summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2013-02-26if selinux is disabled, ignore that selogin dir is missingPavel Březina1-3/+15
https://fedorahosted.org/sssd/ticket/1817
2013-02-21Fix uninitialized time_t var in responderOndrej Kos1-1/+1
https://fedorahosted.org/sssd/ticket/1810
2013-02-14Lower the DEBUG level if an entry cannot be deleted from memcacheJakub Hrozek1-3/+3
2013-02-10Introduce IS_SUBDOMAIN() macroSimo Sorce4-8/+8
Fixes https://fedorahosted.org/sssd/ticket/1766
2013-02-10Parent and subdomains use the same sysdbSimo Sorce2-71/+8
Remove code that tries to get the 'right' sysdb, as it is always going to get the same answer anyway since the recent patches to rework the domains/sysdb relationship.
2013-02-10Change the way domains are linked.Simo Sorce3-78/+32
- Use a double-linked list for domains and subdomains. - Never remove a subdomain, simply mark it as disabled if it becomes unused. - Rework the way subdomains are refreshed. Now sysdb_update_subdomains() actually updates the current subdomains and marks as disabled the ones not found in the sysdb or add new ones found. It never removes them. Removal of missing domains from sysdb is deferred to the providers, which will perform it at refresh time, for the ipa provider that is done by ipa_subdomains_write_mappings() now. sysdb_update_subdomains() is then used to update the memory hierarchy of the subdomains. - Removes sysdb_get_subdomains() - Removes copy_subdomain() - Add sysdb_subdomain_delete()
2013-02-10Add function get_next_domain()Simo Sorce11-101/+83
Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
2013-02-10Update main domain info in placeSimo Sorce1-21/+4
2013-02-10Avoid sysdb_subdom in sysdb_get_subdomains()Simo Sorce1-30/+7
2013-02-10Add realm info to sss_domain_infoSimo Sorce1-0/+1
2013-02-10NSS: Add original homedir to home directory template optionsStephen Gallagher2-6/+7
https://fedorahosted.org/sssd/ticket/1805
2013-01-23Check that strings do not go beyond the end of the packet body in autofs and ↵Jan Cholasta2-7/+7
SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781
2013-01-22sudo responder: change num_rules type from size_t to uint32_tPavel Březina5-20/+20
https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
2013-01-16Invalidate user entry even if there are no groupsJakub Hrozek1-6/+1
Related to https://fedorahosted.org/sssd/ticket/1757 Previously we would optimize the mc invalidate code for cases where the user was a member of some groups. But if the user was removed from the server while being in memory cache, we would only invalidate the mc record if he was a member of at least one supplementary group.
2013-01-16NSS: invalidate memcache user entry on initgr, tooJakub Hrozek1-0/+11
https://fedorahosted.org/sssd/ticket/1757 When the user entry was missing completely after initgroups, we would never invalidate the user entry from cache. This led to dangling cache entried in memory cache if the user was removed from the server while still being in memory cache.
2013-01-15Add domain to some subdomain functionsSimo Sorce1-1/+2
2013-01-15Add domain arguments to sysdb sudo functionsSimo Sorce1-4/+5
2013-01-15Add domain arguments to sysdb ssh functionsSimo Sorce1-3/+4
2013-01-15Add domain arguments to sysdb services functionsSimo Sorce1-6/+6
also fix sysdb_svc_add declarations
2013-01-15Add domain argument to sysdb selinux functionsSimo Sorce1-2/+4
2013-01-15Add domain argument to sysdb autofs functionsSimo Sorce1-2/+2
2013-01-15Add domain argument to sysdb_delete_user()Simo Sorce1-1/+1
Also remove sysdb_delete_domuser()
2013-01-15Add domain argument to sysdb_search_custom()Simo Sorce1-3/+7
Also changes sysdb_search_custom_by_name()
2013-01-15Add domain argument to sysdb_cache_auth()Simo Sorce1-1/+1
2013-01-15Add domain argument to sysdb_store_user()Simo Sorce1-1/+1
Also remove sysdb_store_domuser()
2013-01-15Add domain argument to sysdb_set_user_attr()Simo Sorce2-12/+10
2013-01-15Add domain to sysdb_search_group_by_gid()Simo Sorce1-1/+1
Also remove unused sysdb_search_domgroup_by_gid()
2013-01-15Add domain to sysdb_search_user_by_uid()Simo Sorce1-1/+2
Also remove unused sysdb_search_domuser_by_uid()
2013-01-15Add domain argument to sysdb_get_user_attr()Simo Sorce2-3/+3
2013-01-15Add domain argument to sysdb_initgroups()Simo Sorce2-3/+4
2013-01-15Add domain option to sysdb_get/netgr/attrs() fnsSimo Sorce1-1/+1
2013-01-15Pass domain to sysdb_enum<pw/gr>ebt() functionsSimo Sorce1-4/+4
2013-01-15Pass domain to sysdb_get<pwu/grg><id() functionsSimo Sorce1-2/+2
2013-01-15Pass domain to sysdb_get<pw/gr>nam() functionsSimo Sorce3-13/+7
Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore fqnames proper value in subdomains, by testing for a parent domain being present or not.
2013-01-15Make sysdb_domain_dn() require a domain.Simo Sorce1-1/+1
2013-01-15Make sysdb_user_dn() require a domain explictly.Simo Sorce1-1/+1
2013-01-15Refactor sysdb initializationSimo Sorce2-2/+1
Change the way sysdbs are initialized. Make callers responsible for providing the list of domains. Remove the returned array of sysdb contexts, it was used only by sss_cache and not really necessary there either as that tool can easily iterate the domains. Make sysdb ctx children of their respective domains. Neither sysdb context nor domains are ever freed until a program is done so there shouldn't be any memory hierarchy issue. As plus we simplify the code by removing a destructor and a setter function.
2013-01-10Change pam data auth tokens.Simo Sorce2-94/+94
Use the new authtok abstraction and interfaces throught the code.
2013-01-10Code can only check for cached passwordsSimo Sorce1-15/+24
Make it clear to the API users that we can not take arbitrary auth tokens. We can only take a password for now so simplify and clarify the interface.
2013-01-08Refactor gid handling in the PAC responderSumit Bose3-84/+202
Instead of using a single array of gid-domain_pointer pairs, Simo suggested to use a gid array for each domain an store it with a pointer to the domain.
2013-01-08PAC responder: check if existing user differsSumit Bose3-13/+64
If some of the Posix attributes of an user existing in the cache differ from the data given in the current PAC the old user entry is drop and a new one is created with the data from the PAC.
2013-01-08Use hash table to collect GIDs from PAC to avoid dupsSumit Bose1-18/+86
To avoid duplicated entries in the group list all gids are added to a hash table first. Fixes: https://fedorahosted.org/sssd/ticket/1672
2013-01-08Read remote groups from PACSumit Bose1-3/+52
Read the group membership of the remote domain the user belongs to from the PAC and add them to the cache. Fixes: https://fedorahosted.org/sssd/ticket/1666
2013-01-08Remote groups do not have an original DN attributeSumit Bose1-40/+34
Groups from subdomains will not have an attribute holding the original DN because in general it will not be available. This attribute is only used by IPA HABC to improve performance and remote groups cannot be used for access control.
2013-01-08Save domain and GID for groups from the configured domainSumit Bose3-17/+47
Currently users from subdomains can only be members of groups from the configured domain and to access those groups a pointer to the domain struct of the configured domain is used. This patch sets the dom_grp member of struct pac_grp to point to the domain struct of the configured for groups from this domain. This is a first step to allow group membership for groups from subdomains as well. For those groups a pointer to the related subdomain structure will be saved.
2013-01-08Always get user data from PACSumit Bose1-7/+7
Currently some user specific data from the PAC is only read when the user is not already in the cache. Since some of this information is needed later on, e.g. the domain SID the user belongs to, with this patch the data is read always from the PAC.
2013-01-08Update domain ID for local domain as wellSumit Bose1-2/+14
Currently only the flat name of the configured domain is updated if it is not already set. This patch updates the domain ID as well. This is typically the case when trust support is enabled on the server side while sssd is running.
2013-01-08Add find_domain_by_id()Sumit Bose2-0/+42
Currently domains can only be searched by name in the global domain list. To make it easier to find the domain for a given SID find_domain_by_id() which returns a pointer to the domain or subdomain entry in the global domain list if a matching id was found.
2013-01-08Use struct pac_grp instead of gid_t for groups from PACSumit Bose3-18/+25
To be able to handle groupmemberships from other domains more data than just the gid must be kept for groups given in the PAC.
2013-01-07memcache: add macro that validates record lengthPavel Březina1-2/+1
generated by cgit (git 2.34.1) at 2024-11-19 15:09:45 +0000