sssd.git/src/confdb, branch adlookup

CONFDB: Assume config file version 2 if missing

2015-09-03T07:32:15+00:00

Default to config file version 2 if the version
is not specified explicitly.

Ticket:
https://fedorahosted.org/sssd/ticket/2688

Reviewed-by: Lukáš Slebodník

sudo: use "higher value wins" when ordering rules

2015-08-14T20:47:45+00:00

This commit changes the default ordering logic (lower value wins) to
a correct one that is used by native ldap support. It also adds a new
option sudo_inverse_order to switch to the original SSSD (incorrect)
behaviour if needed.

Resolves:
https://fedorahosted.org/sssd/ticket/2682

Reviewed-by: Jakub Hrozek

ssh: generate public keys from certificate

2015-07-31T07:52:06+00:00

Resolves: https://fedorahosted.org/sssd/ticket/2711

Reviewed-by: Jakub Hrozek

PAM: add certificate support to PAM (pre-)auth requests

2015-07-31T07:52:01+00:00

Reviewed-by: Jakub Hrozek

TESTS: fix compiler warnings

2015-07-28T11:30:46+00:00

Reviewed-by: Lukáš Slebodník

IFP: Add wildcard requests

2015-07-15T15:32:49+00:00

Resolves:
    https://fedorahosted.org/sssd/ticket/2553

Can be used as:

dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \
        /org/freedesktop/sssd/infopipe/Users \
        org.freedesktop.sssd.infopipe.Users.ListByName \
        string:r\* uint32:10

dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \
        /org/freedesktop/sssd/infopipe/Groups \
        org.freedesktop.sssd.infopipe.Groups.ListByName \
        string:r\* uint32:10

dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \
        /org/freedesktop/sssd/infopipe/Users \
        org.freedesktop.sssd.infopipe.Users.ListByDomainAndName \
        string:ipaldap string:r\* uint32:10

dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \
        /org/freedesktop/sssd/infopipe/Groups \
        org.freedesktop.sssd.infopipe.Groups.ListByDomainAndName \
        string:ipaldap string:r\* uint32:10

By default the wildcard_limit is unset, that is, the request will return
all cached entries that match.

Reviewed-by: Pavel Březina

PAM: authenticate agains cache

2015-07-06T18:19:09+00:00

Enable authenticating users from cache even when SSSD is in online mode.

Introduce new option `cached_auth_timeout`.

Resolves:
https://fedorahosted.org/sssd/ticket/1807

Reviewed-by: Jakub Hrozek

SYSDB: Add a forest root attribute to sss_domain_info

2015-06-14T19:44:39+00:00

Instead of complex forest root search methods, establish forest root
during subdomain list update. The subdomain code can then just use the
forest_root pointer.

Reviewed-by: Sumit Bose

SYSDB: Store trust direction for subdomains

2015-06-14T19:44:39+00:00

We need to store the subdomain trust direction in order to recover the
structure after SSSD restart.

The trust direction is a plain uint32_t to avoid leaking the knowledge
about AD trust directions to sysdb while at the same time making it easy
to compare values between sysdb and LDAP and avoid translating the
values.

Reviewed-by: Sumit Bose

confdb: Add new option subdomain_inherit

2015-06-05T14:39:18+00:00

Adds a new option subdomain_inherit that would allow administrators to pick
and choose which option to pass to subdomains.

This option is required for:
    https://fedorahosted.org/sssd/ticket/2644
as a short-term fix.

The proper solution is described in:
    https://fedorahosted.org/sssd/ticket/2599

Reviewed-by: Pavel Reichl