sssd.git/src/responder/common, branch subdomfo

UTIL: Convert domain->disabled into tri-state with domain states

2015-09-01T12:06:29+00:00

This is a first step towards making it possible for domain to be around,
but not contacted by Data Provider.

Also explicitly create domains as enabled, previously we only relied on
talloc_zero marking dom->disabled as false.

negcache: allow domain name for UID and GID

2015-07-27T20:03:42+00:00

Related to https://fedorahosted.org/sssd/ticket/2731

Reviewed-by: Jakub Hrozek

cache_req: Extend cache_req with wildcard lookups

2015-07-15T15:32:23+00:00

Related:
    https://fedorahosted.org/sssd/ticket/2553

Adds two new functions to the cache_req API:
    - cache_req_user_by_filter_send
    - cache_req_group_by_filter_send

These functions can be used to retrieve users or groups that match a
specified filter.

Also renames a variable to avoid constant confusion -- the variable is
only used for debug output.

Reviewed-by: Pavel Březina

DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUP

2015-07-15T15:32:20+00:00

Related:
    https://fedorahosted.org/sssd/ticket/2553

Extends the Data Provider interface and the responder<->Data provider
interface with wildcard lookups.

The patch uses a new "wildcard" prefix rather than reusing the existing
user/group prefixes.

Reviewed-by: Pavel Březina

IFP: add FindByCertificate method for User objects

2015-06-19T16:48:13+00:00

Related to https://fedorahosted.org/sssd/ticket/2596

Reviewed-by: Pavel Březina

ncache: add calls for certificate based searches

2015-06-19T16:48:13+00:00

Related to https://fedorahosted.org/sssd/ticket/2596

Reviewed-by: Pavel Březina

negcache: Soften condition for expired entries

2015-05-22T10:26:59+00:00

Type of timestamp for entries in negative cache is time_t
which is number of *seconds* that have elapsed since 1 January 1970.

The condition for ttl was to strict so entry could be valid
 from  "ttl-1" to  ttl e.g.
 * ttl is 1 second
 * entry was stored to negative cache at 1432120871.999639
   stored_timestamp = 1432120871
 * entry was tested few miliseconds later 1432120872.001293
   current_time = 1432120872

Entry was marked as expired becuase result of condition was false
  stored_timestamp + ttl < current_time
          1432120871 + 1 < 1432120872

This is a reason why ./test-negcache sometime fails.
It's quite easily reproducible on slow machine or when valgrind was used.

sh$ while libtool --mode=execute valgrind ./test-negcache ; do echo OK: done

Reviewed-by: Pavel Reichl

responders: reset ncache after domains are discovered during startup

2015-04-09T06:35:23+00:00

After responders start, they add a lookup operation that discovers the
subdomains so that qualifying users works. After this operation is
finishes, we need to reset negcache to allow users to be added into the
newly discovered domains.

Reviewed-by: Lukáš Slebodník

ncache: Add sss_ncache_reset_repopulate_permanent

2015-04-09T06:35:20+00:00

This new function resets the negative cache and then re-adds the
permanent entries.

Reviewed-by: Lukáš Slebodník

ncache: Silence critical error from filter_users when default_domain_suffix is set

2015-04-09T06:35:16+00:00

When default_domain_suffix is used and filter_users is set (at least
root is always, by default), SSSD tried to add the negcache entry to the
default domain. But since the default domain is not known after start
up, adding the entries fail with a verbose error message.

This patch handles EAGAIN returned from the parsing function while
setting negcache entries gracefully and also makes the debug message in
parsing function more precise.

Reviewed-by: Lukáš Slebodník