summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2012-11-12Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek1-17/+12
2012-11-10Store the original group DN in the subdomain user objectSumit Bose1-26/+58
For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
2012-11-10Get lists of GIDs to be added and deleted and use themSumit Bose1-3/+89
Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
2012-11-10Add pac_user_get_grp_info() to read current group membershipsSumit Bose1-0/+106
To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
2012-11-10Add diff_gid_lists() with testSumit Bose2-0/+172
This patch adds a new call which compares a list of current GIDs with a list of new GIDs and return a list of GIDs which are currently missing and must be added and another list of GIDs which are not used anymore and must be deleted. The method is the same as used by diff_string_lists().
2012-11-10Add helpers to set common mc record fieldsSimo Sorce1-16/+26
Les copy/paste and chance of errors when setting basic record fields that are shared among all object types.
2012-11-08sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina1-1/+2
If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
2012-11-06sss_cache: Remove fastcache even if sssd is not running.Michal Zidek1-3/+23
https://fedorahosted.org/sssd/ticket/1584
2012-11-02PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek1-0/+1
https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
2012-10-30sudo: do not hardcode protocol versionPavel Březina1-1/+2
2012-10-29Include talloc log in our debug facilityMichal Zidek6-6/+6
https://fedorahosted.org/sssd/ticket/1495
2012-10-29Free the internal DP requestJakub Hrozek1-0/+8
2012-10-26pac responder: add user principal and name alias to cached user objectSumit Bose3-4/+46
The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
2012-10-26pac responder: use only lower case user nameSumit Bose2-5/+15
Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
2012-10-26pac responder: fix copy-and-paste errorSumit Bose1-7/+0
This error prevent proper id-mapping in the PAC responder.
2012-10-23Fix two errors in the nss responderSumit Bose1-1/+3
One is a copy-and-paste error which was introduce by 1774ee9a61b9d691dadd1a0538f32bcdcc84f72f. The second fixes a missing explicit setting of the return value. In the case where we want fully qualified names ret contains the number of characters from the last snprintf() which is almost ever not 0.
2012-10-18Allow setting the default_shell option per-domain as wellJakub Hrozek1-1/+3
https://fedorahosted.org/sssd/ticket/1583
2012-10-12Check for subdomains if getpwuid or getgrgid are the first requestsSumit Bose1-0/+72
Fixes https://fedorahosted.org/sssd/ticket/1561
2012-10-12Save time of last get_domains requestSumit Bose1-0/+16
2012-10-11Fix memory hierarchy in subdomains discoveryJakub Hrozek1-116/+160
https://fedorahosted.org/sssd/ticket/1571 The patch changes the subdomains discovery to use the tevent_req style. Previously, the code violated several rules which made the code very unreadable and led to memory hierarchy issues and use-after-free errors.
2012-10-11nss_cmd_retpwent(): do not go into infinite loop if n < 0Pavel Březina1-0/+8
https://fedorahosted.org/sssd/ticket/1551
2012-10-11do not call dp callbacks when responder is shutting downPavel Březina3-0/+25
https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
2012-10-09Fix typosYuri Chornoivan2-2/+2
2012-10-09Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek1-1/+2
2012-10-05SSH: Expire hosts in known_hostsJan Cholasta3-1/+21
2012-10-05SSH: Refactor sysdb and related codeJan Cholasta2-73/+52
2012-10-02Fix few coding style issuesPavel Březina1-1/+1
2012-10-01Use flat name for master domain as wellSumit Bose2-1/+18
2012-10-01Add new option default_domain_suffixSumit Bose10-24/+65
2012-09-24SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2-6/+2
The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
2012-09-24sss_cache tool invalidates records in memory cache.Michal Zidek3-2/+126
2012-09-20SSH: Fix possible infinite loop when updating known_hostsJan Cholasta1-3/+1
2012-09-13SELinux: Always use the default if it exists on the serverJakub Hrozek1-22/+21
https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
2012-09-13NSS: Fix off-by-one error in parse_getservbynameJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1438
2012-09-04SSH: Simplify public key formatting functionJan Cholasta1-4/+2
2012-09-04SSH: Return error code in SSH utility functionsJan Cholasta1-6/+7
2012-09-04Check if the SELinux login directory existsJakub Hrozek1-3/+3
https://fedorahosted.org/sssd/ticket/1492
2012-08-21accept_fd_handler: add missing returnSumit Bose1-0/+1
2012-08-16Only create the SELinux login file if there are mappings on the serverJakub Hrozek1-45/+77
https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
2012-08-16Do not try to remove the temp login file if already renamedJakub Hrozek1-2/+3
write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
2012-08-16Build SELinux code in responder conditionallyJakub Hrozek1-0/+7
https://fedorahosted.org/sssd/ticket/1480
2012-08-15Fix LOCAL domain lookupsPavel Březina1-19/+22
https://fedorahosted.org/sssd/ticket/1436 Now subdomains are not evaluated for local domains.
2012-08-07Remove SYSDB_SUDO_CACHE_OC from attribute listsPavel Březina1-1/+0
It is not an attribute.
2012-08-07Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina1-1/+1
It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
2012-08-01Change subdomain_infoSimo Sorce1-1/+1
Rename the structure to use a standard name prefix so it is properly name-spaced, in preparation for changing the structure itself.
2012-08-01Fix bad checkJakub Hrozek1-1/+1
2012-07-27Write SELinux config files in responder instead of PAM moduleJan Zeleny1-5/+95
2012-07-27Move SELinux processing from session to account PAM stackJan Zeleny1-1/+2
The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
2012-07-20NSS: Add override_shell optionStephen Gallagher3-2/+18
If override_shell is specified in the [nss] section, all users managed by SSSD will have their shell set to this value. If it is specified in the [domain/DOMAINNAME] section, it will apply to only that domain (and override the [nss] value, if any). https://fedorahosted.org/sssd/ticket/1087
2012-07-18PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek1-1/+1
generated by cgit (git 2.34.1) at 2024-07-01 05:33:10 +0000