sssd.git/src/providers/ipa, branch nonroot-libcap

IPA: add support for new extdom plugin version

2014-09-30T16:24:53+00:00

Initially the extdom plugin was only used to translate SIDs of AD user
and groups to names or POSIX IDs. On IPA clients group memberships were
resolved with the help of the PAC in the Kerberos ticket which required
that the user has logged in at least once. Home directory and the login
shell were auto generated.

The new version of the extdom plugin can return the complete list of
group memberships of a user and the list of all members of a group.
Additionally the gecos field, home directory and login shell are
returned together with an optional list of key-value pairs for arbitrary
data which is written unmodified to the cache.

Fixes https://fedorahosted.org/sssd/ticket/2159
  and https://fedorahosted.org/sssd/ticket/2041

Reviewed-by: Jakub Hrozek

IPA: Use GC for group lookups in server mode

2014-09-25T08:12:57+00:00

https://fedorahosted.org/sssd/ticket/2412

Even though AD trusts often work with POSIX attributes which are
normally not replicated to GC, our group lookups are smart since commit
008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
the LDAP connection and only use the GC connection to look up the members.

Reviewed-by: Pavel Reichl

Add alternative objectClass to group attribute maps

2014-09-15T08:12:57+00:00

In IPA we sometimes need to use posixGroup and
sometimes groupOfNames objectclass to query the
groups. This patch adds the possibility to specify
alternative objectclass in group maps. By
default it is only set for IPA.

Fixes:
https://fedorahosted.org/sssd/ticket/2436

Reviewed-by: Jakub Hrozek

IPA: process non-posix nested groups

2014-09-08T16:55:17+00:00

Do not expect objectClass to be posixGroup but rather more general
groupofnames.

Resolves:
https://fedorahosted.org/sssd/ticket/2343

Reviewed-by: Michal Židek

SSS_CACHE: Allow sss_cache tool to flush SSH hosts cache

2014-09-05T09:40:39+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2358

Signed-off-by: Jan Cholasta 

Reviewed-by: Jan Cholasta 
Reviewed-by: Pavel Reichl

SDAP: new option - DN to ppolicy on LDAP

2014-08-27T12:25:05+00:00

To check value of pwdLockout attribute on LDAP server, DN of ppolicy
must be set.

Resolves:
https://fedorahosted.org/sssd/ticket/2364

Reviewed-by: Pavel Březina

Revert "IPA: new attribute map for non-posix groups"

2014-08-19T17:23:22+00:00

This reverts commit 4c560e7b98e7ab71d22be24d2fbc468396cb634f.

IPA: new attribute map for non-posix groups

2014-08-19T13:46:58+00:00

Create new set of attributes to be used when processing non-posix groups.

Resolves:
https://fedorahosted.org/sssd/ticket/2343

Reviewed-by: Michal Židek

IPA: handle searches by SID in apply_subdomain_homedir

2014-08-19T12:28:44+00:00

https://fedorahosted.org/sssd/ticket/2391

apply_subdomain_homedir() didn't handle the situation where an entity
that doesn't match was requested from the cache. For user and group
lookups this wasn't a problem because the negative match was caught
sooner.

But SID lookups can match either user or group. When a group SID was
requested, the preceding LDAP request matched the SID and stored the
group in the cache. Then apply_subdomain_homedir() only tried to search
user by SID, didn't find the entry and accessed a NULL pointer.

A simple reproducer is:
$ python
>>> import pysss_nss_idmap
>>> pysss_nss_idmap.getnamebysid(group_sid)

The group_sid can be anything, including Domain Users (XXX-513)

Reviewed-by: Jakub Hrozek

case_sensitivity = preserving

2014-07-29T12:52:06+00:00

If case_sensitivity is set to 'preserving', getXXnam
returns name attribute in the same format as
stored in LDAP.

Fixes:
https://fedorahosted.org/sssd/ticket/2367

Reviewed-by: Pavel Reichl