public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,028 Commits 9 Branches 0 Tags
7ef4e9eb810063243fcc575434d856c854b14eee
Commit Graph
29 Commits
Author SHA1 Message Date
Simo Sorce ab4fcb0fe2 Simplify date manipulation in pwd plugin 
Use a helper function to perform operations on dates in LDAP attributes.

Related to #2795

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: David Kupka <dkupka@redhat.com>
 2016-07-25 05:08:55 -04:00
Simo Sorce e011b376a5 Improve keytab code to select the right principal. 
Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD
compatibility), however since we added alias support we need to search for the
krbCanonicalName in preference, hen nothing is specified, and for the requested
principal name when a getkeytab operation is performed. This is so that the
correct salt can be applied. (Windows AD uses some peculiar aliases for some
special accounts to generate the salt).

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2016-02-01 13:28:39 +01:00
Nathaniel McCallum bdccb0c721 Preliminary refactoring of libotp files 
There are no major changes in this commit other than changing filenames
and symbols to have consistent namespaces. This prepares for larger
changes to come in subsequent commits.

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2014-12-03 08:48:56 +01:00
Simo Sorce 88bcf5899c keytabs: Expose and modify key encoding function 
Make it available outside of the encoding.c file for use in a follow-up
patch. Add option to not pass a password and generate a random key
instead.

Related:
https://fedorahosted.org/freeipa/ticket/3859

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
 2014-06-26 10:30:53 +02:00
Nathaniel McCallum 9f62d0c157 Teach ipa-pwd-extop to respect global ipaUserAuthType settings 
https://fedorahosted.org/freeipa/ticket/4105

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-02-21 10:26:02 +01:00
Nathaniel McCallum a51b07c275 Add OTP sync support to ipa-pwd-extop 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-02-21 10:26:02 +01:00
Sumit Bose d876a22732 Remove generation and handling of LM hashes 
https://fedorahosted.org/freeipa/ticket/3795
 2013-11-01 09:28:35 +01:00
Nathaniel McCallum 5b58348cd3 Add OTP support to ipa-pwd-extop 
During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.

    https://fedorahosted.org/freeipa/ticket/3367
    http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum 1e1bab4edc Remove unnecessary prefixes from ipa-pwd-extop files 2013-05-17 09:30:51 +02:00
Rob Crittenden f1f1b4e7f2 Enable transactions by default, make password and modrdn TXN-aware 
The password and modrdn plugins needed to be made transaction aware
for the pre and post operations.

Remove the reverse member hoop jumping. Just fetch the entry once
and all the memberof data is there (plus objectclass).

Fix some unit tests that are failing because we actually get the data
now due to transactions.

Add small bit of code in user plugin to retrieve the user again
ala wait_for_attr but in the case of transactions we need do it only
once.

Deprecate wait_for_attr code.

Add a memberof fixup task for roles.

https://fedorahosted.org/freeipa/ticket/1263
https://fedorahosted.org/freeipa/ticket/1891
https://fedorahosted.org/freeipa/ticket/2056
https://fedorahosted.org/freeipa/ticket/3043
https://fedorahosted.org/freeipa/ticket/3191
https://fedorahosted.org/freeipa/ticket/3046
 2012-11-21 14:55:12 +01:00
Sumit Bose 27f02881c1 Make pwd-extop aware of new ipaNTHash attribute 2011-12-06 08:29:53 -05:00
Yuri Chornoivan 1785d0a7c1 Fix typos 
Fix "The the" and "classses" in FreeIPA code and messages.

https://fedorahosted.org/freeipa/ticket/1480
 2011-09-07 13:20:42 +02:00
Simo Sorce 35e15f6c91 ipa-pwd-extop: Allow kadmin to set krb keys 
Prevent the ipa-pwd-extop plugin from re-generating keys when kadimn is storing
a new set of keys. Only generate the userPassword and sambaXXPassword hashes.
Also avoid checking policies in this case and if history is provided avoid
regenerating the passwordHistory too.
 2011-08-26 08:24:50 -04:00
Simo Sorce 7ea0b5d56e ipa-pwd-extop: Use common password policy code 2011-08-26 08:24:50 -04:00
Simo Sorce eed401306c ipa-pwd-extop: Move encoding in common too 
Also to be used by ipa-kdb
 2011-08-26 08:24:49 -04:00
Simo Sorce b4aab3d98d ipa-pwd-extop: Use common krb5 structs from kdb.h 
This removes custom structures and allows easier sharing of code with ipa-kdb
 2011-08-26 08:24:49 -04:00
Simo Sorce 229b9a209c ipa-pwd-extop: Use the proper mkvno number in keys 
Setting 0 will work as MIT KDCs assume the current master key when that is
found. But it is a legacy compatibility mode and we should instead set the
proper mkvno number on keys so changeing master key becomes possible w/o
having to do a dump reload and stopping the service. This is especially
important in replicated environments.
 2011-08-26 08:24:49 -04:00
Simo Sorce c42cf02405 ipa-pwd_extop: use endian.h instead of nih function 2011-08-26 08:24:48 -04:00
Simo Sorce 5341a22ba2 Update krbExtraData too when changing passwords. 
Fixes: https://fedorahosted.org/freeipa/ticket/937
 2011-02-14 13:36:27 -05:00
Jakub Hrozek 8a9fdbfb03 Do not use LDAP_DEPRECATED in plugins 
Remove the LDAP_DEPRECATED constant and do not use functions that are
marked as deprecated in recent OpenLDAP releases. Also always define
WITH_{MOZLDAP,OPENLDAP} since there are conditional header includes that
depend on that constant.

https://fedorahosted.org/freeipa/ticket/576
 2011-01-07 05:00:44 -05:00
Jakub Hrozek 7493d781df Change FreeIPA license to GPLv3+ 
The changes include:
 * Change license blobs in source files to mention GPLv3+ not GPLv2 only
 * Add GPLv3+ license text
 * Package COPYING not LICENSE as the license blobs (even the old ones)
   mention COPYING specifically, it is also more common, I think

 https://fedorahosted.org/freeipa/ticket/239
 2010-12-20 17:19:53 -05:00
Simo Sorce 37f48c0019 Make use of mozldap vs openldap for plugins selectable 2010-12-06 12:23:09 -05:00
Jakub Hrozek 3b7a86024b Use internal implementation of internal Kerberos functions 
Don't use KRB5_PRIVATE.

The patch implements and uses the following krb5 functions that are
otherwise private in recent MIT Kerberos releases:
 * krb5_principal2salt_norealm
 * krb5_free_ktypes

Signed-off-by: Simo Sorce <ssorce@redhat.com>
 2010-11-22 16:01:35 -05:00
Jakub Hrozek 5da451876e Common include file for SLAPI plugin logging 
Consolidate the common logging macros into common/util.h and use them
in SLAPI plugins instead of calling slapi_log_error() directly.

https://fedorahosted.org/freeipa/ticket/408

Signed-off-by: Simo Sorce <ssorce@redhat.com>
 2010-11-22 16:01:35 -05:00
Simo Sorce 79c39339da pwd-plugin: fix slapi log target in logging functions 2010-10-28 17:17:59 -04:00
Simo Sorce 016f889a51 Improve logging facilities 
Provide simplified logging macros that appropriately use __func__ __FILE__,
__LINE__, or the plugin name depending on the log level.
 2010-10-07 11:23:51 -04:00
Simo Sorce ec33e38e9a pwd-plugin: Fix unresolve symbol 
This fixes a har crash when someone tries to fetch a keytab
 2010-10-07 11:16:19 -04:00
Simo Sorce c594ab88ba Add options to control NTLM hashes 
By default LM hash is disabled.
Of course generation still depends on whether the SamAccount objectclass is
present in the user object.
 2010-10-05 08:54:08 -04:00
Simo Sorce 3127df2aee Split ipa_pwd_extop plugin in multiple files 
The plugin was getting difficult to read and maintain.
Split it (and apply cosmetic cleanups to some functions) in smaller
pieces that perform specific tasks.
 2010-10-01 11:17:40 -04:00