summaryrefslogtreecommitdiff
path: root/src/providers
AgeCommit message (Collapse)AuthorFilesLines
2013-08-28IPA: Enable AD sites when in server modeJakub Hrozek3-2/+70
https://fedorahosted.org/sssd/ticket/1964 Currently the AD sites are enabled unconditionally
2013-08-28krb5: Fetch ccname template from krb5.confStephen Gallagher6-14/+169
In order to use the same defaults in all system daemons that needs to know how to generate or search for ccaches we introduce ode here to take advantage of the new option called default_ccache_name provided by libkrb5. If set this variable we establish the same default for all programs that surce it out of krb5.conf therefore providing a consistent experience across the system. Related: https://fedorahosted.org/sssd/ticket/2036
2013-08-28krb5_common: Refactor to use a talloc temp contextSimo Sorce1-12/+28
In preparation for handling some more allocations in the following patches and fixes a curent memleak on the opts struct. Related: https://fedorahosted.org/sssd/ticket/2036
2013-08-27KRB5: Add support for KEYRING cache typeStephen Gallagher4-0/+212
https://fedorahosted.org/sssd/ticket/2036
2013-08-27KRB5: Remove unnecessary call to become_user()Stephen Gallagher1-6/+0
By the time that the create_ccache_in_dir() routine is called, we are already guaranteed to have dropped privileges. This has either happened because we dropped them before the exec() in the normal operation case or because we dropped them explicitly after we completed the TGT validation step if that or FAST is configured.
2013-08-26sudo: do not strdup usn on ENOENTPavel Březina1-1/+1
If USN attribute is not present, we call strdup on uninitialized variable. This may cause segfault, or if we are lucky and usn is NULL it will return ENOMEM.
2013-08-26sudo: do not fail to store the rule if we can't read usnPavel Březina1-3/+4
Resolves: https://fedorahosted.org/sssd/ticket/2052
2013-08-24DP: Notify propperly when removing PAC responderOndrej Kos2-1/+5
Adds pac_cli be_client structure pointer, to indetify and log the PAC responder termination correctly.
2013-08-24check_cc_validity: make sure _valid is always setSumit Bose1-5/+7
In the KRB5_FCC_NOFILE code path _valid is not set leading to 'may be used uninitialized' compiler warnings.
2013-08-22Remove include recursionLukas Slebodnik2-3/+0
warning reported by coverity include_recursion: #include file "src/providers/dp_backend.h" includes itself: dp_backend.h -> dp_refresh.h -> dp_backend.h (other events go to each file) primary_file: During compilation of file 'src/krb5_plugin/sssd_krb5_locator_plugin.c include_recursion: #include file "src/providers/dp_backend.h" includes itself: dp_backend.h -> dp_refresh.h -> dp_ptask.h -> dp_backend.h (other events go to each file) primary_file: During compilation of file 'src/krb5_plugin/sssd_krb5_locator_plugin.c'
2013-08-22proxy: Allow initgroup to return NOTFOUNDSimo Sorce1-0/+16
When the user is only member of its own primary group, initgroups_dyn may return NOTFOUND as, at least for the 'files' nss provider the code skips the passed in group. Resolves: https://fedorahosted.org/sssd/ticket/2051
2013-08-22KRB5: Only set active and valid on successStephen Gallagher1-6/+5
The FILE cache only sets the return values of _active and _bool if the entire function succeeds. The DIR cache was setting it even on failure. This patch makes both consistent. This will benefit static analysis tools which would be able to detect if the variable is ever used uninitialized anywhere.
2013-08-22KRB5: Refactor cc_*_check_existingStephen Gallagher1-61/+59
There was duplicated code in cc_file_check_existing() and in cc_dir_check_existing(). I pulled them into the same function. There are two changes made to the original code here: 1) Fixes a use-after-free bug in cc_file_check_existing(). In the original code, we called krb5_free_context() and then used that context immediately after that in krb5_cc_close(). This patch corrects the ordering 2) The krb5_cc_resolve() call handles KRB5_FCC_NOFILE for all cache types. Previously, this was only handled for DIR caches.
2013-08-22KRB5: Add new #define for collection cache typesStephen Gallagher4-18/+18
Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
2013-08-19sysdb_add_incomplete_group: store SID string is availableSumit Bose2-9/+18
During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
2013-08-19save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose1-0/+16
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose1-4/+14
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sudo: continue if we are unable to resolve fqdnPavel Březina1-1/+0
https://fedorahosted.org/sssd/ticket/2043
2013-08-19KRB5: Do not log to syslog on each loginJakub Hrozek1-1/+3
2013-08-19KRB5: Formatting changesJakub Hrozek1-4/+4
2013-08-19sdap_save_user: save original primary GID of subdomain usersSumit Bose1-11/+22
If ID mapping is enabled we use magic private groups (MPG) for subdomains, i.e. the UID and the primary GID of the user will have the same numerical value. As a consequence the information about the original primary group might get lost because neither in AD domains nor on a typical UNIX system the user is an explicit member of it's primary group. With this patch the mapped GID or the original primary group is saved in the cached user object under a new attribute. Fixes https://fedorahosted.org/sssd/ticket/2027
2013-08-19sdap_get_initgr_done: use the right SID to get a GIDSumit Bose1-1/+2
2013-08-19ipa_s2n_get_user_done: make sure ALIAS name is lower caseSumit Bose1-2/+18
Fixes https://fedorahosted.org/sssd/ticket/1630
2013-08-19ipa_s2n_get_user_done: free group_attrs as wellSumit Bose1-0/+1
2013-08-19AD: Use the correct include guardJakub Hrozek1-3/+3
2013-08-19Remove include recursionLukas Slebodnik1-1/+0
Header file proxy.h included itself.
2013-08-19Check whether servername is not empty string.Lukas Slebodnik1-1/+1
Previous check was wrong, servername cannot be NULL.
2013-08-19proxy: Alocate auth tokens in struct authtok_convLukas Slebodnik1-0/+20
Struct sss_auth_token became opaque in commit 9acfb09f7969a69f58bd45c856b01700541853ca. All ocasions of "struct sss_auth_token" was replaced with pointer to this struct, but proper initialization of auth_tokens was missing in struct authtok_conv. Resolves: https://fedorahosted.org/sssd/ticket/2046
2013-08-11ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2-0/+30
Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
2013-08-09AD: Cast SASL callbacks to propper typeOndrej Kos1-1/+3
The initialization of ad_sasl_callbacks raised an incompatible pointer type warning. This was caused because the cyrus-sasl API hasa changed. The callback function list needs to be cast now.
2013-08-09Remove unused constantJakub Hrozek1-2/+0
2013-08-09Use the correct resolv timeoutJakub Hrozek1-1/+1
2013-08-08Enable removing nonexisting dn in sdap_handle_account_infoLukas Slebodnik1-1/+1
Change was introduced in commit ca344fde
2013-08-08Fix memory context for hash entriesSumit Bose1-2/+4
In sdap_nested_group_populate_users() username and orignal_dn are allocated on a temporary memory context. If the corresponding user is not found in the cache both are added to a hash which is later on returned to the caller. To avoid a use-after-free when the hash entries are looked up both must be reassigned to the memory context of the hash.
2013-08-07simple access provider: allow fully qualified namesPavel Březina1-46/+95
https://fedorahosted.org/sssd/ticket/2026
2013-08-07Fix memory context for a state memberSumit Bose1-1/+1
primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
2013-08-06sssd_ad: Add hackish workaround for sasl ad_compatSimo Sorce1-0/+41
This tries to set the ad_compat option for sasl, by working around the openldap/sasl initialization as openldap does not allow us to pass down to sasl our own getopt callback. Resolves: https://fedorahosted.org/sssd/ticket/2040
2013-08-05sudo: print better debug message when a rule has multiple cn valuesPavel Březina1-1/+5
2013-08-05sudo: skip rule on error instead of failing completelyPavel Březina1-1/+3
https://fedorahosted.org/sssd/ticket/2031
2013-07-29Use GID if subdomain is not MPGJakub Hrozek1-1/+8
https://fedorahosted.org/sssd/ticket/2032 In non-MPG subdomains (such as those that manage their IDs manually with POSIX attributes), we need to set the GID ourself.
2013-07-25Prevent using uninitialized "group_name" in done section.Lukas Slebodnik1-1/+1
Coverity ID: 11927
2013-07-24Set default DNS resolution timeout to 6 seconds.Michal Zidek1-2/+2
Partially solves ticket: https://fedorahosted.org/sssd/ticket/1966 To avoid the problem mentioned in the ticket above, option dns_discovery_domain must be set properly.
2013-07-24LDAP: Use domain-specific name where appropriateJakub Hrozek5-112/+159
The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
2013-07-23Fix possible dereference of a NULL pointer.Lukas Slebodnik1-1/+1
We check if function ipa_get_ad_id_ctx returns NULL, but function ipa_get_ad_id_ctx could never return NULL. This issue was found by scan-build.
2013-07-23KRB5: Do not send PAC in server modeJakub Hrozek5-7/+27
The krb5 child contacts the PAC responder for any user except for the IPA native users if the PAC is configured. This works fine for the general case but the ipa_server_mode is a special one. The PAC responder is there, but since in the server mode we should be operating as AD provider default, the PAC shouldn't be analyzed either in this case.
2013-07-22Fix warnings: uninitialized variableLukas Slebodnik2-4/+3
2013-07-22Remove unused memory context from function unpack_authtokLukas Slebodnik1-3/+3
2013-07-19Fix the default FQDN formatJakub Hrozek1-1/+1
Commit 52ae806bd17c3c00d70bd1aed437f10f5ae51a1c changed the default FQDN format by accident to the one we only ever user internally. This commit fixes the mistake.
2013-07-19AD: Set the bool value same as default value in optsJakub Hrozek1-4/+4
https://fedorahosted.org/sssd/ticket/2023 When the option values are copied using dp_opt_copy_map, the .val member is used if it's not NULL. At the same time, the bool options are never NULL, unlike integers or strings that can have special NULL-like values such as NULL_STRING. This effectively means that when copying a bool option, the .val member is always used. But in the AD maps, some .val fields were set differently from the .def_val fields. The effect was that when the AD subdomain provider was initialized from IPA subdomain provider using only the defaults, some options (notably referral chasing) were set to a value that didn't make sense for the AD provider. This patch makes sure that for all boolean option, the .val is always the same as .def_val.
2013-07-19IPA: warn if full_name_format is customized in server modeJakub Hrozek1-0/+17
https://fedorahosted.org/sssd/ticket/2009 If the IPA server mode is on and the SSSD is running on the IPA server, then the server's extdom plugin calls getpwnam_r to read info about trusted users from the AD server and return them to the clients that called the extended operation. The SSSD returns the subdomain users fully-qualified, ie "user@domain" by default. The format of the fully qualified name is configurable. However, the extdom plugin returns the user name without the domain component. With this patch, when ipa_server_mode is on, warn if the full_name_format is set to a non-default value. That would prompt the admin to change the format if he changed it to something exotic.
generated by cgit (git 2.34.1) at 2024-07-02 15:58:49 +0000