summaryrefslogtreecommitdiff
path: root/src/providers
AgeCommit message (Collapse)AuthorFilesLines
2011-05-05Added some kerberos functions for building on RHEL5Jan Zeleny1-2/+2
2011-05-04Fixed lastUSN checking improvementsJan Zeleny3-5/+23
This patch fixes some issues with setting lastUSN attribute and it adds check against the highest user/group USN after enumeration to keep better track of the real highest USN. Optimal solution here would be to schedule a check of rootDSE entry right after the enumeration finishes, but for the moment this is good enough.
2011-05-04Do not leak LDAP URI with high log levelJakub Hrozek1-2/+7
2011-05-04Do not leak pcre contextJakub Hrozek1-0/+12
2011-05-02Fix minor typo in error messageStephen Gallagher1-1/+1
https://fedorahosted.org/sssd/ticket/825
2011-05-02Return pam data to the renewal item if renewal failsSumit Bose1-4/+9
A previous patch changed a talloc_steal() into a talloc_move(). Now it is not enough to change the parent memory context with talloc_steal to give back the data, but it has to be assigned back too. Additionally this patch uses the missing pam data as an indication that a renewal request for this data is currently running.
2011-04-29Fix order of arguments in select_principal_from_keytab() callJakub Hrozek1-1/+1
2011-04-29Fix bad password caching when using automatic TGT renewalStephen Gallagher1-3/+12
Fixes CVE-2011-1758, https://fedorahosted.org/sssd/ticket/856
2011-04-29Fix segfault in IPA providerStephen Gallagher1-2/+2
We were trying to request the krb5 keytab from the auth provider configuration, but it hasn't yet been set up. Much better to use the value in the ID provider.
2011-04-28Fix IPA config bug with SDAP_KRB5_REALMStephen Gallagher1-1/+1
2011-04-28Do not leak LDAP paging controlsJakub Hrozek1-0/+5
2011-04-27Add ldap_page_size configuration optionStephen Gallagher6-5/+12
2011-04-27Enable paging support for LDAPStephen Gallagher1-23/+117
2011-04-27Log the LDAP message type we're processingStephen Gallagher1-0/+57
2011-04-27simple provider: Don't treat primary GID lookup failures as fatalStephen Gallagher1-13/+19
2011-04-25Modify principal selection for keytab authenticationJan Zeleny7-28/+73
Currently we construct the principal as host/fqdn@REALM. The problem with this is that this principal doesn't have to be in the keytab. In that case the provider fails to start. It is better to scan the keytab and find the most suitable principal to use. Only in case no suitable principal is found the backend should fail to start. The second issue solved by this patch is that the realm we are authenticating the machine to can be in general different from the realm our users are part of (in case of cross Kerberos trust). The patch adds new configuration option SDAP_SASL_REALM. https://fedorahosted.org/sssd/ticket/781
2011-04-25Allow new option to specify principal for FASTJan Zeleny5-6/+58
https://fedorahosted.org/sssd/ticket/700
2011-04-25Extend and move function for finding principal in keytabJan Zeleny1-80/+2
The function now supports finding principal in keytab not only based on realm, but based on both realm and primary/instance parts. The function also supports * wildcard at the beginning or at the end of primary principal part. The function for finding principal has been moved to util/sss_krb5.c, so it can be used in other parts of the code.
2011-04-19Add last usn checking after reconnectionJan Zeleny2-1/+31
When reconnecting to the LDAP server supporting USNs (either because of new incomming id operation or invokation of callback responsible for checking status of the backend), detect whether the highest USN is lower than the one SSSD has recorded. If so, setup enumeration/cleanup to refresh potentionally changed account information in the SSSD cache. Related ticket: https://fedorahosted.org/sssd/ticket/734
2011-04-19Add value of the last USN to server configurationStephen Gallagher2-0/+16
Related: https://fedorahosted.org/sssd/ticket/734
2011-04-19Add user and group search LDAP filter optionsJakub Hrozek4-19/+82
https://fedorahosted.org/sssd/ticket/647
2011-04-19Always generate kpasswdinfo fileStephen Gallagher1-2/+1
Previously, we only generated it when performing a password change, but this didn't play nicely with kpasswd.
2011-04-15Set same status for duplicate serversJakub Hrozek1-0/+21
2011-04-15Do not throw a DP error when failing to delete a nonexistent entityStephen Gallagher1-4/+4
2011-04-12Never remove gecos from the sysdb cacheStephen Gallagher1-0/+9
Now that gecos can come from either the 'gecos' or 'cn' attributes, we need to ensure that we never remove it from the cache.
2011-04-12Initialise rootdse to NULL if not availableSumit Bose1-0/+1
2011-04-11Initialise srv_opts even if rootDSE is missingSumit Bose2-46/+49
2011-04-11Remove detection of duplicates from SRV result processingJakub Hrozek1-9/+0
2011-04-08Read only rootDSE data if rootDSE is availableSumit Bose1-20/+22
2011-04-08Fix unchecked return values of pam_add_responseJakub Hrozek2-3/+11
https://fedorahosted.org/sssd/ticket/798
2011-04-08Don't pass NULL to printf for TLS errorsJakub Hrozek3-33/+24
https://fedorahosted.org/sssd/ticket/643
2011-04-01Do not attempt to resolve nameless serversJakub Hrozek1-1/+1
The failover code is not strictly in charge of resolving. Its main function is to provide a server to connect to for a service. It is legal, although not currently used, to have a server that has no name (server->common == NULL). In this case, no resolving should be done and it is assumed that the failover user, which are the SSSD back ends in our case, would perform any resolving out of band, perhaps using the user_data attribute of fo_server structure.
2011-04-01Only save members for successfully saved groupsJakub Hrozek1-2/+17
2011-03-30Fall back to cn if gecos is not availableStephen Gallagher1-0/+9
We were not fully compliant with section 5.3 of RFC 2307 which states: An account's GECOS field is preferably determined by a value of the gecos attribute. If no gecos attribute exists, the value of the cn attribute MUST be used. (The existence of the gecos attribute allows information embedded in the GECOS field, such as a user's telephone number, to be returned to the client without overloading the cn attribute. It also accommodates directories where the common name does not contain the user's full name.)
2011-03-28Mark transaction as done when cancelledJakub Hrozek1-2/+8
2011-03-28RFC2307: Ignore zero-length member names in group lookupsStephen Gallagher1-0/+4
2011-03-28Always complete the transaction in sdap_process_group_members_2307Stephen Gallagher1-0/+11
If the loop ran through at least one sdap_process_missing_member_2307() call and errored out later, we were not canceling the transaction.
2011-03-28Fix typo in sdap_nested_group_process_stepJakub Hrozek1-1/+1
2011-03-24Return from functions in LDAP provider after marking request as failedJakub Hrozek1-1/+4
2011-03-24Add host access control supportPierre Ossman6-3/+157
https://fedorahosted.org/sssd/ticket/746
2011-03-23Add sysdb_attrs_primary_name_list() routineStephen Gallagher1-18/+22
This routine will replace the use of sysdb_attrs_to_list() for any case where we're trying to get the name of the entry. It's a necessary precaution in case the name is multi-valued.
2011-03-23Use sysdb_attrs_primary_name() in sdap_initgr_nested_store_groupStephen Gallagher1-1/+3
2011-03-23Use fake groups during IPA schema initgroupsJakub Hrozek1-114/+418
https://fedorahosted.org/sssd/ticket/822
2011-03-23Add originalDN to fake groupsJakub Hrozek1-1/+10
2011-03-23RFC2307bis: Ignore aliases for groupsStephen Gallagher1-14/+26
Groups in ldap with multiple values for their groupname attribute will now be compared against the RDN of the entry to determine the "primary" group name. We will save only this primary group name to the ldb cache.
2011-03-23RFC2307: Ignore aliases for groupsStephen Gallagher1-23/+35
Groups in ldap with multiple values for their groupname attribute will now be compared against the RDN of the entry to determine the "primary" group name. We will save only this primary group name to the ldb cache.
2011-03-23Ignore aliases for usersStephen Gallagher1-20/+26
Users in ldap with multiple values for their username attribute will now be compared against the RDN of the entry to determine the "primary" username. We will save only this primary name to the ldb cache.
2011-03-22Sanitize DN when searching the original DN in the cacheSumit Bose1-1/+9
2011-03-17Fix incorrect return value checkStephen Gallagher1-1/+1
2011-03-15Fix LDAP search filter for nested initgroupsJakub Hrozek1-1/+1
generated by cgit (git 2.34.1) at 2024-07-22 14:06:03 +0000