sssd.git/src/providers/ipa, branch subdomfo

UTIL: Convert domain->disabled into tri-state with domain states

2015-09-01T12:06:29+00:00

This is a first step towards making it possible for domain to be around,
but not contacted by Data Provider.

Also explicitly create domains as enabled, previously we only relied on
talloc_zero marking dom->disabled as false.

sssd: incorrect checks on length values during packet decoding

2015-08-31T16:34:26+00:00

https://fedorahosted.org/sssd/ticket/1697

It is safer to isolate the checked (unknown/untrusted)
value on the left hand side in the conditions
to avoid overflows/underflows.

Reviewed-by: Petr Cech

DYNDNS: remove zone command

2015-08-14T21:54:44+00:00

Remove zone command from message to nsupsate. This command is generally
used to hint nsupdate. In correctly configured environment such
information should be obtained via DNS.

If DNS does not provide necessary information we give other hints.

For more details see:
https://fedorahosted.org/sssd/wiki/DesignDocs/DDNSMessagesUpdate

Resolves:
https://fedorahosted.org/sssd/ticket/2495

Reviewed-by: Jakub Hrozek

DYNDNS: Add a new option dyndns_server

2015-08-14T21:51:02+00:00

Some environments use a different DNS server than identity server. For
these environments, it would be useful to be able to override the DNS
server used to perform DNS updates.

This patch adds a new option dyndns_server that, if set, would be used
to hardcode a DNS server address into the nsupdate message.

Reviewed-by: Pavel Reichl

IPA: Always re-fetch the keytab from the IPA server

2015-08-14T21:44:18+00:00

Even if a keytab for one-way trust exists, re-fetch the keytab again and
try to use it. Fall back to the previous one if it exists.

This is in order to allow the admin to re-establish the trust keytabs
with a simple sssd restart.

Reviewed-by: Pavel Březina

IPA: Change the default of ldap_user_certificate to userCertificate;binary

2015-08-14T21:24:27+00:00

This is safe from ldb point of view, because ldb gurantees the data is
NULL-terminated. We must be careful before we save the data, though.

Resolves:
https://fedorahosted.org/sssd/ticket/2742

Reviewed-by: Pavel Březina

IPA: Improve messages about failures

2015-08-07T09:17:40+00:00

Reviewed-by: Pavel Březina

IPA: Remove MPG groups if getgrgid was called before getpw()

2015-07-31T08:19:52+00:00

https://fedorahosted.org/sssd/ticket/2724

This bug only affects IPA clients that are connected to IPA servers with
AD trust and ID mapping in effect.

If an IPA client calls getgrgid() for an ID that matches a user, the
user's private group would be returned and stored as a group entry.

Subsequent queries for that user would fail, because MPG domains impose
uniqueness restriction for both the ID and name space across groups and
users.

To work around that, we remove the UPG groups in MPG domains during a
group lookup.

Reviewed-by: Sumit Bose

IPA: Handle sssd-owned keytabs when running as root

2015-07-28T09:34:10+00:00

https://fedorahosted.org/sssd/ticket/2718

This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.

Reviewed-by: Alexander Bokovoy

IPA: Better debugging

2015-07-28T09:33:41+00:00

Reviewed-by: Alexander Bokovoy