sssd.git/src/confdb, branch sysdb

p11: enable ocsp checks

2015-11-26T15:39:49+00:00

This patch enables the Online Certificate Status Protocol in NSS and
adds an option to disable it if needed. To make further tuning of
certificate verification more easy it is not an option on its own but an
option to the new certificate_verification configuration option.

Resolves https://fedorahosted.org/sssd/ticket/2812

Reviewed-by: Jakub Hrozek

SSSD: Add a new option diag_cmd

2015-11-13T09:55:50+00:00

This option is an optional one that is run when a sbus ping times out
and before a SIGKILL signal is sent.

It is undocumented by default.

diag_cmd (string):
A command that should be run for diagnostic purpose when an sbus timeout
fails. The option value may contain %p which would be expanded for the
process ID of the process that timed out

Example:
        pstack %p
This setting would print the stackstrace of the service whose ping timed out.

Default: not set.

Reviewed-by: Petr Cech

util: Update get_next_domain's interface

2015-10-23T08:32:23+00:00

Update get next domain to be able to
include disbled domains and change the
interface to accept flags instead of
multiple booleans.

Ticket:
https://fedorahosted.org/sssd/ticket/2673

Reviewed-by: Jakub Hrozek

REFACTOR: umask(0177) --> umask(SSS_DFL_UMASK)

2015-10-14T11:27:02+00:00

There are many calls of umask function with 0177 argument. This patch
add new constant SSS_DFL_UMASK which stands for 0177. So all occurences
of umask(0177) (except responder code) are replaced by constant
SSS_DFL_UMASK.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

confdb: warn if memcache_timeout > than entry_cache

2015-09-30T14:37:57+00:00

Only group and user records are cached in memory cache so only timeouts
for those are checked.

Resolves:
https://fedorahosted.org/sssd/ticket/2176

Reviewed-by: Pavel Březina

PAM: Make p11_child timeout configurable

2015-09-23T21:08:50+00:00

Ticket:
https://fedorahosted.org/sssd/ticket/2773

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Pavel Reichl

UTIL: Convert domain->disabled into tri-state with domain states

2015-09-21T15:03:01+00:00

Required for:
https://fedorahosted.org/sssd/ticket/2637

This is a first step towards making it possible for domain to be around,
but not contacted by Data Provider.

Also explicitly create domains as active, previously we only relied on
talloc_zero marking dom->disabled as false.

Reviewed-by: Pavel Březina

CONFDB: Assume config file version 2 if missing

2015-09-03T07:32:15+00:00

Default to config file version 2 if the version
is not specified explicitly.

Ticket:
https://fedorahosted.org/sssd/ticket/2688

Reviewed-by: Lukáš Slebodník

sudo: use "higher value wins" when ordering rules

2015-08-14T20:47:45+00:00

This commit changes the default ordering logic (lower value wins) to
a correct one that is used by native ldap support. It also adds a new
option sudo_inverse_order to switch to the original SSSD (incorrect)
behaviour if needed.

Resolves:
https://fedorahosted.org/sssd/ticket/2682

Reviewed-by: Jakub Hrozek

ssh: generate public keys from certificate

2015-07-31T07:52:06+00:00

Resolves: https://fedorahosted.org/sssd/ticket/2711

Reviewed-by: Jakub Hrozek