Although errno was cleared in function sss_nss_make_request
some sss glic functions set errno with value of output argument errnop.

Reproducer:
* sssd compiled with enabled option sss-default-nss-plugin
* sss is the last value in group (/etc/nsswitch.conf)
* sssd-client is installed but sssd is stopped.

C-program:
  #include <stdio.h>
  #include <stdlib.h>
  #include <errno.h>
  #include <grp.h>

  int main(int argc, char *argv[])
  {
      struct group *p_group;

      setgrent();
      while (1) {
          errno = 0;  /* initialize for  getgrent() */
          p_group = getgrent();
          if (p_group == NULL) {
              if (errno == 0) {
                      break;   /* end of groups */
              } else {
                  perror("getgrent");
                  printf("getgrent error %d \n", errno);
                  endgrent();
                  exit(-2);
              }
          }
          printf("getgrent() OK group(%d) = %s \n",
                 p_group->gr_gid, p_group->gr_name);
      }

      exit(0);
  }

Resolves:
https://fedorahosted.org/sssd/ticket/2619

Reviewed-by: Pavel Reichl <preichl@redhat.com>

src/sss_client/pam_sss.c:1461:73:
    error: cast from 'int **' to 'const void **' must have all
    intermediate pointers const qualified to be safe [-Werror,-Wcast-qual]

    pam_get_data(pamh, "pam_sss:password_expired_flag", (const void **) &exp_data);
                                                                        ^
Reviewed-by: Sumit Bose <sbose@redhat.com>

Reported by clang static analyser.

Reviewed-by: Sumit Bose <sbose@redhat.com>

Reported by: cppcheck

void free_fun(struct info *info)
     free(info->name);
     free(info);
     info = NULL;
     ^^^^^^^^^^^
Assignment to function parameter has no effect outside the function.

Reviewed-by: Pavel Reichl <preichl@redhat.com>

This option sets string to be printed when authenticating using SSH
keys and account is expired.

Resolves:
https://fedorahosted.org/sssd/ticket/2050

Reviewed-by: Sumit Bose <sbose@redhat.com>

If account has expired then pass message.

Resolves:
https://fedorahosted.org/sssd/ticket/2050

Reviewed-by: Sumit Bose <sbose@redhat.com>

Example of warning:
src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23:
  error: equality comparison with extraneous parentheses
  [-Werror,-Wparentheses-equality]
    if (((wbc_status) == WBC_ERR_SUCCESS)) {
         ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~
src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23:
  note: remove extraneous parentheses around the comparison
  to silence this warning
    if (((wbc_status) == WBC_ERR_SUCCESS)) {
        ~             ^                 ~
src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23:
  note: use '=' to turn this equality comparison into an assignment
    if (((wbc_status) == WBC_ERR_SUCCESS)) {
                      ^~
                      =

The reason is definition of some macros which were used in if conditions.

Reviewed-by: Michal Židek <mzidek@redhat.com>

The PAC responder by default allows only connections from the root user.
This patch opens the socket to the PAC responder before the krb5_child
drops privileges so the connection seemingly comes from root.

https://fedorahosted.org/sssd/ticket/2559

Reviewed-by: Sumit Bose <sbose@redhat.com>

Some callers of libwbclient functions expects the return values are
initialized even it the functions returns an error. This patch adds some
initializations to meet this requirement.

Resolves https://fedorahosted.org/sssd/ticket/2537

Reviewed-by: Pavel Reichl <preichl@redhat.com>

When the administrator sets the domains= list, he usually wants to
restrict the set of domains. An empty list is an undefined configuration
and it's safer to fail then.

https://fedorahosted.org/sssd/ticket/2516

Reviewed-by: Pavel Reichl <preichl@redhat.com>