup task reusable for subdomains.
2013-08-28LDAP: Make cleanup synchronousJakub Hrozek3-150/+34
The LDAP cleanup request was asynchronous for no good reason, probably a leftover from the days of async sysdb. This patch makes it sychronous again, removing a lot of uneeded code.
2013-08-28LDAP: Convert enumeration to the ptask APIJakub Hrozek4-136/+132
https://fedorahosted.org/sssd/ticket/1942 Identity providers other than LDAP need to customize the enumeration in different ways while sharing the way the task is scheduled etc. The easiest way to accomplish it is to leverage the recently introduced ptask framework.
2013-08-28LDAP: Move the ldap enum request to its own reusable moduleJakub Hrozek6-642/+741
The LDAP enumeration was too closely tied to the LDAP identity provider. Because some providers might need special handling such as refresh the master domain record before proceeding with the enumeration itself, this patch splits the request itself to a separate async request and lets the ldap_id_enum.c module only configure this new request. Also move the enum timestamp to sdap_domain to make the enum tracking per sdap domain. The cleanup timestamp will be moved in another patch.
2013-08-28LDAP: Remove unused constantJakub Hrozek1-2/+0
The constant was not used since Euegene came up with his reconnection logic.
2013-08-28LDAP: Add enum_{users,groups}_recv to follow the tevent_req styleJakub Hrozek1-24/+19
The enum code was quite old and predated the tevent_req style. In particular, the enum code was checking tevent state direcly and not using _recv functions or the helper macros we added later. As a consequence, it was not easy to read. This patch adds the standard _recv functions to read the status of the enum requests.
2013-08-26sudo: do not strdup usn on ENOENTPavel Březina1-1/+1
If USN attribute is not present, we call strdup on uninitialized variable. This may cause segfault, or if we are lucky and usn is NULL it will return ENOMEM.
2013-08-26sudo: do not fail to store the rule if we can't read usnPavel Březina1-3/+4
Resolves: https://fedorahosted.org/sssd/ticket/2052
2013-08-19sysdb_add_incomplete_group: store SID string is availableSumit Bose2-9/+18
During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
2013-08-19save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose1-0/+16
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose1-4/+14
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sudo: continue if we are unable to resolve fqdnPavel Březina1-1/+0
https://fedorahosted.org/sssd/ticket/2043
2013-08-19sdap_save_user: save original primary GID of subdomain usersSumit Bose1-11/+22
If ID mapping is enabled we use magic private groups (MPG) for subdomains, i.e. the UID and the primary GID of the user will have the same numerical value. As a consequence the information about the original primary group might get lost because neither in AD domains nor on a typical UNIX system the user is an explicit member of it's primary group. With this patch the mapped GID or the original primary group is saved in the cached user object under a new attribute. Fixes https://fedorahosted.org/sssd/ticket/2027
2013-08-19sdap_get_initgr_done: use the right SID to get a GIDSumit Bose1-1/+2
2013-08-11ldap, krb5: More descriptive msg on chpass failure.Michal Zidek1-0/+15
Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
2013-08-08Enable removing nonexisting dn in sdap_handle_account_infoLukas Slebodnik1-1/+1
Change was introduced in commit ca344fde
2013-08-08Fix memory context for hash entriesSumit Bose1-2/+4
In sdap_nested_group_populate_users() username and orignal_dn are allocated on a temporary memory context. If the corresponding user is not found in the cache both are added to a hash which is later on returned to the caller. To avoid a use-after-free when the hash entries are looked up both must be reassigned to the memory context of the hash.
2013-08-07Fix memory context for a state memberSumit Bose1-1/+1
primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
2013-08-05sudo: print better debug message when a rule has multiple cn valuesPavel Březina1-1/+5
2013-08-05sudo: skip rule on error instead of failing completelyPavel Březina1-1/+3
https://fedorahosted.org/sssd/ticket/2031
2013-07-25Prevent using uninitialized "group_name" in done section.Lukas Slebodnik1-1/+1
Coverity ID: 11927
2013-07-24LDAP: Use domain-specific name where appropriateJakub Hrozek5-112/+159
The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
2013-07-17SIGCHLD handler: do not call callback when pvt data where freedPavel Březina1-1/+1
https://fedorahosted.org/sssd/ticket/1992
2013-07-17print hint about password complexity when new password is rejectedPavel Březina1-0/+8
https://fedorahosted.org/sssd/ticket/1827
2013-07-17LDAP: When resolving a SID, search for groups first, then usersJakub Hrozek1-19/+18
https://fedorahosted.org/sssd/ticket/1997 Most of the time, the SIDs are resolved as a call coming from the PAC responder during initgroups. In that case at least, it makes sense to search for group matching that SID first, then users. We may consider making this behaviour configurable ie for the server mode where typically the users should be queried first.
2013-07-01ldap: only update shadowLastChange when password change is successfulJim Collins1-1/+2
https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
2013-06-28AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek2-0/+77
Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28LDAP: Add utility function sdap_copy_mapJakub Hrozek2-0/+45
The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28Replace new_subdomain() with find_subdomain_by_name()Sumit Bose1-3/+2
new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
2013-06-28Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose5-14/+38
Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
2013-06-28Add sdap_idmap_domain_has_algorithmic_mapping()Sumit Bose2-0/+62
This patch implements a wrapper for sss_idmap_domain_has_algorithmic_mapping() for the sdap ID mapping. Fixes https://fedorahosted.org/sssd/ticket/1960
2013-06-28Allow different methods to find new domains for idmappingSumit Bose2-3/+24
Currently the range management code is in the generic LDAP provider and can be used by the LDAP and AD provider. New ranges are allocated with the help of a hash value of the domain SID. If the IPA provider cannot find a range for a given domain it cannot allocate a new range on its own but has to look up the idrange objects on the FreeIPA server and use them accordingly. To allow the LDAP, AD and IPA provider to use as much common code as possible a plugin interface, similar to the one used to find the DNS site, to find a missing range would be useful. The default plugin will be used by the LDAP and the AD provider and the IPA provider will implement a plugin to read the data from the server. Fixes https://fedorahosted.org/sssd/ticket/1961
2013-06-28SDAP IDMAP: Add configured domain to idmap contextSumit Bose1-0/+70
To allow libsss_idmap to manage all id-ranges the id-ranges of the domains configured in sssd.conf which are currently unmanaged must be added to libsss_idmap.
2013-06-28Add now options ldap_min_id and ldap_max_idSumit Bose2-0/+4
Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
2013-06-24LDAP: Retry SID search based on result of LDAP search, not the return codeJakub Hrozek1-2/+13
2013-06-18nested groups: do not expect any particular number of groupsPavel Březina1-19/+10
2013-06-18nested groups: do not return ENOMEM if num_groups is 0Pavel Březina1-6/+10
talloc_realloc(..., 0) calls talloc_free() and returns NULL. If we process group that contains only users, we errornously return ENOMEM.
2013-06-17handle ERR_ACCOUNT_EXPIRED properlyPavel Březina1-1/+5
https://fedorahosted.org/sssd/ticket/1953
2013-06-17nested groups: allocate more space if deref returns more membersPavel Březina1-0/+21
https://fedorahosted.org/sssd/ticket/1894
2013-06-10A new option krb5_use_kdcinfoJakub Hrozek3-2/+8
https://fedorahosted.org/sssd/ticket/1883 The patch introduces a new Kerberos provider option called krb5_use_kdcinfo. The option is true by default in all providers. When set to false, the SSSD will not create krb5 info files that the locator plugin consumes and the user would have to set up the Kerberos options manually in krb5.conf
2013-06-10providers: refresh expired netgroupsPavel Březina3-0/+183
https://fedorahosted.org/sssd/ticket/1713
2013-06-07LDAP: Do not store separate GID for subdomain usersJakub Hrozek1-10/+18
As the subdomains are MPG domains, we don't want to store a separate GID for the subdomain users, but rather just create a UPG.
2013-06-07Split generating primary GID for ID mapped users into a separate functionJakub Hrozek1-41/+70
Move the part of sdap_save_user into a separate function so that it can be special cased an only called for users in primary domains, not subdomain users.
2013-06-07LDAP: store FQDNs for trusted users and groupsJakub Hrozek5-12/+36
Because the NSS responder expects the name attribute to contain FQDN, we must save the name as FQDN in the LDAP provider if the domain we save to is a subdomain.
2013-06-07LDAP: split a function to create search basesJakub Hrozek2-29/+73
This function will be used later to fill the sdap_domain structures with search bases.
generated by cgit (git 2.34.1) at 2024-12-04 18:50:56 +0000