sssd.git/src/providers/krb5, branch sysdb

sysdb: Unify name format for groups and users

2016-01-13T10:28:45+00:00

This is WIP patch to unify format of
usernames and groupnames in sssd internals.

In current form it breaks just about everything.

The sysdb update function is just placeholder
and it's contents are irelevant.

Currently I am working on fqname attribute
removal because it seems to just add confusion.

If you decide to look into the code, please use
sunglasses or other other protective gear and play
some calm music in your backgroun to prevent
eye or brain injury.

KRB5_CHILD: Debug logs for PAC timeout

2015-12-14T12:46:20+00:00

This patch adds debug message that inform user when KRB5_CHILD calls
PAC responder. This action might take a bit of time in case the cache
is not populated or up to date.

Resolves:
https://fedorahosted.org/sssd/ticket/2846

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

KRB5: Mark globals in krb5_opts.h as extern

2015-12-14T12:29:46+00:00

To avoid collisions when we want to work with them elsewhere in the code.

Reviewed-by: Jakub Hrozek

KRB5: Handle KRB5_REALM_UNKNOWN as ERR_NETWORK_IO

2015-12-07T15:07:59+00:00

Resolves:
    https://fedorahosted.org/sssd/ticket/2866

This would help users who authenticate to AD trust servers while offline
and see error messages such as:
    [get_and_save_tgt] (0x0020): 996: [-1765328230][Cannot find KDC for realm "AD.EXAMPLE.COM"]

in the krb5_child.log

Reviewed-by: Pavel Březina

KRB5: Handle preauth request timeout more gracefully

2015-12-07T15:04:45+00:00

The error itself doesn't matter that much, because pam_sss.so handles
all preauth errors gracefully already, but the issue triggered a loud
and confusing debug message in the logs.

Reviewed-by: Pavel Březina

KRB5_CHILD: More restrictive umask

2015-11-05T15:07:51+00:00

We could use more restrictive umask in krb5_child. I found out that
there is directory creation, but it is done by create_ccache_dir()
which has its own umask setup.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

FO: Use refcount to keep track of servers returned to callers

2015-10-23T08:21:13+00:00

Resolves:
    https://fedorahosted.org/sssd/ticket/2829

Reviewed-by: Pavel Březina

REFACTOR: umask(077) --> umask(SSS_DFL_X_UMASK)

2015-10-14T11:27:13+00:00

There are many calls of umask function with 077 argument. This patch
add new constant SSS_DFL_X_UMASK which stands fot 077. So all
occurences of umask(077) are replaced by constant SSS_DFL_X_UMASK.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

KRB5: Offline operation with disabled domain

2015-09-21T15:04:07+00:00

https://fedorahosted.org/sssd/ticket/2637

If a subdomain is in the disabled state, switch krb5_child operation
into offline mode.

Similarly, instead of marking the whole back end as offline, mark just
the domain as offline -- depending on the domain type, this would mark
the whole back end or just inactivate subdomain.

Reviewed-by: Pavel Březina

sssd: incorrect checks on length values during packet decoding

2015-08-31T16:34:26+00:00

https://fedorahosted.org/sssd/ticket/1697

It is safer to isolate the checked (unknown/untrusted)
value on the left hand side in the conditions
to avoid overflows/underflows.

Reviewed-by: Petr Cech