sssd.git/src/config/etc, branch sysdb

AD: Add autofs provider

2015-11-26T15:51:41+00:00

https://fedorahosted.org/sssd/ticket/1632

Adds the possibility to configure:
    autofs_provider = ad

The AD autofs provider uses the rfc2307 (nis*) attribute maps. This is
different (at the moment) from using autofs_provider=ldap with
ldap_schema=ad.

Reviewed-by: Ondrej Valousek 
Reviewed-by: Pavel Březina

p11: enable ocsp checks

2015-11-26T15:39:49+00:00

This patch enables the Online Certificate Status Protocol in NSS and
adds an option to disable it if needed. To make further tuning of
certificate verification more easy it is not an option on its own but an
option to the new certificate_verification configuration option.

Resolves https://fedorahosted.org/sssd/ticket/2812

Reviewed-by: Jakub Hrozek

SSSD: Add a new option diag_cmd

2015-11-13T09:55:50+00:00

This option is an optional one that is run when a sbus ping times out
and before a SIGKILL signal is sent.

It is undocumented by default.

diag_cmd (string):
A command that should be run for diagnostic purpose when an sbus timeout
fails. The option value may contain %p which would be expanded for the
process ID of the process that timed out

Example:
        pstack %p
This setting would print the stackstrace of the service whose ping timed out.

Default: not set.

Reviewed-by: Petr Cech

PAM: Make p11_child timeout configurable

2015-09-23T21:08:50+00:00

Ticket:
https://fedorahosted.org/sssd/ticket/2773

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Pavel Reichl

DYNDNS: Add a new option dyndns_server

2015-08-14T21:51:02+00:00

Some environments use a different DNS server than identity server. For
these environments, it would be useful to be able to override the DNS
server used to perform DNS updates.

This patch adds a new option dyndns_server that, if set, would be used
to hardcode a DNS server address into the nsupdate message.

Reviewed-by: Pavel Reichl

sudo: use "higher value wins" when ordering rules

2015-08-14T20:47:45+00:00

This commit changes the default ordering logic (lower value wins) to
a correct one that is used by native ldap support. It also adds a new
option sudo_inverse_order to switch to the original SSSD (incorrect)
behaviour if needed.

Resolves:
https://fedorahosted.org/sssd/ticket/2682

Reviewed-by: Jakub Hrozek

ssh: generate public keys from certificate

2015-07-31T07:52:06+00:00

Resolves: https://fedorahosted.org/sssd/ticket/2711

Reviewed-by: Jakub Hrozek

LDAP: Add the wildcard_limit option

2015-07-15T15:32:46+00:00

Related:
    https://fedorahosted.org/sssd/ticket/2553

Adds a new wildcard_limit option that is set by default to 1000 (one
page). This option limits the number of entries that can by default be
returned by a wildcard search.

Reviewed-by: Pavel Březina

PAM: authenticate agains cache

2015-07-06T18:19:09+00:00

Enable authenticating users from cache even when SSSD is in online mode.

Introduce new option `cached_auth_timeout`.

Resolves:
https://fedorahosted.org/sssd/ticket/1807

Reviewed-by: Jakub Hrozek

LDAP: add ldap_user_certificate option

2015-06-19T15:21:24+00:00

Related to https://fedorahosted.org/sssd/ticket/2596

Reviewed-by: Pavel Březina