sssd.git/src/providers/ldap, branch mdbtest

IPA: allow initgroups by SID for AD users

2015-04-29T09:33:22+00:00

If a user from a trusted AD domain is search with the help of an
override name the SID from the override anchor is used to search the
user in AD. Currently the initgroups request only allows searches by
name.  With this patch a SID can be used as well.

Resolves https://fedorahosted.org/sssd/ticket/2632

Reviewed-by: Jakub Hrozek

SDAP: Filter ad groups in initgroups

2015-04-14T11:13:30+00:00

Function sdap_add_incomplete_groups stored domain local groups
from subdomain as POSIX group, which should not be done.

Resolves:
https://fedorahosted.org/sssd/ticket/2614

Reviewed-by: Jakub Hrozek

SDAP: Extract filtering AD group to function

2015-04-14T11:13:23+00:00

Patch remove code duplication.

Reviewed-by: Jakub Hrozek

SDAP: Do not set gid 0 twice

2015-04-14T11:13:16+00:00

The gid o was added to sysdb attrs directly in sdap_save_group for 1st time
and for second time in the function sdap_store_group_with_gid,
which was called every time from function sdap_save_group

[sysdb_set_entry_attr] (0x0080): ldb_modify failed:
    [Attribute or value exists](20)[attribute 'gidNumber': value #1
    on 'name=domainlocalgroup1_dom2-493341@sssdad_tree.com,cn=groups,cn=sssdad_tree.com,cn=sysdb' provided more than once]
[sysdb_set_entry_attr] (0x0040): Error: 17 (File exists)
[sysdb_store_group] (0x1000): sysdb_set_group_attr failed.
[sysdb_store_group] (0x0400): Error: 17 (File exists)
[sdap_store_group_with_gid] (0x0040):
    Could not store group domainlocalgroup1_dom2-493341@sssdad_tree.com
[sdap_save_group] (0x0080): Could not store group with GID: [File exists]
[sdap_save_group] (0x0080):
    Failed to save group [domainlocalgroup1_dom2-493341@sssdad_tree.com]: [File exists]
[sdap_save_groups] (0x0040): Failed to store group 0. Ignoring.

Reviewed-by: Jakub Hrozek

LDAP: Set sdap handle as explicitly connected in LDAP auth

2015-04-08T13:15:07+00:00

In case SSSD is set with id_provider=proxy and auth_provider=ldap, the
LDAP provider is not used to retrieve the user info with the
higher-level calls, but the lower-level connection establishment is used
instead. In this case, we need to make sure to mark the connection as
explicitly connected to be notified about results of looking up the DN.

Resolves:
https://fedorahosted.org/sssd/ticket/2620

Reviewed-by: Pavel Březina

enumeration: fix talloc context

2015-04-08T09:22:09+00:00

If for some reason ptask fails (e.g. timeout), req is talloc freed
but because subreq is attached to ectx which is permanent it is
finished anyway. Then a crash occures when we are trying to access
callback data.

The same happens in sdap_dom_enum_ex_send.

Resolves:
https://fedorahosted.org/sssd/ticket/2611

Reviewed-by: Pavel Reichl

LDAP: fix a typo in debug message

2015-03-26T10:23:26+00:00

Reviewed-by: Pavel Březina

ldap: refactor nds_check_expired to use util func

2015-03-23T11:07:03+00:00

Refactor nds_check_expired() to use utility function sss_utc_to_time_t().

Reviewed-by: Jakub Hrozek

ldap: refactor check_pwexpire_kerberos to use util func

2015-03-23T11:06:59+00:00

Refactor check_pwexpire_kerberos() to use utility function
sss_utc_to_time_t().

Modify test to handle new error code ERR_TIMESPEC_NOT_SUPPORTED

Reviewed-by: Jakub Hrozek

TESTS: test expiration

2015-03-23T11:06:51+00:00

Reviewed-by: Jakub Hrozek