summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2013-01-15Pass domain to sysdb_get<pwu/grg><id() functionsSimo Sorce1-2/+2
2013-01-15Pass domain to sysdb_get<pw/gr>nam() functionsSimo Sorce3-13/+7
Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore fqnames proper value in subdomains, by testing for a parent domain being present or not.
2013-01-15Make sysdb_domain_dn() require a domain.Simo Sorce1-1/+1
2013-01-15Make sysdb_user_dn() require a domain explictly.Simo Sorce1-1/+1
2013-01-15Refactor sysdb initializationSimo Sorce2-2/+1
Change the way sysdbs are initialized. Make callers responsible for providing the list of domains. Remove the returned array of sysdb contexts, it was used only by sss_cache and not really necessary there either as that tool can easily iterate the domains. Make sysdb ctx children of their respective domains. Neither sysdb context nor domains are ever freed until a program is done so there shouldn't be any memory hierarchy issue. As plus we simplify the code by removing a destructor and a setter function.
2013-01-10Change pam data auth tokens.Simo Sorce2-94/+94
Use the new authtok abstraction and interfaces throught the code.
2013-01-10Code can only check for cached passwordsSimo Sorce1-15/+24
Make it clear to the API users that we can not take arbitrary auth tokens. We can only take a password for now so simplify and clarify the interface.
2013-01-08Refactor gid handling in the PAC responderSumit Bose3-84/+202
Instead of using a single array of gid-domain_pointer pairs, Simo suggested to use a gid array for each domain an store it with a pointer to the domain.
2013-01-08PAC responder: check if existing user differsSumit Bose3-13/+64
If some of the Posix attributes of an user existing in the cache differ from the data given in the current PAC the old user entry is drop and a new one is created with the data from the PAC.
2013-01-08Use hash table to collect GIDs from PAC to avoid dupsSumit Bose1-18/+86
To avoid duplicated entries in the group list all gids are added to a hash table first. Fixes: https://fedorahosted.org/sssd/ticket/1672
2013-01-08Read remote groups from PACSumit Bose1-3/+52
Read the group membership of the remote domain the user belongs to from the PAC and add them to the cache. Fixes: https://fedorahosted.org/sssd/ticket/1666
2013-01-08Remote groups do not have an original DN attributeSumit Bose1-40/+34
Groups from subdomains will not have an attribute holding the original DN because in general it will not be available. This attribute is only used by IPA HABC to improve performance and remote groups cannot be used for access control.
2013-01-08Save domain and GID for groups from the configured domainSumit Bose3-17/+47
Currently users from subdomains can only be members of groups from the configured domain and to access those groups a pointer to the domain struct of the configured domain is used. This patch sets the dom_grp member of struct pac_grp to point to the domain struct of the configured for groups from this domain. This is a first step to allow group membership for groups from subdomains as well. For those groups a pointer to the related subdomain structure will be saved.
2013-01-08Always get user data from PACSumit Bose1-7/+7
Currently some user specific data from the PAC is only read when the user is not already in the cache. Since some of this information is needed later on, e.g. the domain SID the user belongs to, with this patch the data is read always from the PAC.
2013-01-08Update domain ID for local domain as wellSumit Bose1-2/+14
Currently only the flat name of the configured domain is updated if it is not already set. This patch updates the domain ID as well. This is typically the case when trust support is enabled on the server side while sssd is running.
2013-01-08Add find_domain_by_id()Sumit Bose2-0/+42
Currently domains can only be searched by name in the global domain list. To make it easier to find the domain for a given SID find_domain_by_id() which returns a pointer to the domain or subdomain entry in the global domain list if a matching id was found.
2013-01-08Use struct pac_grp instead of gid_t for groups from PACSumit Bose3-18/+25
To be able to handle groupmemberships from other domains more data than just the gid must be kept for groups given in the PAC.
2013-01-07memcache: add macro that validates record lengthPavel Březina1-2/+1
2013-01-07sss_userdel and sss_groupdel with use_fully_qualified_namesMichal Zidek1-15/+50
If use_fully_qualified_names is used, we need to pass fqdn to sss_mmap_cache_*_invalidate.
2013-01-02failover: Protect against empty host namesMichal Zidek1-1/+2
Added new parameter to split_on_separator that allows to skip empty values. The whole function was rewritten. Unit test case was added to check the new implementation. https://fedorahosted.org/sssd/ticket/1484
2012-12-20mmap cache: invalidate cache on fatal errorSimo Sorce3-10/+30
If a fatal EFAULT error is returned by the internal function that frees used memory invalidate the whole cache and reinit it. This way we avoid further corruption and insure clients see consistent data. Also insure we use the right context in init() and we use talloc_zfree() in reinit so that if the init() later fails we do not leave around a pointer to free memory in the callers.
2012-12-20Carefully check records when forcibly invalidatingSimo Sorce1-18/+101
We should never try to invalidate an already invalid record as internal pointers will not be consistent. Carefully test that the record really is valid when we are fishing for free space, and properly invalidate records or return a fatal error if something goes wrong. In order to make the code more robust always invalidate the whole data space on initialization by setting all bits to 1, and make sure to invalidate the whole last allocated slot by converting rec->len to the number of slots instead of just the space used.
2012-12-20Update free table when records are invalidated.Simo Sorce1-14/+23
We were holding up slots when entries were invalidated directly an not through our primitive garbage collection scheme.
2012-12-20nss_mc: Add extra checks when dereferencing recordsSimo Sorce1-0/+12
Although it should enver happen that we pass in an invalid hash it is always better to just not do anything than access memory ouf of the hash table. It can lead to segfaults, or worse referencing memory that should not be touched.
2012-12-19sssd_nss: Plug memory leaksSimo Sorce1-2/+11
A recent patch introduced a glaring memory leak in the routines that clean up memcache memory on initgroups calls.
2012-12-18responder_dp: Add timeout to side requetsSimo Sorce1-1/+25
This is an additional proteciont in case the provider misbheaves to avoid having requests pending forever. Fixes: https://fedorahosted.org/sssd/ticket/1717
2012-12-18AUTOFS: Clear enum cache if a request comes in from the sss_cacheJakub Hrozek1-0/+22
In order for sss_cache to work correctly, we must also signal the autofs responder to invalidate the hash table requests.
2012-12-18RESPONDERS: Create a common file with service names and versionsJakub Hrozek10-16/+49
The monitor sends calls different sbus methods to different responders. Instead of including headers of the particular responders directly in monitor, which breaks layering a little, create a common header file that will be included from src/responder/common/
2012-12-18AUTOFS: remove all maps from hash if request for auto.master comes inJakub Hrozek2-3/+59
https://fedorahosted.org/sssd/ticket/1592 When a request for auto.master comes in, we need to remove all the maps from the lookup hash table. We can't simply delete the maps, because another request might be processing them, so instead the maps are removed from the hash table, effectively becoming orphaned. The maps will get freed when the timed destructor is invoked.
2012-12-18AUTOFS: allow removing entries from hash tableJakub Hrozek3-1/+32
There is a timed desctructor in the autofs responder that, when the entry timeout passes, removes the autofs map from the hash table while the map is freed. This patch adds a hash delete callback so that if the map is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
2012-12-14sssd_pam: Cleanup requests cache on sbus reconectSimo Sorce1-1/+4
The pam responder was not properly configured to recover from a backend disconnect. The connections that were in flight before the disconnection were never freed and new requests for the same user would just pile up on top of the now phantom requests. Fixes: https://fedorahosted.org/sssd/ticket/1655
2012-12-14Allow mmap calls to gracefully return absent ctxSimo Sorce1-0/+25
This is to allow to freely call mc functions even if initialization failed. They will now gracefully fail instead of segfaulting.
2012-12-13sssd_nss: Remove entries from memory cache if not found in sysdbMichal Zidek1-0/+23
Functions nss_cmd_getXXnam remove entries from memory cache if not found in sysdb cache of a local domain.
2012-12-11NSS: Fix the error handler in sss_mc_create_fileJakub Hrozek1-10/+16
https://fedorahosted.org/sssd/ticket/1704 The function is short enough so that we can simply stick with return and release resources before returning as appropriate.
2012-12-10PAC: check the return value of diff_git_listsJakub Hrozek1-0/+4
2012-12-10SSH: Reject requests for authorized keys of rootJan Cholasta1-0/+5
https://fedorahosted.org/sssd/ticket/1687
2012-12-06sudo: print rule name if notBefore or notAfter attribute is missingPavel Březina1-1/+1
...and if sudo_timed = true. https://fedorahosted.org/sssd/ticket/1688 A comma was missing in attribute list. This caused concatenation of the two attributes so we requested one attribute called "objectClasscn". This doesn't affect functionality, only debug messages.
2012-12-05Always append rctx as private dataSimo Sorce1-1/+1
This is used for the new calls back from the data provider.
2012-12-05Hook for mmap cache update on initgroup callsSimo Sorce3-0/+147
This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
2012-12-05Hook to perform a mmap cache update from sssd_nssSimo Sorce3-0/+118
This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
2012-12-05mmap cache: public functions to invalidate recordsSimo Sorce2-0/+135
These functions can be called from the nss responder to invalidate records that have ceased to exist or that need to be refreshed the first time an application needs them.
2012-12-04NSS: Fix netgroup midpoint cache refreshJakub Hrozek3-3/+3
https://fedorahosted.org/sssd/ticket/1683 The result of the percent calculation was always 0 as it used plain ints. The patch switches to using explicit floats to avoid reintroducing the bug again even with brackets.
2012-12-02sudo: print message if old protocol is usedPavel Březina1-3/+15
2012-11-20LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
2012-11-19Refactor the way subdomain accounts are savedSimo Sorce4-29/+53
The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
2012-11-19Display more information on DB version mismatchOndrej Kos1-0/+1
https://fedorahosted.org/sssd/ticket/1589 Added check for determining, whether database version is higher or lower than expected. To distinguish it from other errors it uses following retun values (further used for appropriate error message): EMEDIUMTYPE for lower version than expected EUCLEAN for higher version than expected When SSSD or one of it's tools fails on DB version mismatch, new error message is showed suggesting how to proceed.
2012-11-19SUDO: Fix wrong variable checkJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1650
2012-11-15Add ignore_group_members option.Paul B. Henson1-16/+19
https://fedorahosted.org/sssd/ticket/1376
2012-11-14sudo: print how many rules we are refreshing or returningPavel Březina1-3/+4
2012-11-14sudo: do not send domain name with usernamePavel Březina3-6/+5
This caused troubles with subdomain users and it is not really necessary. This patch does not change the protocol itself, that should be done on the earliest possible occasion. Part of https://fedorahosted.org/sssd/ticket/1616
generated by cgit (git 2.34.1) at 2024-11-19 08:40:27 +0000