sssd.git/src, branch review-negcache

nss: use negative cache for sid-by-id requests

2015-07-27T17:01:26+00:00

Since requests by ID are not assized to a specific domain SSSD might
check the ID in domains where the ID does not exists even if the ID is
already in the sysdb cache of the right domain. For requests where
already a memory cache is available like e.g. getpwuid() and getgrgid()
this has no negative impact because the requests are answered directly
from the cache most of the time without hitting SSSD. As long as there
is no use-case which does not use the memory cache those requests do not
need an update.

But for request like sid-by-id where currently no memory cache is
available there are quite some additional costs especially for trusted
domains.

Resolves https://fedorahosted.org/sssd/ticket/2731

negcache: allow domain name for UID and GID

2015-07-27T17:01:26+00:00

Related to https://fedorahosted.org/sssd/ticket/2731

AD: Handle cases where no GPOs apply

2015-07-26T18:33:07+00:00

It is possible to have a machine where none of the GPOs associated with
it include access-control rules. Currently, this results in a
denial-by-system-error.

We need to treat this case as allowing the user (see the test cases in
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration

We also need to delete the result object from the cache to ensure that
offline operation will also grant access.

Resolves:
https://fedorahosted.org/sssd/ticket/2713

Reviewed-by: Lukáš Slebodník

intg: Invalidate memory cache before removing files

2015-07-24T14:54:02+00:00

Workaround for:
https://fedorahosted.org/sssd/ticket/2726

Reviewed-by: Michal Židek

DYNDNS: support for dualstack

2015-07-24T07:30:41+00:00

When dyndns_iface option was not used, address of connection to LDAP
was used. This patch proposes following change:
  * Interface containing address of connection is found.
  * All A and AAAA addresses of this interface are collected.
  * Collected addresses are sent during DDNS update.
  * Function sss_iface_addr_add() is removed.

Resolves:
https://fedorahosted.org/sssd/ticket/2558

TESTS: dyndns tests support AAAA addresses

2015-07-24T07:30:41+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2558

DYNDNS: special value '*' for dyndns_iface option

2015-07-24T07:30:41+00:00

Option dyndns_iface has now special value '*' which implies that IPs
from add interfaces should be sent during DDNS update.

DYNDNS: support mult. interfaces for dyndns_iface opt

2015-07-24T07:30:41+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2549

DYNDNS: sss_iface_addr_list_get return ENOENT

2015-07-24T07:30:41+00:00

If none of eligible interfaces matches ifname then ENOENT is returned.

Resolves:
https://fedorahosted.org/sssd/ticket/2549

Fix minor typos

2015-07-23T09:10:16+00:00

Reviewed-by: Lukáš Slebodník