Rewrite HBAC rule evaluator

Add helper function msgs2attrs_array

This function converts a list of ldb_messages into a list of
sysdb_attrs.

Conflicts:

	src/providers/ldap/ldap_common.c
	src/providers/ldap/ldap_common.h

Add HBAC evaluator and tests

Add helper functions for looking up HBAC rule components

Remove old HBAC implementation

Add new HBAC lookup and evaluation routines

Conflicts:

	Makefile.am

Add ipa_hbac_refresh option

This option describes the time between refreshes of the HBAC rules
on the IPA server.

Add ipa_hbac_treat_deny_as option

By default, we will treat the presence of any DENY rule as denying
all users. This option will allow the admin to explicitly ignore
DENY rules during a transitional period.

Treat NULL or empty rhost as unknown

Previously, we were assuming this meant it was coming from the
localhost, but this is not a safe assumption. We will now treat it
as unknown and it will fail to match any rule that requires a
specified srchost or group of srchosts.

libipa_hbac: Support case-insensitive comparisons with UTF8

UTF8 HBAC test

Fix memory leak in ipa_hbac_evaluate_rules

https://fedorahosted.org/sssd/ticket/933

Fix incorrect NULL check in ipa_hbac_common.c

https://fedorahosted.org/sssd/ticket/936

Require matched version and release for libipa_hbac

Add rule validator to libipa_hbac

https://fedorahosted.org/sssd/ticket/943

2 files changed, 4 insertions, 0 deletions

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index fed19f079..920a8a056 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -97,6 +97,8 @@ option_strings = {
     'ipa_dyndns_update' : _("Whether to automatically update the client's DNS entry in FreeIPA"),
     'ipa_dyndns_iface' : _("The interface whose IP should be used for dynamic DNS updates"),
     'ipa_hbac_search_base' : _("Search base for HBAC related objects"),
+    'ipa_hbac_refresh' : _("The amount of time between lookups of the HBAC rules against the IPA server"),
+    'ipa_hbac_treat_deny_as' : _("If DENY rules are present, either DENY_ALL or IGNORE"),
 
     # [provider/krb5]
     'krb5_kdcip' : _('Kerberos server address'),
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 31b7dc9be..d7992b608 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -100,6 +100,8 @@ krb5_renew_interval = int, None, false
 krb5_use_fast = str, None, false
 
 [provider/ipa/access]
+ipa_hbac_refresh = int, None, false
+ipa_hbac_treat_deny_as = str, None, false
 
 [provider/ipa/chpass]