summaryrefslogtreecommitdiff
path: root/src/providers
AgeCommit message (Collapse)AuthorFilesLines
2013-07-17LDAP: When resolving a SID, search for groups first, then usersJakub Hrozek1-19/+18
https://fedorahosted.org/sssd/ticket/1997 Most of the time, the SIDs are resolved as a call coming from the PAC responder during initgroups. In that case at least, it makes sense to search for group matching that SID first, then users. We may consider making this behaviour configurable ie for the server mode where typically the users should be queried first.
2013-07-15Use conditional build for retrieving ccache.Lukas Slebodnik2-88/+22
Some krb5 functions needn't be available for retrieving ccache with principal. Therefore ifdef is used to solve this situation with older version of libkrb5. There were two functions with similar functionality in krb5_child and krb5_utils. They were merged to one universal function, which was moved to file src/util/sss_krb5.c
2013-07-11Return right directory name for dircacheLukas Slebodnik1-6/+10
Dircache can be either file or directory. Wrong value was used when dircache was itself directory. https://fedorahosted.org/sssd/ticket/2002
2013-07-11Always set port status to neutral when resetting service.Michal Zidek1-1/+2
We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
2013-07-10KRB5_CHILD: Fix handling of get_password return codeOndrej Kos1-4/+10
The switch statement was dead code due to missing case/default.
2013-07-01ldap: only update shadowLastChange when password change is successfulJim Collins1-1/+2
https://fedorahosted.org/sssd/ticket/1999 ldap_auth.c code which was added to SSSD for updating the shadowLastChange when "ldap_chpass_update_last_change" option is enabled updates shadowLastChange even when the PAM password change status reports failure. We should only update shadowLastChange on PAM password change success or we open up a work around for users to avoid changing their passwords periodically as required by policy. The user simply attempts to change password, fails by trying to set new password which invalid (denied due to password history check) yet shadowLastChange is updated, avoiding their need to actually change the password they are using.
2013-06-28IPA: Look up AD users directly if IPA server mode is onJakub Hrozek6-6/+168
https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
2013-06-28IPA: Create and remove AD id_ctx for subdomains discovered in server modeJakub Hrozek1-0/+182
When IPA server mode is on, then this patch will create an ad_id_ctx for each subdomain discovered in IPA provider. The ID context is needed to perform direct lookups using the AD provider. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek3-65/+78
Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28IPA: Initialize server mode ctx if server mode is onJakub Hrozek4-0/+62
This patch introduces a new structure that holds information about a subdomain and its ad_id_ctx. This structure will be used only in server mode to make it possible to search subdomains with a particular ad_id_ctx. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28AD: initialize failover with custom realm, domain and failover serviceJakub Hrozek3-28/+41
This is needed so we can initialize failover using IPA realm and on-the-fly discovered DNS domain. The subdomains discovered on-thefly will use the subdomain name for realm, domain and failover service to avoid conflicts. Subtaks of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28AD: decouple ad_id_ctx initializationJakub Hrozek3-102/+285
The IPA subdomain code will perform lookups on its own in the server mode. For this, the AD provider must offer a way to initialize the ad_id_ctx for external consumers. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28LDAP: Add utility function sdap_copy_mapJakub Hrozek2-0/+45
The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
2013-06-28IPA: Add a server mode optionJakub Hrozek2-0/+2
https://fedorahosted.org/sssd/ticket/1993 SSSD needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, is introduced which defaults to false but is set to true during ipa-server-install or during updates of the FreeIPA server if it is not already set.
2013-06-28Save mpg state for subdomainsSumit Bose2-4/+13
The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
2013-06-28IPA: read ranges before subdomainsSumit Bose1-29/+27
Since FreIPA will start to support external mapping for trusted domains as well the range type for the domain must be know before the domain object is created. The reason is that external mapping will not use magic private groups (mpg) while algorithmic mapping will use them.
2013-06-28Replace new_subdomain() with find_subdomain_by_name()Sumit Bose5-16/+11
new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
2013-06-28Add support for new ipaRangeType attributeSumit Bose3-6/+36
Recent versions of FreeIPA support a range type attribute to allow different type of ranges for sub/trusted-domains. If the attribute is available it will be used, if not the right value is determined with the help of the other idrange attributes. Fixes https://fedorahosted.org/sssd/ticket/1961
2013-06-28Add ipa_idmap_init()Sumit Bose3-1/+275
Use the sdap_idmap context for the IPA provider as well. https://fedorahosted.org/sssd/ticket/1961
2013-06-28Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose5-14/+38
Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
2013-06-28Add sdap_idmap_domain_has_algorithmic_mapping()Sumit Bose2-0/+62
This patch implements a wrapper for sss_idmap_domain_has_algorithmic_mapping() for the sdap ID mapping. Fixes https://fedorahosted.org/sssd/ticket/1960
2013-06-28Allow different methods to find new domains for idmappingSumit Bose2-3/+24
Currently the range management code is in the generic LDAP provider and can be used by the LDAP and AD provider. New ranges are allocated with the help of a hash value of the domain SID. If the IPA provider cannot find a range for a given domain it cannot allocate a new range on its own but has to look up the idrange objects on the FreeIPA server and use them accordingly. To allow the LDAP, AD and IPA provider to use as much common code as possible a plugin interface, similar to the one used to find the DNS site, to find a missing range would be useful. The default plugin will be used by the LDAP and the AD provider and the IPA provider will implement a plugin to read the data from the server. Fixes https://fedorahosted.org/sssd/ticket/1961
2013-06-28SDAP IDMAP: Add configured domain to idmap contextSumit Bose1-0/+70
To allow libsss_idmap to manage all id-ranges the id-ranges of the domains configured in sssd.conf which are currently unmanaged must be added to libsss_idmap.
2013-06-28Add now options ldap_min_id and ldap_max_idSumit Bose4-0/+8
Currently the range for Posix IDs stored in an LDAP server is unbound. This might lead to conflicts in a setup with AD and trusts when the configured domain uses IDs from LDAP. With the two noe options this conflict can be avoided.
2013-06-27SSH: When host is removed from LDAP, remove it from the cache as wellJan Cholasta1-1/+8
https://fedorahosted.org/sssd/ticket/1949
2013-06-27Fix compilation warningJakub Hrozek1-1/+1
2013-06-27AD: Write out domain-realm mappingsJakub Hrozek3-165/+10
This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
2013-06-27KRB5: guess UPN for subdomain usersJakub Hrozek7-18/+43
2013-06-26AD: kinit with the local DC even when talking to a GCJakub Hrozek2-4/+21
We tried to use the GC address even for kinit which gave us errors like: "Realm not local to KDC while getting initial credentials". This patch adds a new AD_GC service that is only used for ID lookups, any sort of Kerberos operations are done against the local servers.
2013-06-26Use forest for GC SRV lookupsSumit Bose1-12/+40
https://fedorahosted.org/sssd/ticket/1973
2013-06-26Do not switch to credentials everytime.Lukas Slebodnik1-4/+69
If user decide to kinit as another user we do not want to switch back to user ccache at another login. We will switch to new ccache if and only if default principal name is the same as current principal name, or there is not any default ccache. https://fedorahosted.org/sssd/ticket/1936
2013-06-26Every time return directory for krb5 cache collection.Lukas Slebodnik2-4/+64
Function krb5_cc_get_full_name is called only as a way to validate that, we have the right cache. Instead of returned name, location will be returned from function cc_dir_cache_for_princ. https://fedorahosted.org/sssd/ticket/1936
2013-06-25fix dead code in fail_over_srv.cPavel Březina1-11/+12
https://fedorahosted.org/sssd/ticket/1969 The dead code is in fo_discover_servers_primary_done(). By fixing it I have also added a debug message on ret != EOK. This change is done also in fo_discover_servers_backup_done().
2013-06-25krb5: do not use enterprise principals for renewalsSumit Bose1-1/+6
When renewing a ticket we already know the canonical principal hence it is not needed to expand it to an enterprise principal but we can contact the KDC of the corresponding realm directly.
2013-06-25krb5: do not send pac for IPA users from the local domainSumit Bose5-10/+20
So far we didn't send the PAC of IPA users to the PAC responder during password authentication because group memberships for IPA users can be retrieved efficiently with LDAP calls. Recently patches added PAC support for the AD provider as well and removed the restriction for the IPA users. This patch restores the original behaviour by introducing a new flag in struct krb5_ctx which is only set for the IPA provider. Additionally a different flag is renamed to make it's purpose more clear. Fixes https://fedorahosted.org/sssd/ticket/1995
2013-06-25Revert "Always send the PAC to the PAC responder"Sumit Bose1-18/+20
This reverts commit d153941864fe481399665be8fe583c9317194a99.
2013-06-24Fix typo in pack_authtok()Sumit Bose1-1/+1
2013-06-24KRB5: use the right authtok type for renewalsSumit Bose1-3/+20
2013-06-24IPA: Do not download or store the member attribute of host groupsJakub Hrozek2-2/+0
https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
2013-06-24LDAP: Retry SID search based on result of LDAP search, not the return codeJakub Hrozek1-2/+13
2013-06-21failover: if expanded server is marked as neutral, invoke srv collapsePavel Březina1-0/+7
https://fedorahosted.org/sssd/ticket/1947 Otherwise we will do the SRV expansion once again: 1. leaving the old servers in server list 2. meta server is not inserted back in the list, the newly found servers are inserted behind meta server, meta server is orphaned and the new servers are forgotten
2013-06-21collapse_srv_lookup may free the server, make it clear from the APIPavel Březina1-6/+9
https://fedorahosted.org/sssd/ticket/1947
2013-06-21failover: return error when SRV lookup returned only duplicatesPavel Březina1-2/+21
https://fedorahosted.org/sssd/ticket/1947 Otherwise we risk that the meta server is removed from the server list, but without a chance to return, because there may be no fo_server with srv_data = meta. Also if state->meta->next is NULL (it is still orphaned because we try to errornously expand it without invoking collapse first), state->out will be NULL and SSSD will crash. New error code: ERR_SRV_DUPLICATES
2013-06-21failover: do not return invalid pointer when server is already presentPavel Březina1-2/+6
https://fedorahosted.org/sssd/ticket/1947
2013-06-21FO: Check the return value of send_fnJakub Hrozek1-0/+4
2013-06-21Fix dp_copy_optionsJakub Hrozek1-1/+1
2013-06-18nested groups: do not expect any particular number of groupsPavel Březina1-19/+10
2013-06-18nested groups: do not return ENOMEM if num_groups is 0Pavel Březina1-6/+10
talloc_realloc(..., 0) calls talloc_free() and returns NULL. If we process group that contains only users, we errornously return ENOMEM.
2013-06-17Set default realm for enterprise principalsSumit Bose1-0/+12
Enterprise principals require that a default realm is available. To make SSSD more robust in the case that the default realm option is missing in krb5.conf or to allow SSSD to work with multiple unconnected realms (e.g. AD domains without trust between them) the default realm will be set explicitly. Fixes https://fedorahosted.org/sssd/ticket/1931
2013-06-17Use principal from the ticket to find validation entrySumit Bose1-1/+1
If canonicalization or enterprise principals are enabled the realm of the client principal might have changed compared to the original request. To find the most suitable keytab entry to validate the TGT is it better to use the returned client principal. Fixes https://fedorahosted.org/sssd/ticket/1931
generated by cgit (git 2.34.1) at 2024-11-27 04:12:09 +0000