sssd.git/src/providers/krb5, branch misc

KRB5_CHILD: More restrictive umask

2015-11-05T15:07:51+00:00

We could use more restrictive umask in krb5_child. I found out that
there is directory creation, but it is done by create_ccache_dir()
which has its own umask setup.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

FO: Use refcount to keep track of servers returned to callers

2015-10-23T08:21:13+00:00

Resolves:
    https://fedorahosted.org/sssd/ticket/2829

Reviewed-by: Pavel Březina

REFACTOR: umask(077) --> umask(SSS_DFL_X_UMASK)

2015-10-14T11:27:13+00:00

There are many calls of umask function with 077 argument. This patch
add new constant SSS_DFL_X_UMASK which stands fot 077. So all
occurences of umask(077) are replaced by constant SSS_DFL_X_UMASK.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

KRB5: Offline operation with disabled domain

2015-09-21T15:04:07+00:00

https://fedorahosted.org/sssd/ticket/2637

If a subdomain is in the disabled state, switch krb5_child operation
into offline mode.

Similarly, instead of marking the whole back end as offline, mark just
the domain as offline -- depending on the domain type, this would mark
the whole back end or just inactivate subdomain.

Reviewed-by: Pavel Březina

sssd: incorrect checks on length values during packet decoding

2015-08-31T16:34:26+00:00

https://fedorahosted.org/sssd/ticket/1697

It is safer to isolate the checked (unknown/untrusted)
value on the left hand side in the conditions
to avoid overflows/underflows.

Reviewed-by: Petr Cech

KRB5: Use sss_unique_file when creating kdcinfo files

2015-08-17T13:22:08+00:00

Reviewed-by: Pavel Březina

KRB5: Use sss_unique file in krb5_child

2015-08-17T13:22:00+00:00

In krb5_child, we intentionally don' set the owner of the temporary
file, because we're not renaming it to a 'stable' name, but rather
directly using it as the ccache.

Reviewed-by: Pavel Březina

krb5: assume online state if KDC proxy is configured

2015-08-05T12:10:24+00:00

If a KDC proxy is configured a request in the KRB5 provider will assume
online state even if the backend is offline without changing the state
of the backend.

Resolves https://fedorahosted.org/sssd/ticket/2700

Reviewed-by: Alexander Bokovoy 
Reviewed-by: Jakub Hrozek

krb5: do not create kdcinfo file if proxy configuration exists

2015-08-05T12:10:16+00:00

Resolves https://fedorahosted.org/sssd/ticket/2652

Reviewed-by: Alexander Bokovoy 
Reviewed-by: Jakub Hrozek

KRB5: Do not try to remove missing ccache

2015-08-05T09:44:05+00:00

There was a misleading debug message in krb5_child
[[sssd[krb5_child[16629]]]] [get_and_save_tgt]
    (0x0080): Failed to remove old ccache file [(null)],
              please remove it manually.

Reviewed-by: Pavel Reichl