summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2012-11-20LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
2012-11-19Refactor the way subdomain accounts are savedSimo Sorce4-29/+53
The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this incongrunece is that currently group memberships do not return fully qualified names for subdomain users as they should. In oreder to fix this and other potential issues surrounding the violation of the original assumption, we need to fully qualify subdomain user names. By savin them fully qualified we do not risk aliasing local users and have group memberhips or other name based matching code mistake a domain user with subdomain usr or vice versa.
2012-11-19Display more information on DB version mismatchOndrej Kos1-0/+1
https://fedorahosted.org/sssd/ticket/1589 Added check for determining, whether database version is higher or lower than expected. To distinguish it from other errors it uses following retun values (further used for appropriate error message): EMEDIUMTYPE for lower version than expected EUCLEAN for higher version than expected When SSSD or one of it's tools fails on DB version mismatch, new error message is showed suggesting how to proceed.
2012-11-19SUDO: Fix wrong variable checkJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1650
2012-11-15Add ignore_group_members option.Paul B. Henson1-16/+19
https://fedorahosted.org/sssd/ticket/1376
2012-11-14sudo: print how many rules we are refreshing or returningPavel Březina1-3/+4
2012-11-14sudo: do not send domain name with usernamePavel Březina3-6/+5
This caused troubles with subdomain users and it is not really necessary. This patch does not change the protocol itself, that should be done on the earliest possible occasion. Part of https://fedorahosted.org/sssd/ticket/1616
2012-11-14sudo: support users from subdomainsPavel Březina4-60/+214
https://fedorahosted.org/sssd/ticket/1616
2012-11-14use tmp_ctx in sudosrv_get_sudorules_from_cache()Pavel Březina1-8/+20
2012-11-14sudo: fix missing parameter in two debug messagesPavel Březina1-3/+3
2012-11-12Do not always return PAM_SYSTEM_ERR when offline krb5 authentication failsJakub Hrozek1-17/+12
2012-11-10Store the original group DN in the subdomain user objectSumit Bose1-26/+58
For user of the local domain the server-side DN of the groups the user is a member of is stored with the user object in the cache and used to improve performance e.g. by the HBAC code. Since subdomain users should be handled by HBAC as well the group DN is stored in the same way as for users of the local domain. This patch also adds code to remove the attribute from the user object if the user is removed from the group.
2012-11-10Get lists of GIDs to be added and deleted and use themSumit Bose1-3/+89
Currently the user was just added to all local groups which are given in the PAC. With this patch the user is added only to groups he is currently not a member of and deleted from groups which are not found in the PAC anymore.
2012-11-10Add pac_user_get_grp_info() to read current group membershipsSumit Bose1-0/+106
To be able to efficiently store group memberships we need to know the current memberships of a user. sysdb_initgroups() is used to read the user entry together with all groups the user is a member of. Some of the group attributes are kept to avoid additional lookups and speed up further processing. Currently sysdb_initgroups() does not return the original DN of the group. Since it is needed to remove memberships later on it is added to the list of requested attributes
2012-11-10Add diff_gid_lists() with testSumit Bose2-0/+172
This patch adds a new call which compares a list of current GIDs with a list of new GIDs and return a list of GIDs which are currently missing and must be added and another list of GIDs which are not used anymore and must be deleted. The method is the same as used by diff_string_lists().
2012-11-10Add helpers to set common mc record fieldsSimo Sorce1-16/+26
Les copy/paste and chance of errors when setting basic record fields that are shared among all object types.
2012-11-08sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina1-1/+2
If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
2012-11-06sss_cache: Remove fastcache even if sssd is not running.Michal Zidek1-3/+23
https://fedorahosted.org/sssd/ticket/1584
2012-11-02PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek1-0/+1
https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
2012-10-30sudo: do not hardcode protocol versionPavel Březina1-1/+2
2012-10-29Include talloc log in our debug facilityMichal Zidek6-6/+6
https://fedorahosted.org/sssd/ticket/1495
2012-10-29Free the internal DP requestJakub Hrozek1-0/+8
2012-10-26pac responder: add user principal and name alias to cached user objectSumit Bose3-4/+46
The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
2012-10-26pac responder: use only lower case user nameSumit Bose2-5/+15
Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
2012-10-26pac responder: fix copy-and-paste errorSumit Bose1-7/+0
This error prevent proper id-mapping in the PAC responder.
2012-10-23Fix two errors in the nss responderSumit Bose1-1/+3
One is a copy-and-paste error which was introduce by 1774ee9a61b9d691dadd1a0538f32bcdcc84f72f. The second fixes a missing explicit setting of the return value. In the case where we want fully qualified names ret contains the number of characters from the last snprintf() which is almost ever not 0.
2012-10-18Allow setting the default_shell option per-domain as wellJakub Hrozek1-1/+3
https://fedorahosted.org/sssd/ticket/1583
2012-10-12Check for subdomains if getpwuid or getgrgid are the first requestsSumit Bose1-0/+72
Fixes https://fedorahosted.org/sssd/ticket/1561
2012-10-12Save time of last get_domains requestSumit Bose1-0/+16
2012-10-11Fix memory hierarchy in subdomains discoveryJakub Hrozek1-116/+160
https://fedorahosted.org/sssd/ticket/1571 The patch changes the subdomains discovery to use the tevent_req style. Previously, the code violated several rules which made the code very unreadable and led to memory hierarchy issues and use-after-free errors.
2012-10-11nss_cmd_retpwent(): do not go into infinite loop if n < 0Pavel Březina1-0/+8
https://fedorahosted.org/sssd/ticket/1551
2012-10-11do not call dp callbacks when responder is shutting downPavel Březina3-0/+25
https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
2012-10-09Fix typosYuri Chornoivan2-2/+2
2012-10-09Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek1-1/+2
2012-10-05SSH: Expire hosts in known_hostsJan Cholasta3-1/+21
2012-10-05SSH: Refactor sysdb and related codeJan Cholasta2-73/+52
2012-10-02Fix few coding style issuesPavel Březina1-1/+1
2012-10-01Use flat name for master domain as wellSumit Bose2-1/+18
2012-10-01Add new option default_domain_suffixSumit Bose10-24/+65
2012-09-24SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2-6/+2
The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
2012-09-24sss_cache tool invalidates records in memory cache.Michal Zidek3-2/+126
2012-09-20SSH: Fix possible infinite loop when updating known_hostsJan Cholasta1-3/+1
2012-09-13SELinux: Always use the default if it exists on the serverJakub Hrozek1-22/+21
https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
2012-09-13NSS: Fix off-by-one error in parse_getservbynameJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1438
2012-09-04SSH: Simplify public key formatting functionJan Cholasta1-4/+2
2012-09-04SSH: Return error code in SSH utility functionsJan Cholasta1-6/+7
2012-09-04Check if the SELinux login directory existsJakub Hrozek1-3/+3
https://fedorahosted.org/sssd/ticket/1492
2012-08-21accept_fd_handler: add missing returnSumit Bose1-0/+1
2012-08-16Only create the SELinux login file if there are mappings on the serverJakub Hrozek1-45/+77
https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
2012-08-16Do not try to remove the temp login file if already renamedJakub Hrozek1-2/+3
write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
generated by cgit (git 2.34.1) at 2024-07-04 15:14:44 +0000