sssd.git/src/providers/ad, branch mdbtest

GPO: Do not ignore missing attrs for GPOs

2015-04-30T06:47:00+00:00

We don't want to skip over a GPO that might properly be denying
users.

[sssd[be[a.foo.com]]] [sdap_sd_search_send] (0x0400):
    Searching entry [cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=foo,DC=com] using SD
[sssd[be[a.foo.com]]] [sdap_get_generic_ext_step] (0x0400):
    calling ldap_search_ext with [(objectclass=*)][cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=lzb,DC=hq].
[sssd[be[a.foo.com]]] [sdap_process_message] (0x4000):
    Message type: [LDAP_RES_SEARCH_RESULT]
[sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x0400):
    Search result: Referral(10), 0000202B: RefErr: DSID-0310063C, data 0, 1 access points
        ref 1: 'lzb.hq'
[sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x1000):
    Ref: ldap://foo.com/cn=%7B2BA15B73-9524-419F-B4B7-185E1F0D3DCF%7D,cn=policies,cn=system,DC=foo,DC=com
[sssd[be[a.foo.com]]] [ad_gpo_get_gpo_attrs_done] (0x0040):
    no attrs found for GPO; try next GPO.

Resolves:
https://fedorahosted.org/sssd/ticket/2629

Reviewed-by: Stephen Gallagher

ad_opts: Use different default attribute for group name

2015-04-17T11:35:49+00:00

The MSFT docs [1,2] for LDAP attributes says:
samAccountName is mandotory for 'user' and 'group' objectclasses
via the 'Security-Principal' aux-class

name is part of the 'top' class and *not* mandatory for 'user' or 'group'.

[1] https://msdn.microsoft.com/en-us/library/ms679635%28v=vs.85%29.aspx
[2] https://msdn.microsoft.com/en-us/library/ms678697%28v=vs.85%29.aspx

Resolves:
https://fedorahosted.org/sssd/ticket/2593

Reviewed-by: Sumit Bose

AD GPO: Always look up GPOs from machine domain

2015-04-15T15:30:30+00:00

When dealing with users from a child domain, SSSD was attempting to use
the subdomain for lookups. However, all GPOs applicable to this machine
are stored in the primary domain (the domain the host directly joined).

This patch has the GPO processing use the primary domain instead of the
user domain.

Resolves:
https://fedorahosted.org/sssd/ticket/2606

Reviewed-by: Jakub Hrozek

AD: Always get domain-specific ID connection

2015-04-15T15:30:27+00:00

ad_get_dom_ldap_conn() assumed that ad_ctx->ldap_ctx always points at
the LDAP connection for the primary domain, however it turns out that
this is not always the case. It's currently unclear why, but this
connection can sometimes be pointing at a subdomain. Since the value of
subdom_id_ctx->ldap_ctx always points to the correct domain (including
the primary domain case), there's no benefit to trying to shortcut to
the ad_ctx->ldap_ctx when performing this lookup.

This patch also makes a minor tweak to the tests so that the primary
domain passes the sdap_domain_get() check for validity (since it needs
to have a private member assigned).

Reviewed-by: Jakub Hrozek

AD: Clean up ad_access_gpo

2015-04-15T15:30:14+00:00

Align goto usage with conventions in the rest of the source.

Reviewed-by: Jakub Hrozek

GPO: Check return value of ad_gpo_store_policy_settings

2015-04-01T11:54:05+00:00

Reviewed-by: Pavel Reichl

GPO: error out instead of leaving array element uninitialized

2015-03-23T06:47:02+00:00

In general every object created by the AD provider should have a SID
attribute. Since SIDs and GPOs are used for access control a missing SID
should be treated as error for now until it is known if there is a valid
reason why the SID is missing.

Resolves https://fedorahosted.org/sssd/ticket/2608

Reviewed-by: Jakub Hrozek

Add missing new lines to debug messages

2015-03-17T13:40:19+00:00

Reviewed-by: Jakub Hrozek

be_refresh: add sdap_refresh_init

2015-03-08T21:27:16+00:00

Reviewed-by: Jakub Hrozek

sdap_handle_acct_req_send: remove be_req

2015-03-08T21:27:10+00:00

be_req was used only as a talloc context for subreq. This memory context
was replace by state of the parent request which is more suitable for
tevent coding style.

This change will allow us to use this function in be_refresh where
none be_req is available.

Reviewed-by: Jakub Hrozek