sssd.git/src/providers, branch f23

IPA: Always re-fetch the keytab from the IPA server

2015-09-07T16:22:05+00:00

Even if a keytab for one-way trust exists, re-fetch the keytab again and
try to use it. Fall back to the previous one if it exists.

This is in order to allow the admin to re-establish the trust keytabs
with a simple sssd restart.

Reviewed-by: Pavel Březina

IPA: Change the default of ldap_user_certificate to userCertificate;binary

2015-09-07T16:21:48+00:00

This is safe from ldb point of view, because ldb gurantees the data is
NULL-terminated. We must be careful before we save the data, though.

Resolves:
https://fedorahosted.org/sssd/ticket/2742

Reviewed-by: Pavel Březina

LDAP: use ldb_binary_encode when printing attribute values

2015-09-07T16:21:42+00:00

Reviewed-by: Pavel Březina

IPA: Handle sssd-owned keytabs when running as root

2015-09-07T16:20:27+00:00

https://fedorahosted.org/sssd/ticket/2718

This patch handles the case where the keytab is created with sssd:sssd
ownership (perhaps by the IPA oddjob script) but SSSD runs as root,
which is the default in many distributions.

Reviewed-by: Alexander Bokovoy

IPA: Better debugging

2015-09-07T16:20:14+00:00

Reviewed-by: Alexander Bokovoy

IPA: Remove MPG groups if getgrgid was called before getpw()

2015-09-07T16:12:16+00:00

https://fedorahosted.org/sssd/ticket/2724

This bug only affects IPA clients that are connected to IPA servers with
AD trust and ID mapping in effect.

If an IPA client calls getgrgid() for an ID that matches a user, the
user's private group would be returned and stored as a group entry.

Subsequent queries for that user would fail, because MPG domains impose
uniqueness restriction for both the ID and name space across groups and
users.

To work around that, we remove the UPG groups in MPG domains during a
group lookup.

Reviewed-by: Sumit Bose

DYNDNS: special value '*' for dyndns_iface option

2015-09-07T16:08:17+00:00

Option dyndns_iface has now special value '*' which implies that IPs
from add interfaces should be sent during DDNS update.

DYNDNS: support mult. interfaces for dyndns_iface opt

2015-09-07T16:08:10+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2549

DYNDNS: sss_iface_addr_list_get return ENOENT

2015-09-07T16:08:02+00:00

If none of eligible interfaces matches ifname then ENOENT is returned.

Resolves:
https://fedorahosted.org/sssd/ticket/2549

KRB5: Return right data provider error code

2015-09-07T16:07:06+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2719

Reviewed-by: Michal Židek