sssd.git/src/providers/ldap/sdap_async_initgroups.c, branch dpstr

LDAP: remove unused param. in sdap_fallback_local_user

2015-10-12T12:46:59+00:00

Remove unused sdap_options parameter.

Reviewed-by: Lukáš Slebodník

SDAP: Log failure from sysdb_handle_original_uuid

2015-06-14T19:32:33+00:00

Reviewed-by: Michal Židek

SDAP: Remove unnecessary argument from sdap_save_user

2015-05-22T10:31:01+00:00

Reviewed-by: Pavel Březina

IPA: allow initgroups by UUID for FreeIPA users

2015-05-06T08:43:59+00:00

If a FreeIPA user is searched with the help of an override name the UUID
from the override anchor is used to search the user. Currently the
initgroups request only allows searches by SID or name. With this patch
a UUID can be used as well.

Related to https://fedorahosted.org/sssd/ticket/2642

Reviewed-by: Jakub Hrozek

IPA: allow initgroups by SID for AD users

2015-04-29T09:33:22+00:00

If a user from a trusted AD domain is search with the help of an
override name the SID from the override anchor is used to search the
user in AD. Currently the initgroups request only allows searches by
name.  With this patch a SID can be used as well.

Resolves https://fedorahosted.org/sssd/ticket/2632

Reviewed-by: Jakub Hrozek

SDAP: Filter ad groups in initgroups

2015-04-14T11:13:30+00:00

Function sdap_add_incomplete_groups stored domain local groups
from subdomain as POSIX group, which should not be done.

Resolves:
https://fedorahosted.org/sssd/ticket/2614

Reviewed-by: Jakub Hrozek

sdap: properly handle binary objectGuid attribute

2015-03-20T11:26:47+00:00

Although in the initial processing SSSD treats the binary value right at
some point it mainly assumes that it is a string. Depending on the value
this might end up with the correct binary value stored in the cache but
in most cases there will be only a broken entry in the cache.

This patch converts the binary value into a string representation which
is described in [MS-DTYP] and stores the result in the cache.

Resolves https://fedorahosted.org/sssd/ticket/2588

Reviewed-by: Jakub Hrozek

Add missing new lines to debug messages

2015-03-17T13:40:19+00:00

Reviewed-by: Jakub Hrozek

LDAP/AD: do not resolve group members during tokenGroups request

2015-03-17T10:52:29+00:00

During initgroups requests we try to avoid to resolve the complete
member list of groups if possible, e.g. if there are no nested groups.
The tokenGroups LDAP lookup return the complete list of memberships for
a user hence it is not necessary lookup the other group member and
un-roll nested groups. With this patch only the group entry is looked up
and saved as incomplete group to the cache.

This is achieved by adding a new boolean parameter no_members to
groups_get_send() and sdap_get_groups_send(). The difference to config
options like ldap_group_nesting_level = 0 or ignore_group_members is
that if no_members is set to true groups which are missing in the cache
are created a incomplete groups. As a result a request to lookup this
group will trigger a new LDAP request to resolve the group completely.
This way no information is ignored but the time needed to read all data
is better distributed between different requests.

https://fedorahosted.org/sssd/ticket/2601

Reviewed-by: Jakub Hrozek

LDAP: Add UUID when saving incomplete groups

2015-01-30T11:40:50+00:00

Related to:
https://fedorahosted.org/sssd/ticket/2571

Reviewed-by: Sumit Bose