sssd.git/src/providers/ipa, branch mdbtest

IPA: fix segfault in ipa_s2n_exop

2015-04-29T15:09:04+00:00

can be triggered on demand by assigning a POSIX group
with external members sudo privileges, then dropping
the cache and doing a sudo -U  -l.

Reviewed-by: Sumit Bose

IPA: allow initgroups by SID for AD users

2015-04-29T09:33:22+00:00

If a user from a trusted AD domain is search with the help of an
override name the SID from the override anchor is used to search the
user in AD. Currently the initgroups request only allows searches by
name.  With this patch a SID can be used as well.

Resolves https://fedorahosted.org/sssd/ticket/2632

Reviewed-by: Jakub Hrozek

IPA: check ghosts in groups found by uuid as well

2015-04-27T13:42:39+00:00

With views and overrides groups are not allowed to have ghost members
anymore because the name of a member might be overridden. To achieve
this ghost members are looked up and resolved later during group
lookups. Currently this is only done for group lookups by name but
should happen as well if the group is looked up by uuid.

Resolves https://fedorahosted.org/sssd/ticket/2631

Reviewed-by: Jakub Hrozek

IPA: use sysdb_attrs_add_string_safe to add group member

2015-04-27T13:41:21+00:00

The member list returned by the extdom plugin might contain some entries
more than once. Although this is an issue on the server side to avoid
ldb errors duplicates should be filtered out on the client as well.

Reviewed-by: Jakub Hrozek

IPA: do not try to save override data for the default view

2015-04-27T13:39:12+00:00

For the default view all override data is available in the cached user
or group object. Even if separate override data is available it should
not be written into the cache.

Resolves https://fedorahosted.org/sssd/ticket/2630

Reviewed-by: Jakub Hrozek

subdom: Remove unused function get_flat_name_from_subdomain_name

2015-04-16T07:31:48+00:00

The function was added in 70eaade10feedd7845e39170d0b7eebf3a030af1 and
is unused since b8d703cf3aba81800cf1b8ccca64bb00ef0b30f7

Reviewed-by: Lukáš Slebodník

selinux: Only call semanage if the context actually changes

2015-04-14T17:58:30+00:00

https://fedorahosted.org/sssd/ticket/2624

Add a function to query the libsemanage database for a user context and
only update the database if the context differes from the one set on the
server.

Adds talloc dependency to libsss_semanage.

Reviewed-by: Michal Židek

IPA: Remove the ipa_hbac_treat_deny_as option

2015-03-24T20:03:41+00:00

https://fedorahosted.org/sssd/ticket/2603

Since deny rules are no longer supported on the server, the client
should no longer support them either. Remove the option.

Reviewed-by: Pavel Březina

IPA: Deprecate the ipa_hbac_treat_deny_as option

2015-03-24T20:03:38+00:00

https://fedorahosted.org/sssd/ticket/2603

Deny rules have not been supported by the IPA server since 2.1. We
should deprecate the ipa_hbac_treat_deny_as option.

Reviewed-by: Pavel Březina

IPA: Only treat malformed HBAC rules as fatal if deny rules are enabled

2015-03-24T20:03:35+00:00

https://fedorahosted.org/sssd/ticket/2603

If deny rules are not in effect, we can skip malformed HBAC rules
because at worst we will deny access. If deny rules are in effect, we
need to error out to be on the safe side and avoid skipping a deny rule.

Reviewed-by: Pavel Březina