sssd.git/src/providers/ad, branch master

GPO: Use sss_unique_file and close fd on failure

2015-09-01T11:01:42+00:00

The GPO child didn't remove temporary file on failure and didn't close
the fd on failure (the latter was not much of a problem for a
short-lived child process).

Reviewed-by: Pavel Březina

AD: send less logs to syslog

2015-09-01T09:26:26+00:00

Create new callback that handles logging messages in cyrus sasl library.

Resolves:
https://fedorahosted.org/sssd/ticket/2561

Reviewed-by: Pavel Březina

sssd: incorrect checks on length values during packet decoding

2015-08-31T16:34:26+00:00

https://fedorahosted.org/sssd/ticket/1697

It is safer to isolate the checked (unknown/untrusted)
value on the left hand side in the conditions
to avoid overflows/underflows.

Reviewed-by: Petr Cech

DYNDNS: remove zone command

2015-08-14T21:54:44+00:00

Remove zone command from message to nsupsate. This command is generally
used to hint nsupdate. In correctly configured environment such
information should be obtained via DNS.

If DNS does not provide necessary information we give other hints.

For more details see:
https://fedorahosted.org/sssd/wiki/DesignDocs/DDNSMessagesUpdate

Resolves:
https://fedorahosted.org/sssd/ticket/2495

Reviewed-by: Jakub Hrozek

DYNDNS: Add a new option dyndns_server

2015-08-14T21:51:02+00:00

Some environments use a different DNS server than identity server. For
these environments, it would be useful to be able to override the DNS
server used to perform DNS updates.

This patch adds a new option dyndns_server that, if set, would be used
to hardcode a DNS server address into the nsupdate message.

Reviewed-by: Pavel Reichl

AD: Use ad_site also when site search fails

2015-07-29T15:24:15+00:00

https://fedorahosted.org/sssd/ticket/2725

Some deployments use the ad_site option for cases where the AD clients
are not able to find a site for one reason or another. With our current
code, the ad_site option value can only override a site that the client
found, not supply the value for cases no site could be found.

This patch fixes the issue.

Reviewed-by: Jakub Hrozek

AD: Handle cases where no GPOs apply

2015-07-26T18:33:07+00:00

It is possible to have a machine where none of the GPOs associated with
it include access-control rules. Currently, this results in a
denial-by-system-error.

We need to treat this case as allowing the user (see the test cases in
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration

We also need to delete the result object from the cache to ensure that
offline operation will also grant access.

Resolves:
https://fedorahosted.org/sssd/ticket/2713

Reviewed-by: Lukáš Slebodník

Fix minor typos

2015-07-23T09:10:16+00:00

Reviewed-by: Lukáš Slebodník

LDAP: Add the wildcard_limit option

2015-07-15T15:32:46+00:00

Related:
    https://fedorahosted.org/sssd/ticket/2553

Adds a new wildcard_limit option that is set by default to 1000 (one
page). This option limits the number of entries that can by default be
returned by a wildcard search.

Reviewed-by: Pavel Březina

GPO: Fix incorrect strerror on GPO access denial

2015-06-23T13:43:07+00:00

We're attempting to use strerror() to print the result from
ad_gpo_access_check(), but that function returns an extended SSSD errno

Signed-off-by: Lukas Slebodnik 

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek