sssd.git, branch f23

IPA: Always re-fetch the keytab from the IPA server

2015-09-07T16:22:05+00:00

Even if a keytab for one-way trust exists, re-fetch the keytab again and
try to use it. Fall back to the previous one if it exists.

This is in order to allow the admin to re-establish the trust keytabs
with a simple sssd restart.

Reviewed-by: Pavel Březina

UTIL: Provide a common interface to safely create temporary files

2015-09-07T16:21:55+00:00

Reviewed-by: Pavel Březina

IPA: Change the default of ldap_user_certificate to userCertificate;binary

2015-09-07T16:21:48+00:00

This is safe from ldb point of view, because ldb gurantees the data is
NULL-terminated. We must be careful before we save the data, though.

Resolves:
https://fedorahosted.org/sssd/ticket/2742

Reviewed-by: Pavel Březina

LDAP: use ldb_binary_encode when printing attribute values

2015-09-07T16:21:42+00:00

Reviewed-by: Pavel Březina

IPA: Handle sssd-owned keytabs when running as root

2015-09-07T16:20:27+00:00

https://fedorahosted.org/sssd/ticket/2718

This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.

Reviewed-by: Alexander Bokovoy

UTIL: Lower debug level in perform_checks()

2015-09-07T16:20:21+00:00

Failures in perform_checks() don't have to be fatal, therefore the debug
messages shouldn't be either.

Reviewed-by: Alexander Bokovoy

IPA: Better debugging

2015-09-07T16:20:14+00:00

Reviewed-by: Alexander Bokovoy

IPA: Remove MPG groups if getgrgid was called before getpw()

2015-09-07T16:12:16+00:00

https://fedorahosted.org/sssd/ticket/2724

This bug only affects IPA clients that are connected to IPA servers with
AD trust and ID mapping in effect.

If an IPA client calls getgrgid() for an ID that matches a user, the
user's private group would be returned and stored as a group entry.

Subsequent queries for that user would fail, because MPG domains impose
uniqueness restriction for both the ID and name space across groups and
users.

To work around that, we remove the UPG groups in MPG domains during a
group lookup.

Reviewed-by: Sumit Bose

TESTS: dyndns tests support AAAA addresses

2015-09-07T16:08:25+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2558

DYNDNS: special value '*' for dyndns_iface option

2015-09-07T16:08:17+00:00

Option dyndns_iface has now special value '*' which implies that IPs
from add interfaces should be sent during DDNS update.