sssd.git/src/responder, branch nonroot

Fix: always check return value of unlink()

2014-11-28T15:16:37+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2506

Reviewed-by: Lukáš Slebodník

PAM: Move is_uid_trusted from pam_ctx to preq

2014-11-25T17:48:34+00:00

Keeping a per-request flag in a global structure is really dangerous.

Reviewed-by: Sumit Bose

PAM: Check for trusted domain before sending the request to BE

2014-11-25T17:48:11+00:00

https://fedorahosted.org/sssd/ticket/2501

Moving the checks to one place has the advantage of not duplicating
security decisions. Previously, the checks were scattered all over the
responder code, making testing hard.

The disadvantage is that we actually check for the presence of the user,
which might trigger some back end lookups. But I think the benefits
overweight the disadvantage.

Also only check the requested domains from a trusted client. An untrusted
client should simply have no say in what domains he wants to talk to, it
should ignore the 'domains' option.

Reviewed-by: Sumit Bose

PAM: Make pam_forwarder_parse_data static

2014-11-24T20:22:48+00:00

Reviewed-by: Pavel Reichl

NSS: Fix warning enumerated type mixed with another type

2014-11-10T09:31:23+00:00

src/responder/nss/nsssrv_cmd.c:688: mixed_enum_type: enumerated type mixed with
another type

"enum sss_dp_acct_type" was mixed with type "int". ANSI C is not very
strict in this.

Reviewed-by: Michal Židek

Add ssh pubkey to origbyname request

2014-11-05T14:26:47+00:00

Since the IPA clients expects that the extdom plugin delivers the
default view data for a given user this patch adds the public SSH key to
the list of returned attributes of the getorigbyname request so that it
can be send back to the clients.

Reviewed-by: Jakub Hrozek

Views: apply user SSH public key override

2014-11-05T14:26:36+00:00

With this patch the SSH public key override attribute is read from the
FreeIPA server and saved in the cache with the other override data.

Since it is possible to have multiple public SSH keys this override
value does not replace any other data but will be added to existing
values.

Fixes https://fedorahosted.org/sssd/ticket/2454

Reviewed-by: Jakub Hrozek

sysdb_add_overrides_to_object: add new parameter and multi-value support

2014-11-05T14:26:32+00:00

With the new parameter an attribute list other than the default one can
be used.

Override attributes with multiple values (e.g. SSH public keys) are now
supported as well.

Reviewed-by: Jakub Hrozek

nss: return user_attributes in origbyname request

2014-11-05T14:21:01+00:00

To allow IPA clients to offer special attributes of AD users form
trusted domain the extdom plugin on the IPA server must send them to the
clients. The extdom plugin already uses sss_nss_getorigbyname() to get
attributes like the SID and the user principal name. This patch adds the
attributes given by the NSS/IFP user_attributes option to the list of
attributes returned by sss_nss_getorigbyname().

Fixes https://fedorahosted.org/sssd/ticket/2464

Reviewed-by: Jakub Hrozek

nss: parse user_attributes option

2014-11-05T14:20:51+00:00

Reviewed-by: Jakub Hrozek