sssd.git/src/confdb, branch sid_index

confdb: Add new option subdomain_inherit

2015-06-08T10:55:29+00:00

Adds a new option subdomain_inherit that would allow administrators to pick
and choose which option to pass to subdomains.

This option is required for:
    https://fedorahosted.org/sssd/ticket/2644
as a short-term fix.

The proper solution is described in:
    https://fedorahosted.org/sssd/ticket/2599

Reviewed-by: Pavel Reichl 
(cherry picked from commit 1711cbfd2e36d44af1ae50e3a2beeec3a1f0b5e8)

Log reason in debug message why ldb_modify failed

2015-03-11T09:07:51+00:00

Reviewed-by: Sumit Bose 
(cherry picked from commit 04d138472cc086fb7961f0d378852b09961b1a33)

PAM: new option pam_account_expired_message

2015-02-23T12:49:53+00:00

This option sets string to be printed when authenticating using SSH
keys and account is expired.

Resolves:
https://fedorahosted.org/sssd/ticket/2050

Reviewed-by: Sumit Bose 
(cherry picked from commit e039f1aefecc65a7b3c2d4a13a612bff1dd367c8)

Add missing new lines to debug messages

2015-02-18T15:16:50+00:00

Reviewed-by: Pavel Reichl

CONFDB: Typo in debug message

2015-01-05T15:37:39+00:00

Reviewed-by: Sumit Bose

confdb: Make confdb_set_string accept const char pointer

2014-11-28T15:09:53+00:00

The last parameter (value) in the confdb_set_string
is not modified, so it makes sense to make it const
to avoid unnecessary warnings or casts.

Reviewed-by: Pavel Reichl

CONFDB: Detect&fix misconf opt refresh_expired_interval

2014-11-04T11:35:41+00:00

Related to:
https://fedorahosted.org/sssd/ticket/2102

Reviewed-by: Pavel Březina

SSSD: Load a user to run a service as from configuration

2014-10-22T13:44:13+00:00

Related:
    https://fedorahosted.org/sssd/ticket/2370

Adds a option, user to run as, that is specified in the [sssd] section. When
this option is specified, SSSD will run as this user and his private
group. When these are not specified, SSSD will run as the configure-time
user and group (usually root).

Currently all services and providers are started as root. There is a
temporary svc_supported_as_nonroot() function that returns true for a
service if that service runs and was tested as nonroot and false
otherwise. Currently this function always returns false, but will be
amended in future patches.

Reviewed-by: Pavel Reichl 
Reviewed-by: Simo Sorce

confdb: add has_views and view_name to sss_domain_info

2014-10-20T14:14:10+00:00

To let the responders know which view is applied and to make view
handling more efficiently especially when no view is applied/available
two new member are added to the sss_domain_info struct.

view_name is the name of the view if available. has_views is only true
if the client has a specific view applied, i.e. it is false for the case
when there are no views at all (e.g. plain LDAP provider) or the client
has the FreeIPA default view. This allows the responders to easily
bypass any view related code.

Reviewed-by: Pavel Březina

PAM: new options pam_trusted_users & pam_public_domains

2014-09-29T16:27:07+00:00

pam_public_domains option is a list of numerical UIDs or user names
that are trusted.

pam_public_domains option is a list of domains accessible even for
untrusted users.

Based on:
https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM

Reviewed-by: Lukáš Slebodník