summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-10-04remove non-nslcd stuffLuke Shumaker
2014-09-28Ignore files generated/placed by ./autogen.shLuke Shumaker
2014-09-28Turn into a new-style systemd daemonLuke Shumaker
2014-07-02Minor comment spelling fixTim Harder
2014-07-02Check a socket's connectivity before trying to use itTim Harder
This alleviates some cases where multi-second lag occurs before a query returns due to some or all connections having been closed by the peer, e.g. a load balancer timing out old connections, but they are all tried before opening new connections. Tested and working on Linux.
2014-07-02Fix copy-pastoArthur de Jong
2014-06-12Use other IP range for testsArthur de Jong
This uses IP addresses from the RFC 5737 TEST-NET-1 range that is meant for use in documentation. This avoids issues with running the tests environments that also use the 10.0.0.0/8 range.
2014-06-06Get files ready for 0.9.4 releaseArthur de Jong
2014-06-06Return correct port number on SolarisArthur de Jong
This is a small fix for when using nscd (which still does not seem to work completely). The port is stored in network byte order but should be printed in host byte order.
2014-06-06Add missing include for FreeBSDArthur de Jong
2014-06-06Fix password modification by rootArthur de Jong
This fixes 15fc13c.
2014-06-06Clear proper buffer lengthArthur de Jong
This fixes 3d29861.
2014-06-06Fix code indentationArthur de Jong
This fixes 2274b41.
2014-06-06Update files from latest automakeArthur de Jong
2014-06-05Fix commentArthur de Jong
2014-06-05Introduce lookup_groupbyuser test commandArthur de Jong
This command can be used to perform a lookup using getgrouplist() to present a list of returned numeric group ids. This can be used to avoid the additional lookups that are done with the id and groups commands.
2014-05-17Clear buffers before free-ingArthur de Jong
This clears most buffers that may hold credentials at one point before free()ing the memory.
2014-05-08Clarify code contributionArthur de Jong
2014-05-04Improve error logging of user login failuresArthur de Jong
2014-05-04Also extract policy controls on BIND failureArthur de Jong
This ensures that controls returned by an LDAP server as part of a failed BIND operation are also returned. This makes it possible to distinguish between a wrong password and an expired password. This also only logs the BIND operation result on DEBUG level (the error is logged later on).
2014-05-04Use FreeBSD lib directory and SONAME on DragonflyArthur de Jong
2014-05-04Small documentation improvementsArthur de Jong
This includes a number of minor changes to the documentation. This also documents the children search scope (related to 2caeef4).
2014-05-04Log daemonising failuresArthur de Jong
This also clears errno in the main function to ensure that no incorrect errno value is logged on errors.
2014-05-04Add a test for setting member attribute mappingArthur de Jong
2014-05-04Fix mapping group member attribute to empty stringArthur de Jong
This fixes be94912.
2014-05-04Make buffer size error logging consistentArthur de Jong
This adds logging of most cases where a defined buffer is not large enough to hold provided data on error log level.
2014-05-04Warn when binddn buffer is too smallArthur de Jong
2014-05-04Grow DN buffer sizeArthur de Jong
The buffer size seems to be a problem in environments with long names or environments with non-ASCII characters.
2014-05-02Use larger nslcd password bufferushi
I had some edge cases where 64 bytes were not enough. People are using password managers with long generated passwords. I increased the buffer size to 128.
2014-03-12Get files ready for 0.9.3 releaseArthur de Jong
2014-03-12Update files from recent automakeArthur de Jong
2014-03-10Run the correct executables for the testsArthur de Jong
This fixes issues with running the tests when using a separate build directory (fixes ef0eddaa).
2014-03-10Fix nslcd-test.conf permissions for testArthur de Jong
This ensures that configuration file is not world readable when the tests are run. This avoids test failure for the use of the rootpwmodpw option.
2014-03-10Interpret transferred integers as signed againArthur de Jong
This fixes an issue with unsigned values ending up in signed fields and missing sign extension. See: https://bugs.debian.org/739330
2014-03-02Use right h_errnop for retrying with larger bufferNalin Dahyabhai
The libc nsswitch code expects h_errno to be set to NETDB_INTERNAL when it needs to try again with a larger buffer. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
2014-03-02Fix crash when retrieving large networks entriesLukas Slebodnik
If NSS_STATUS_TRYAGAIN is returned from read_one_hostent or read_one_netent then fp will be closed and function tio_skipall will be called with NULL pointer. It could happend in functions: _nss_ldap_getnetbyname_r _nss_ldap_getnetbyaddr_r _nss_ldap_gethostbyname2_r _nss_ldap_gethostbyaddr_r Fixes r548 (aka afd5d9b).
2014-01-31Support builtin Windows groupsDavy Defaud
This maps the gid (gidNumber) to an AD SID for builtin groups when searching a group by gid (RID) between 544 and 552. In that case the SID prefix is not the domain's prefix (S-1-5-21-dddddd-dddddd-dddddd) but the BUILTIN SID prefix (1-5-32). For example, if you add a user to the Administrators builtin group (S-1-5-32-544), now you should be able to get this group through nslcd, instead of receiving an error message.
2014-01-25Add test for krb5 thread safetyArthur de Jong
This adds a test that checks the return value of krb5_is_thread_safe() to see if krb5 is thread safe (during build) and issues a warning if it is not. nslcd does not directly link to krb5 but the library may be loaded (by GSSAPI) if Kerberos is used to authenticate nslcd to the LDAP server.
2014-01-25Also detect DragonFly as BSDFrancois Tigeot
This fixes the detection of DragonFly as requiring the freebsd NSS interface flavour.
2014-01-25Update shadow.c to resolve pwdLastSet issuejoshuashire
We read the date into the buffer to the specified length to get it to the Unix time (i.e. seconds) from its AD value of nanoseconds, then convert it to days for shadow. If we use date rather than buffer we end up trying to convert the original nanosecond value.
2014-01-05Implement deref control handlingArthur de Jong
This uses the LDAP_CONTROL_X_DEREF control as described in draft-masarati-ldap-deref-00 to request the LDAP server to dereference group member attribute values to uid attribute values. This should reduce the number of searches that are required for expanding group members that use the member attribute. This mechanism could also be used to extract information on nested groups but the gains are less clear there. Not all LDAP servers support this control. In OpenLDAP, load the (currently undocumented) deref overlay and enable it for the database to take advantage of this improvement. There is a functional difference when using this control. Any returned deferred uid value returned by the LDAP server is accepted as a member. No checks are performed to see if the user matches the search base and search filters set for passwd entries.
2014-01-05Update documentationArthur de Jong
This documents the way the deref controls are used.
2014-01-05Use myldap_get_deref_values() to get member uidsArthur de Jong
This uses information from the deref control (if available) to get the username for each of the members of the group. Any missing deref member attribute values will be seen as nested groups and will be traversed if nested group support is enabled.
2014-01-05Provide a myldap_get_deref_values() functionArthur de Jong
This function looks for deref response controls (LDAP_CONTROL_X_DEREF) in the entry and returns the information from the dereferenced attribute in two lists: dereferenced values and attribute values that could not be dereferenced.
2014-01-05Skip member attributes in bymember searchArthur de Jong
This changes the group by member searches to not request the member attributes. This will speed up result parsing by a fraction because less data is transferred but will also cause the deref control not to be added to these searches.
2014-01-05Provide replacement ldap_create_deref_control()Arthur de Jong
This adds a test for a bug in OpenLDAP that allocated a LDAP_CONTROL_PAGEDRESULTS control instead of a LDAP_CONTROL_X_DEREF control.
2014-01-05Request attribute deref via search controlArthur de Jong
This uses the LDAP_CONTROL_X_DEREF control as descibed in draft-masarati-ldap-deref-00 to request the LDAP server to dereference member attribute values to uid attribute values in order to avoid doing extra searches. This control is currently only added for group search by looking for the member attribute in the search.
2014-01-05Rename entry property to indicate storage typeArthur de Jong
This changes entrye->rangedattributevalues to entry->buffers because the propery is not only used for ranged attribute values but for anything that can be freed with free().
2014-01-05Ignore missing page controlsArthur de Jong
Since we could get arbitrray controls and are only interested in page controls we ignore failures to find page controls.
2014-01-05Use do_try_search() also for paged searchesArthur de Jong
This also changes do_try_search() to support building continued paged controls and lays the groundwork for adding more search controls.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2025-07-03 21:00:17 +0000