sssd.git/src/providers/ipa, branch f23

IPA: Always re-fetch the keytab from the IPA server

2015-09-07T16:22:05+00:00

Even if a keytab for one-way trust exists, re-fetch the keytab again and
try to use it. Fall back to the previous one if it exists.

This is in order to allow the admin to re-establish the trust keytabs
with a simple sssd restart.

Reviewed-by: Pavel Březina

IPA: Change the default of ldap_user_certificate to userCertificate;binary

2015-09-07T16:21:48+00:00

This is safe from ldb point of view, because ldb gurantees the data is
NULL-terminated. We must be careful before we save the data, though.

Resolves:
https://fedorahosted.org/sssd/ticket/2742

Reviewed-by: Pavel Březina

IPA: Handle sssd-owned keytabs when running as root

2015-09-07T16:20:27+00:00

https://fedorahosted.org/sssd/ticket/2718

This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.

Reviewed-by: Alexander Bokovoy

IPA: Better debugging

2015-09-07T16:20:14+00:00

Reviewed-by: Alexander Bokovoy

IPA: Remove MPG groups if getgrgid was called before getpw()

2015-09-07T16:12:16+00:00

https://fedorahosted.org/sssd/ticket/2724

This bug only affects IPA clients that are connected to IPA servers with
AD trust and ID mapping in effect.

If an IPA client calls getgrgid() for an ID that matches a user, the
user's private group would be returned and stored as a group entry.

Subsequent queries for that user would fail, because MPG domains impose
uniqueness restriction for both the ID and name space across groups and
users.

To work around that, we remove the UPG groups in MPG domains during a
group lookup.

Reviewed-by: Sumit Bose

KRB5: Add and use krb5_auth_queue_send to queue requests by default

2015-07-06T13:23:44+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2701

Previously, only the krb5 provides used to queue requests, which
resulted in concurrent authentication requests stepping on one another.

This patch queues requests by default.

Reviewed-by: Sumit Bose

views: Add is_default_view helper function

2015-07-02T11:37:38+00:00

Ticket:
https://fedorahosted.org/sssd/ticket/2641

Reviewed-by: Pavel Reichl

LDAP/IPA: add user lookup by certificate

2015-06-19T16:48:13+00:00

Related to https://fedorahosted.org/sssd/ticket/2596

Reviewed-by: Pavel Březina

LDAP: add ldap_user_certificate option

2015-06-19T15:21:24+00:00

Related to https://fedorahosted.org/sssd/ticket/2596

Reviewed-by: Pavel Březina

BUILD: Store keytabs in /var/lib/sss/keytabs

2015-06-16T16:27:39+00:00

Make sure the directory is only accessible to the sssd user

Reviewed-by: Michal Židek