sssd.git/src/providers/ldap, branch nonroot-libcap

LDAP: Do not require a dereference control to be retuned in a reply

2014-09-29T17:16:45+00:00

When we attempt to request attributes that are not present in
the dereferenced links, some serves might not send the dereference
control back at all. Be permissive and treat the search as if
it didn't find anything.

Reviewed-by: Pavel Reichl

Fix debug messages - trailing '.'

2014-09-29T16:15:01+00:00

Fix debug messages where '\n' was wrongly followed by '.'.

Reviewed-by: Lukáš Slebodník

LDAP: Do not clobber return value when multiple controls are returned

2014-09-16T11:39:22+00:00

We loop over the array of returned controls and set 'ret' based on the
control value. In case multiple controls were returned, the 'ret'
variable might be clobbered with result of a string-to-int conversion.

Reviewed-by: Pavel Reichl

Use the alternative objectclass in group maps.

2014-09-15T08:13:00+00:00

Use the alternative group objectclass in queries.

Fixes:
https://fedorahosted.org/sssd/ticket/2436

Reviewed-by: Jakub Hrozek

Add alternative objectClass to group attribute maps

2014-09-15T08:12:57+00:00

In IPA we sometimes need to use posixGroup and
sometimes groupOfNames objectclass to query the
groups. This patch adds the possibility to specify
alternative objectclass in group maps. By
default it is only set for IPA.

Fixes:
https://fedorahosted.org/sssd/ticket/2436

Reviewed-by: Jakub Hrozek

LDAP: Always free talloc_req

2014-09-10T16:23:48+00:00

On failure, the subreq wasn't freed, which was not a big deal given the
parent request would free the subreq anyway, but it's better to follow
the usual pattern.

Reviewed-by: Simo Sorce

LDAP: Check return value

2014-09-08T18:49:52+00:00

Reported by Coverity

Reviewed-by: Lukáš Slebodník

LDAP: Skip dereferenced entries that we are not permitted to read

2014-09-08T17:13:26+00:00

https://fedorahosted.org/sssd/ticket/2421

In case we dereference an entry, for which we have /some/ permissions
for reading, but we only request attributes that we can't access, the
dereference control only returns the DN.

This is also the case with the current version of 389DS for cases where
no entries at all are readable. In this case, the server should not return
the DN at all, though. This DS bug was tracked as
https://fedorahosted.org/389/ticket/47885

Reviewed-by: Michal Židek

AD: process non-posix nested groups using tokenGroups

2014-09-08T16:55:26+00:00

When initgr is performed for AD supporting tokenGroups, do not skip
non-posix groups.

Resolves:
https://fedorahosted.org/sssd/ticket/2343

Reviewed-by: Michal Židek

AD: process non-posix nested groups w/o tokenGroups

2014-09-08T16:55:23+00:00

When initgr is performed for AD not supporting tokenGroups, do not
filter out groups without gid attribute or with gid equal to zero.

Resolves:
https://fedorahosted.org/sssd/ticket/2343

Reviewed-by: Michal Židek