summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2011-07-21Only print server address if one is availableJakub Hrozek1-0/+7
2011-07-21Do not add a NULL host parsed from LDAP URIJakub Hrozek1-1/+8
https://fedorahosted.org/sssd/ticket/911
2011-07-13Fix python HBAC bindings for python <= 2.4Jakub Hrozek5-84/+311
Several parts of the HBAC python bindings did not work with old Python versions, such as the one shipped in RHEL5. The changes include: * a compatibility wrapper around python set object * PyModule_AddIntMacro compat macro * Py_ssize_t compat definition * Do not use PyUnicode_FromFormat * several function prototypes and structures used to have "char arguments where they have "const char *" in recent versions. This caused compilation warnings this patch mitigates by using the discard_const hack on python 2.4
2011-07-13Fixes for python HBAC bindingsJakub Hrozek2-12/+105
These changes were proposed during a review: * Change the signature of str_concat_sequence() to const char * * use a getsetter for HbacRule.enabled to allow string true/false and integer 1/0 in addition to bool * fix a minor memory leak (HbacRequest.rule_name) * remove overzealous discard consts
2011-07-13Use ares_search instead of ares_query for hostname resolutionJakub Hrozek1-1/+1
ares_query does not take search or domain directives from /etc/resolv.conf into account https://fedorahosted.org/sssd/ticket/922
2011-07-13Remove unused krb5_service structure memberJakub Hrozek3-7/+1
2011-07-11Check DNS records before updatingJakub Hrozek4-25/+470
https://fedorahosted.org/sssd/ticket/802
2011-07-11Allow returning arbitrary address from resolv_hostent as stringJakub Hrozek2-3/+10
2011-07-11Split reading resolver family order into a separate functionJakub Hrozek3-23/+52
2011-07-11Do not hardcode default resolver timeoutJakub Hrozek2-1/+3
2011-07-11Escape IP address in kdcinfoJakub Hrozek2-14/+36
https://fedorahosted.org/sssd/ticket/909
2011-07-11Move IP adress escaping from the LDAP namespaceJakub Hrozek5-14/+14
2011-07-08Allow NULL memctx in sysdb_custom_subtree_dnStephen Gallagher1-3/+11
ldb_dn_new_fmt() has a bug and cannot take a NULL memory context
2011-07-08Add LDAP access control based on NDS attributesSumit Bose9-3/+253
2011-07-08Add support for experimental featuresSumit Bose2-0/+10
New experimental features should have their own configure switch to enable or disable them at compile time. Additionally they can check if the configure variable build_all_experimental_features is set and enable the feature. This variable will be set if the command line option --enable-all-experimental-features is used to configure sssd. This will make it easy to enable all experimental features. Experimental features should be marked in the man pages. To simplify this include/experimental.xml can be used.
2011-07-08Provide python bindings for the HBAC evaluator libraryJakub Hrozek2-0/+2209
2011-07-08Treat NULL or empty rhost as unknownStephen Gallagher2-11/+25
Previously, we were assuming this meant it was coming from the localhost, but this is not a safe assumption. We will now treat it as unknown and it will fail to match any rule that requires a specified srchost or group of srchosts.
2011-07-08Add ipa_hbac_treat_deny_as optionStephen Gallagher6-2/+42
By default, we will treat the presence of any DENY rule as denying all users. This option will allow the admin to explicitly ignore DENY rules during a transitional period.
2011-07-08Add ipa_hbac_refresh optionStephen Gallagher7-1/+38
This option describes the time between refreshes of the HBAC rules on the IPA server.
2011-07-08Add new HBAC lookup and evaluation routinesStephen Gallagher2-124/+398
2011-07-08Remove old HBAC implementationStephen Gallagher2-1595/+1
2011-07-08Add helper functions for looking up HBAC rule componentsStephen Gallagher6-0/+2616
2011-07-08Add HBAC evaluator and testsStephen Gallagher4-0/+1004
2011-07-08Add helper function msgs2attrs_arrayStephen Gallagher2-0/+33
This function converts a list of ldb_messages into a list of sysdb_attrs.
2011-07-05ipa_dyndns: Use sockaddr_storage for storing IP addressesJakub Hrozek1-12/+17
https://fedorahosted.org/sssd/ticket/915
2011-07-05Call ldap_install_tls() on ldaps connectionsSumit Bose1-0/+15
2011-07-01Replace system() function with fork and execl call.Matthew Ife1-22/+30
This is much more selinux friendly as it allows policy makers to call nscd_domtrans to transition to nscd_t instead of giving more access to the system via the corcmd_exec_bin macro. Modified-by: Simo Sorce <ssorce@redhat.com> Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-07-01Do not access state after tevent_req_done() is called.Sumit Bose1-10/+16
2011-07-01Do not attempt to close() a file descriptor < 0Stephen Gallagher1-1/+3
Coverity 10886
2011-06-30Use ldap_init_fd() instead of ldap_initialize() if availableSumit Bose6-38/+435
2011-06-30Use name based URI instead of IP address based URIsSumit Bose2-38/+3
2011-06-30Add sdap_call_conn_cb() to call add connection callback directlySumit Bose2-0/+40
2011-06-30Add sockaddr_storage to sdap_serviceSumit Bose5-0/+62
2011-06-27fix typosSimo Sorce1-5/+5
2011-06-24Fall back to polling when inotify failsJan Zeleny1-28/+68
2011-06-21Log nsupdate messageJakub Hrozek1-0/+3
https://fedorahosted.org/sssd/ticket/893
2011-06-16Test NULL server hostname in fail over testsJakub Hrozek1-8/+16
2011-06-16Provide TTL structure names for c-ares < 1.7Jakub Hrozek2-0/+11
https://fedorahosted.org/sssd/ticket/898 In c-ares 1.7, the upstream renamed the addrttl/addr6ttl structures to ares_addrttl/ares_addr6ttl so they are in the ares_ namespace. Because they are committed to stable ABI, the contents are the same, just the name changed -- so it is safe to just #define the new name for older c-ares version in case the new one is not detected in configure time.
2011-06-16Do not check pwdAttributeSumit Bose1-9/+0
It is not safe to check pwdAttribute to see if server side password policies are active. Only if a LDAP_CONTROL_PASSWORDPOLICYRESPONSE is present the bind response we can assume that there is a server side password policy.
2011-06-15Switch resolver to using resolv_hostent and honor TTLJakub Hrozek10-276/+401
2011-06-15Resolve hosts by name from DNS into resolv_hostentJakub Hrozek1-0/+254
2011-06-15Resolve hosts by name from files into resolv_hostentJakub Hrozek1-0/+92
2011-06-15Add new resolv_hostent data structure and utility functionsJakub Hrozek2-0/+200
2011-06-15Fix proxy provider return code for secondary missing groupsSumit Bose1-1/+3
2011-06-15Unit test for parge_argsJakub Hrozek1-0/+58
2011-06-15Make parse_args skip extra spacesJakub Hrozek1-16/+24
https://fedorahosted.org/sssd/ticket/871
2011-06-15Fix two typosSumit Bose1-2/+3
2011-06-15Delete cached ccache file if password is expiredSumit Bose1-8/+63
2011-06-02Non-posix group processing - ldap provider and nss responderJan Zeleny3-31/+90
2011-06-02Non-posix group processing - sysdb changesJan Zeleny3-23/+32