Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
(cherry picked from commit 1270ffe9f3809f2fd488ef4a320d344ae107ab87)

Although errno was cleared in function sss_nss_make_request
some sss glic functions set errno with value of output argument errnop.

Reproducer:
* sssd compiled with enabled option sss-default-nss-plugin
* sss is the last value in group (/etc/nsswitch.conf)
* sssd-client is installed but sssd is stopped.

C-program:
  #include <stdio.h>
  #include <stdlib.h>
  #include <errno.h>
  #include <grp.h>

  int main(int argc, char *argv[])
  {
      struct group *p_group;

      setgrent();
      while (1) {
          errno = 0;  /* initialize for  getgrent() */
          p_group = getgrent();
          if (p_group == NULL) {
              if (errno == 0) {
                      break;   /* end of groups */
              } else {
                  perror("getgrent");
                  printf("getgrent error %d \n", errno);
                  endgrent();
                  exit(-2);
              }
          }
          printf("getgrent() OK group(%d) = %s \n",
                 p_group->gr_gid, p_group->gr_name);
      }

      exit(0);
  }

Resolves:
https://fedorahosted.org/sssd/ticket/2619

Reviewed-by: Pavel Reichl <preichl@redhat.com>
(cherry picked from commit d51bc5f43fffa516446ef62c2b860be9fa939c9d)

This option sets string to be printed when authenticating using SSH
keys and account is expired.

Resolves:
https://fedorahosted.org/sssd/ticket/2050

Reviewed-by: Sumit Bose <sbose@redhat.com>
(cherry picked from commit e039f1aefecc65a7b3c2d4a13a612bff1dd367c8)

If account has expired then pass message.

Resolves:
https://fedorahosted.org/sssd/ticket/2050

Reviewed-by: Sumit Bose <sbose@redhat.com>
(cherry picked from commit a61d6d01a4e89ec14175af135e84f1cac55af748)

The PAC responder by default allows only connections from the root user.
This patch opens the socket to the PAC responder before the krb5_child
drops privileges so the connection seemingly comes from root.

https://fedorahosted.org/sssd/ticket/2559

Reviewed-by: Sumit Bose <sbose@redhat.com>
(cherry picked from commit 858e750c3d4fe54e50616a1ed1e101469503c070)

Some callers of libwbclient functions expects the return values are
initialized even it the functions returns an error. This patch adds some
initializations to meet this requirement.

Resolves https://fedorahosted.org/sssd/ticket/2537

Reviewed-by: Pavel Reichl <preichl@redhat.com>

When the administrator sets the domains= list, he usually wants to
restrict the set of domains. An empty list is an undefined configuration
and it's safer to fail then.

https://fedorahosted.org/sssd/ticket/2516

Reviewed-by: Pavel Reichl <preichl@redhat.com>

glibc is inconsistent with how it treats and returns NSS_STATUS_UNAVAIL.

The sss nss plugin is present in nsswitch by default on some platforms
due to glibc caching and problem with long living applications (e.g. GNOME).
But sssd needn't be configuread and it cause problems in some programs.
In this situation, the SSSD nss plugin should behave as if it was functioning
but had no data even thought sssd is not running. The errors have to be passed
from nss plugin up to the user with minimal moidiffication.

Thanks to Stephen Gallagher for initial patch.

Resolves:
https://fedorahosted.org/sssd/ticket/2439

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Thread safe initialisation was fixed in ticket #2380, but there is
still race condition in reinitialisation.

If caches is invalidated with command sss_cache -U (-G or -E) then
client code will need to reinitialize fast memory cache.
Let say we have two threads. The 1st thread find out that memory cache
should be reinitialized; therefore the fast memory cached is unmapped
and context destroyed. In the same time, 2nd thread tried to check
header of memory cache whether it is initialized and valid. As a result
of previously unmapped memory the 2nd thread access
out of bound memory (SEGFAULT).

The destroying of fast memory cache cannot be done any time. We need
to be sure that there isn't any other thread which uses mmaped memory.
The new counter of active threads was added for this purpose. The state
of fast memory cache was converted from boolean to three value state
(UNINITIALIZED, INITIALIZED, RECYCLED)
UNINITIALIZED
    - the fast memory cache need to be initialized.
    - if there is a problem with initialisation the state will not change
    - after successful initialisation, the state will change to INITIALIZED
INITIALIZED
    - if the cahe was invalidated or there is any other problem was
      detected in memory cache header the state will change to RECYCLED
      and memory cache IS NOT destroyed.
RECYCLED
    - nothing will be done is there are any active threads which may use
      the data from mmaped memory
    - if there aren't active threads the fast memory cahe is destroyed and
      state is changed to UNINITIALIZED.

https://fedorahosted.org/sssd/ticket/2445

Reviewed-by: Michal Židek <mzidek@redhat.com>

Reviewed-by: Michal Židek <mzidek@redhat.com>