sssd.git/src/providers/ad, branch openssl

Remove double semicolon at the end of line

2016-09-21T13:10:11+00:00

Reviewed-by: Pavel Březina

dyndns: fix typo and unify ipa with ad debug message when off

2016-08-30T12:30:53+00:00

Reviewed-by: Petr Čech 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: ad_enabled_domains - other then master

2016-08-17T14:08:58+00:00

We can skip looking up other domains if
option ad_enabled_domains doesn't contain them.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: ad_enabled_domains - only master

2016-08-17T14:08:43+00:00

We can skip looking up other domains if option ad_enabled_domains
contains only master domain.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: Initializing of ad_enabled_domains

2016-08-17T14:08:36+00:00

We add ad_enabled_domains into ad_subdomains_ctx.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: Add ad_enabled_domains option

2016-08-17T14:08:19+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

Warn if IP address is used as option for ipa_server/ad_server

2016-08-16T18:21:29+00:00

GSSAPI is dependent on DNS with hostnames and we should warn about this.

Resolves:
https://fedorahosted.org/sssd/ticket/2789

Reviewed-by: Jakub Hrozek

failover: mark subdomain service with sd_ prefix

2016-08-16T12:39:15+00:00

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek

gpo: gPCMachineExtensionNames with just whitespaces

2016-08-11T08:30:45+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3114

We failed GPO procesing if the gPCMachineExtensionNames
attribute contained just whitespaces. This coused
failures in some server settings.

Comment from Alexander Bokovoy quoting:

You should use MS-GPOL spec. 2.2.4 'GPO Search' section says that when
processing gPCMachineExtensionNames, "Group Policy processing terminates
at the first  out of sequence."
Since ' ' (space only) does not fall into defined syntax for
gPCMachineExtensionNames, this Group Policy processing is stopped and
its CSE GUIDs are set to 'empty list'.

Because of the 3.2.5.1.10 'Extension Protocol Sequences' language
------------------------------------------------------------------------
The Group Policy client MUST evaluate the subset of the abstract element
Filtered GPO list separately for each Group Policy extension by
including in the subset only those GPOs whose gPCUserExtensionNames (for
user policy mode) or gPCMachineExtensionNames (for computer policy mode)
attributes contain CSE GUID that correspond to the Group Policy
extension. If the CSE GUID corresponding to the Group Policy extension
is present in Extension List, it is invoked using the
Implementation Identifier field. Applicability is determined as
specified in section 3.2.1.5. The Group Policy Registry Extension MUST
always execute first. All other applicable Group Policy extensions in
the Extension List MUST be loaded and executed in Extension List order.
A failure in any Group Policy extension sequence MUST NOT affect the
execution of other Group Policy extensions.
-------------------------------------------------------------------------

I think we can practically treat wrong content of
gPCMachineExtensionNames (and gPCUserExtensionNames) as inability of the
GPO to pass through the Filtered GPO list. Thus, the GPO would be
ignored.

Reviewed-by: Alexander Bokovoy 
Reviewed-by: Jakub Hrozek

LDAP: new attribute option ldap_user_email

2016-07-29T12:44:44+00:00

Reviewed-by: Jakub Hrozek