Talloc context was not used in functions ad_gpo_parse_gpo_child_response
ad_gpo_process_cse_recv, ad_gpo_store_policy_settings.

Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>

Some internal gpo functions [1] were called just once and with constant
NDR_SCALARS as 2nd argument(ndr_flags), but 2nd argument was not used
in these functions[1]. They used constant NDR_SCALARS.

[1] ndr_pull_security_ace_flags, ndr_pull_security_ace_type,
    ndr_pull_security_ace_object_flags, ndr_pull_security_acl_revision,
    ndr_pull_security_descriptor_revision, ndr_pull_security_descriptor_type

Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>

Resolves:
https://fedorahosted.org/sssd/ticket/2437

Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>

In the access providers, we expect to receive ERR_ACCESS_DENIED when
access is denied, but we were returning EACCES here. The effect was the
same, except that it presented ultimately as a system error instead of
a proper denial.

Related:
https://fedorahosted.org/sssd/ticket/2437

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Reviewed-by: Pavel Reichl <preichl@redhat.com>

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

In IPA we sometimes need to use posixGroup and
sometimes groupOfNames objectclass to query the
groups. This patch adds the possibility to specify
alternative objectclass in group maps. By
default it is only set for IPA.

Fixes:
https://fedorahosted.org/sssd/ticket/2436

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

https://fedorahosted.org/sssd/ticket/2431

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>