summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2013-08-22proxy: Allow initgroup to return NOTFOUNDSimo Sorce1-0/+16
When the user is only member of its own primary group, initgroups_dyn may return NOTFOUND as, at least for the 'files' nss provider the code skips the passed in group. Resolves: https://fedorahosted.org/sssd/ticket/2051
2013-08-22mmap_cache: Use sss_atomic_write_s instead of write.Michal Zidek1-2/+11
Use sss_atomic_write_s() instead of write() in sss_mc_save_corrupted(). Also unlink() the file if no data were written. It is better to use sss_atomic_write_s instead of write
2013-08-22KRB5: Only set active and valid on successStephen Gallagher1-6/+5
The FILE cache only sets the return values of _active and _bool if the entire function succeeds. The DIR cache was setting it even on failure. This patch makes both consistent. This will benefit static analysis tools which would be able to detect if the variable is ever used uninitialized anywhere.
2013-08-22KRB5: Refactor cc_*_check_existingStephen Gallagher1-61/+59
There was duplicated code in cc_file_check_existing() and in cc_dir_check_existing(). I pulled them into the same function. There are two changes made to the original code here: 1) Fixes a use-after-free bug in cc_file_check_existing(). In the original code, we called krb5_free_context() and then used that context immediately after that in krb5_cc_close(). This patch corrects the ordering 2) The krb5_cc_resolve() call handles KRB5_FCC_NOFILE for all cache types. Previously, this was only handled for DIR caches.
2013-08-22KRB5: Add new #define for collection cache typesStephen Gallagher8-35/+35
Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate.
2013-08-19sysdb_add_incomplete_group: store SID string is availableSumit Bose5-14/+72
During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
2013-08-19save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose1-0/+16
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose1-4/+14
For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
2013-08-19mmap_cache: Store corrupted mmap cache before resetMichal Zidek1-0/+66
This patch adds function to store corrupted mmap cache file to disk for further analysis.
2013-08-19sudo: continue if we are unable to resolve fqdnPavel Březina1-1/+0
https://fedorahosted.org/sssd/ticket/2043
2013-08-19mmap_cache: Use better checks for corrupted mc in responderMichal Zidek2-5/+53
We introduced new way to check integrity of memcache in the client code. We should use similiar checks in the responder.
2013-08-19mmap_cache: Off by one error.Michal Zidek4-14/+17
Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
2013-08-19mmap_cache: Remove triple checks in client code.Michal Zidek2-40/+20
We had pattern in client code with 3 conditions that can be replaced with one.
2013-08-19mmap_cache: Check data->name value in client codeMichal Zidek2-0/+37
data->name value must be checked to prevent segfaults in case of corrupted memory cache. resolves: https://fedorahosted.org/sssd/ticket/2018
2013-08-19KRB5: Do not log to syslog on each loginJakub Hrozek1-1/+3
2013-08-19KRB5: Formatting changesJakub Hrozek1-4/+4
2013-08-19fill_initgr: add original primary GID if availableSumit Bose2-0/+28
In some cases when MPG domains are used the information about the original primary group of a user cannot be determined by looking at the explicit group memberships. In those cases the GID related to the original primary group is stored in a special attribute of the user object. This patch adds the GID of the original primary group when available and needed. Fixes https://fedorahosted.org/sssd/ticket/2027
2013-08-19sdap_save_user: save original primary GID of subdomain usersSumit Bose2-11/+23
If ID mapping is enabled we use magic private groups (MPG) for subdomains, i.e. the UID and the primary GID of the user will have the same numerical value. As a consequence the information about the original primary group might get lost because neither in AD domains nor on a typical UNIX system the user is an explicit member of it's primary group. With this patch the mapped GID or the original primary group is saved in the cached user object under a new attribute. Fixes https://fedorahosted.org/sssd/ticket/2027
2013-08-19sdap_get_initgr_done: use the right SID to get a GIDSumit Bose1-1/+2
2013-08-19ipa_s2n_get_user_done: make sure ALIAS name is lower caseSumit Bose1-2/+18
Fixes https://fedorahosted.org/sssd/ticket/1630
2013-08-19ipa_s2n_get_user_done: free group_attrs as wellSumit Bose1-0/+1
2013-08-19UTIL: Remove obsolete compat macrosJakub Hrozek1-19/+0
All supported tevent releases contain these macros.
2013-08-19AD: Use the correct include guardJakub Hrozek1-3/+3
2013-08-19Remove include recursionLukas Slebodnik1-1/+0
Header file proxy.h included itself.
2013-08-19Check whether servername is not empty string.Lukas Slebodnik1-1/+1
Previous check was wrong, servername cannot be NULL.
2013-08-19proxy: Alocate auth tokens in struct authtok_convLukas Slebodnik1-0/+20
Struct sss_auth_token became opaque in commit 9acfb09f7969a69f58bd45c856b01700541853ca. All ocasions of "struct sss_auth_token" was replaced with pointer to this struct, but proper initialization of auth_tokens was missing in struct authtok_conv. Resolves: https://fedorahosted.org/sssd/ticket/2046
2013-08-11mmap_cache: Check if slot and name_ptr are not invalid.Michal Zidek5-2/+73
This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
2013-08-11ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2-0/+30
Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
2013-08-09AD: Cast SASL callbacks to propper typeOndrej Kos1-1/+3
The initialization of ad_sasl_callbacks raised an incompatible pointer type warning. This was caused because the cyrus-sasl API hasa changed. The callback function list needs to be cast now.
2013-08-09Remove unused constantJakub Hrozek1-2/+0
2013-08-09Use the correct resolv timeoutJakub Hrozek1-1/+1
2013-08-08Enable removing nonexisting dn in sdap_handle_account_infoLukas Slebodnik1-1/+1
Change was introduced in commit ca344fde
2013-08-08PAM: Set negcache if user is not found after provider checkJakub Hrozek1-0/+10
2013-08-08PAM: Check negcache when searching for fully qualified users, tooJakub Hrozek1-0/+8
2013-08-08NSS: Clear cached netgroups if a request comes in from the sss_cacheLukas Slebodnik4-0/+55
In order for sss_cache to work correctly, we must also signal the nss responder to invalidate the hash table requests. https://fedorahosted.org/sssd/ticket/1759
2013-08-08NSS: allow removing entries from netgroup hash tableLukas Slebodnik3-1/+32
There is a timed desctructor in the nss responder that, when the entry timeout passes, removes the netgroup from the hash table while the netgroup is freed. This patch adds a hash delete callback so that if the netgroup is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
2013-08-08Fix memory context for hash entriesSumit Bose1-2/+4
In sdap_nested_group_populate_users() username and orignal_dn are allocated on a temporary memory context. If the corresponding user is not found in the cache both are added to a hash which is later on returned to the caller. To avoid a use-after-free when the hash entries are looked up both must be reassigned to the memory context of the hash.
2013-08-07add simple access provider init testPavel Březina1-0/+98
2013-08-07simple access provider: allow fully qualified namesPavel Březina1-46/+95
https://fedorahosted.org/sssd/ticket/2026
2013-08-07Fix memory context for a state memberSumit Bose1-1/+1
primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
2013-08-06sssd_ad: Add hackish workaround for sasl ad_compatSimo Sorce1-0/+41
This tries to set the ad_compat option for sasl, by working around the openldap/sasl initialization as openldap does not allow us to pass down to sasl our own getopt callback. Resolves: https://fedorahosted.org/sssd/ticket/2040
2013-08-05sudo: print better debug message when a rule has multiple cn valuesPavel Březina1-1/+5
2013-08-05sudo: skip rule on error instead of failing completelyPavel Březina1-1/+3
https://fedorahosted.org/sssd/ticket/2031
2013-08-05SSH: Ensure that cmd_ctx->name will not be NULL.Lukas Slebodnik1-4/+6
If cmd_ctx->name was not initialized by sss_parse_name then copy of name will be used. https://fedorahosted.org/sssd/ticket/1970 Coverity ID: 11647
2013-07-31Fix netgroup lookup when using fully qualified namePavel Březina1-2/+2
2013-07-29Netgroups should ignore the 'use_fully_qualified_names' settingStephen Gallagher2-8/+13
Netgroups often have memberNisNetgroup entries included in them that will never process correctly if we require fully-qualified names on the nested lookup. This patch alters the behavior of netgroup lookups to check *all* domains for an unqualified netgroup name, instead of only the ones not requiring fully- qualified names. https://fedorahosted.org/sssd/ticket/2013
2013-07-29Remove unused memory contextLukas Slebodnik1-6/+6
2013-07-29Use GID if subdomain is not MPGJakub Hrozek1-1/+8
https://fedorahosted.org/sssd/ticket/2032 In non-MPG subdomains (such as those that manage their IDs manually with POSIX attributes), we need to set the GID ourself.
2013-07-29Clarify that getnamebysid currently works only with ipa/ad id_providerOndrej Kos1-1/+3
https://fedorahosted.org/sssd/ticket/2035
2013-07-25resolv-tests failing with memory leakMichal Zidek1-2/+4
Wait for c-ares to finish before checking for memory leaks. https://fedorahosted.org/sssd/ticket/1899
generated by cgit (git 2.34.1) at 2024-11-30 04:28:26 +0000