summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2013-01-08Refactor gid handling in the PAC responderSumit Bose3-84/+202
Instead of using a single array of gid-domain_pointer pairs, Simo suggested to use a gid array for each domain an store it with a pointer to the domain.
2013-01-08PAC responder: check if existing user differsSumit Bose3-13/+64
If some of the Posix attributes of an user existing in the cache differ from the data given in the current PAC the old user entry is drop and a new one is created with the data from the PAC.
2013-01-08Use hash table to collect GIDs from PAC to avoid dupsSumit Bose1-18/+86
To avoid duplicated entries in the group list all gids are added to a hash table first. Fixes: https://fedorahosted.org/sssd/ticket/1672
2013-01-08Read remote groups from PACSumit Bose1-3/+52
Read the group membership of the remote domain the user belongs to from the PAC and add them to the cache. Fixes: https://fedorahosted.org/sssd/ticket/1666
2013-01-08Remote groups do not have an original DN attributeSumit Bose1-40/+34
Groups from subdomains will not have an attribute holding the original DN because in general it will not be available. This attribute is only used by IPA HABC to improve performance and remote groups cannot be used for access control.
2013-01-08Save domain and GID for groups from the configured domainSumit Bose3-17/+47
Currently users from subdomains can only be members of groups from the configured domain and to access those groups a pointer to the domain struct of the configured domain is used. This patch sets the dom_grp member of struct pac_grp to point to the domain struct of the configured for groups from this domain. This is a first step to allow group membership for groups from subdomains as well. For those groups a pointer to the related subdomain structure will be saved.
2013-01-08Always get user data from PACSumit Bose1-7/+7
Currently some user specific data from the PAC is only read when the user is not already in the cache. Since some of this information is needed later on, e.g. the domain SID the user belongs to, with this patch the data is read always from the PAC.
2013-01-08Update domain ID for local domain as wellSumit Bose1-2/+14
Currently only the flat name of the configured domain is updated if it is not already set. This patch updates the domain ID as well. This is typically the case when trust support is enabled on the server side while sssd is running.
2013-01-08Add find_domain_by_id()Sumit Bose2-0/+42
Currently domains can only be searched by name in the global domain list. To make it easier to find the domain for a given SID find_domain_by_id() which returns a pointer to the domain or subdomain entry in the global domain list if a matching id was found.
2013-01-08Use struct pac_grp instead of gid_t for groups from PACSumit Bose3-18/+25
To be able to handle groupmemberships from other domains more data than just the gid must be kept for groups given in the PAC.
2013-01-07memcache: add macro that validates record lengthPavel Březina1-2/+1
2013-01-07sss_userdel and sss_groupdel with use_fully_qualified_namesMichal Zidek1-15/+50
If use_fully_qualified_names is used, we need to pass fqdn to sss_mmap_cache_*_invalidate.
2013-01-02failover: Protect against empty host namesMichal Zidek1-1/+2
Added new parameter to split_on_separator that allows to skip empty values. The whole function was rewritten. Unit test case was added to check the new implementation. https://fedorahosted.org/sssd/ticket/1484
2012-12-20mmap cache: invalidate cache on fatal errorSimo Sorce3-10/+30
If a fatal EFAULT error is returned by the internal function that frees used memory invalidate the whole cache and reinit it. This way we avoid further corruption and insure clients see consistent data. Also insure we use the right context in init() and we use talloc_zfree() in reinit so that if the init() later fails we do not leave around a pointer to free memory in the callers.
2012-12-20Carefully check records when forcibly invalidatingSimo Sorce1-18/+101
We should never try to invalidate an already invalid record as internal pointers will not be consistent. Carefully test that the record really is valid when we are fishing for free space, and properly invalidate records or return a fatal error if something goes wrong. In order to make the code more robust always invalidate the whole data space on initialization by setting all bits to 1, and make sure to invalidate the whole last allocated slot by converting rec->len to the number of slots instead of just the space used.
2012-12-20Update free table when records are invalidated.Simo Sorce1-14/+23
We were holding up slots when entries were invalidated directly an not through our primitive garbage collection scheme.
2012-12-20nss_mc: Add extra checks when dereferencing recordsSimo Sorce1-0/+12
Although it should enver happen that we pass in an invalid hash it is always better to just not do anything than access memory ouf of the hash table. It can lead to segfaults, or worse referencing memory that should not be touched.
2012-12-19sssd_nss: Plug memory leaksSimo Sorce1-2/+11
A recent patch introduced a glaring memory leak in the routines that clean up memcache memory on initgroups calls.
2012-12-18responder_dp: Add timeout to side requetsSimo Sorce1-1/+25
This is an additional proteciont in case the provider misbheaves to avoid having requests pending forever. Fixes: https://fedorahosted.org/sssd/ticket/1717
2012-12-18AUTOFS: Clear enum cache if a request comes in from the sss_cacheJakub Hrozek1-0/+22
In order for sss_cache to work correctly, we must also signal the autofs responder to invalidate the hash table requests.
2012-12-18RESPONDERS: Create a common file with service names and versionsJakub Hrozek10-16/+49
The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
2012-12-18AUTOFS: remove all maps from hash if request for auto.master comes inJakub Hrozek2-3/+59
https://fedorahosted.org/sssd/ticket/1592 When a request for auto.master comes in, we need to remove all the maps from the lookup hash table. We can't simply delete the maps, because another request might be processing them, so instead the maps are removed from the hash table, effectively becoming orphaned. The maps will get freed when the timed destructor is invoked.
2012-12-18AUTOFS: allow removing entries from hash tableJakub Hrozek3-1/+32
There is a timed desctructor in the autofs responder that, when the entry timeout passes, removes the autofs map from the hash table while the map is freed. This patch adds a hash delete callback so that if the map is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
2012-12-14sssd_pam: Cleanup requests cache on sbus reconectSimo Sorce1-1/+4
The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
2012-12-14Allow mmap calls to gracefully return absent ctxSimo Sorce1-0/+25
This is to allow to freely call mc functions even if initialization failed. They will now gracefully fail instead of segfaulting.
2012-12-13sssd_nss: Remove entries from memory cache if not found in sysdbMichal Zidek1-0/+23
Functions nss_cmd_getXXnam remove entries from memory cache if not found in sysdb cache of a local domain.
2012-12-11NSS: Fix the error handler in sss_mc_create_fileJakub Hrozek1-10/+16
https://fedorahosted.org/sssd/ticket/1704 The function is short enough so that we can simply stick with return and release resources before returning as appropriate.
2012-12-10PAC: check the return value of diff_git_listsJakub Hrozek1-0/+4
2012-12-10SSH: Reject requests for authorized keys of rootJan Cholasta1-0/+5
https://fedorahosted.org/sssd/ticket/1687
2012-12-06sudo: print rule name if notBefore or notAfter attribute is missingPavel Březina1-1/+1
...and if sudo_timed = true. https://fedorahosted.org/sssd/ticket/1688 A comma was missing in attribute list. This caused concatenation of the two attributes so we requested one attribute called "objectClasscn". This doesn't affect functionality, only debug messages.
2012-12-05Always append rctx as private dataSimo Sorce1-1/+1
This is used for the new calls back from the data provider.
2012-12-05Hook for mmap cache update on initgroup callsSimo Sorce3-0/+147
This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
2012-12-05Hook to perform a mmap cache update from sssd_nssSimo Sorce3-0/+118
This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
2012-12-05mmap cache: public functions to invalidate recordsSimo Sorce2-0/+135
These functions can be called from the nss responder to invalidate records that have ceased to exist or that need to be refreshed the first time an application needs them.
2012-12-04NSS: Fix netgroup midpoint cache refreshJakub Hrozek3-3/+3
https://fedorahosted.org/sssd/ticket/1683 The result of the percent calculation was always 0 as it used plain ints. The patch switches to using explicit floats to avoid reintroducing the bug again even with brackets.
2012-12-02sudo: print message if old protocol is usedPavel Březina1-3/+15
2012-11-20LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
2012-11-19Refactor the way subdomain accounts are savedSimo Sorce4-29/+53
The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
2012-11-19Display more information on DB version mismatchOndrej Kos1-0/+1
https://fedorahosted.org/sssd/ticket/1589 Added check for determining, whether database version is higher or lower than expected. To distinguish it from other errors it uses following retun values (further used for appropriate error message): EMEDIUMTYPE for lower version than expected EUCLEAN for higher version than expected When SSSD or one of it's tools fails on DB version mismatch, new error message is showed suggesting how to proceed.
2012-11-19SUDO: Fix wrong variable checkJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1650
2012-11-15Add ignore_group_members option.Paul B. Henson1-16/+19
https://fedorahosted.org/sssd/ticket/1376
2012-11-14sudo: print how many rules we are refreshing or returningPavel Březina1-3/+4
2012-11-14sudo: do not send domain name with usernamePavel Březina3-6/+5
This caused troubles with subdomain users and it is not really necessary. This patch does not change the protocol itself, that should be done on the earliest possible occasion. Part of https://fedorahosted.org/sssd/ticket/1616
2012-11-14sudo: support users from subdomainsPavel Březina4-60/+214
https://fedorahosted.org/sssd/ticket/1616
2012-11-14use tmp_ctx in sudosrv_get_sudorules_from_cache()Pavel Březina1-8/+20
2012-11-14sudo: fix missing parameter in two debug messagesPavel Březina1-3/+3
2012-11-12Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek1-17/+12
2012-11-10Store the original group DN in the subdomain user objectSumit Bose1-26/+58
For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
2012-11-10Get lists of GIDs to be added and deleted and use themSumit Bose1-3/+89
Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
2012-11-10Add pac_user_get_grp_info() to read current group membershipsSumit Bose1-0/+106
To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
generated by cgit (git 2.34.1) at 2024-11-18 09:26:52 +0000