sssd.git/src/providers/ldap, branch master

DYNDNS: use realm and server commands only as fallback

2015-10-05T18:59:44+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2495

Reviewed-by: Jakub Hrozek

SDAP: fix minor memory leak

2015-10-02T10:50:37+00:00

Reviewed-by: Pavel Březina

SDAP: Relax POSIX check

2015-10-02T10:38:18+00:00

Relax the check on UID or GID just to check if at least one of them is
present but do not require them to be positive numbers.

Add requirement on objectclass attributes to be user or group to make
check more reliable.

Resolves:
https://fedorahosted.org/sssd/ticket/2800

DDNS: execute nsupdate for single update of PTR rec

2015-09-22T12:51:22+00:00

nsupdate fails definitely if any of update request fails when GSSAPI is used.

As tmp solution nsupdate is executed for each update.

Resolves:
https://fedorahosted.org/sssd/ticket/2783

Reviewed-by: Jakub Hrozek

LDAP: Filter out multiple entries when searching overlapping domains

2015-09-22T11:46:02+00:00

In case domain overlap, we might download multiple objects. To avoid
saving them all, we attempt to filter out the objects from foreign
domains.

We can only do this optimization for non-wildcard lookups.

Reviewed-by: Lukáš Slebodník

LDAP: Move sdap_create_search_base from ldap to sdap code

2015-09-22T11:46:00+00:00

The function shouldn't be placed in the LDAP tree, but in the SDAP tree
to make it usable from tests without linking to libraries that are
normally linked from LDAP provider (such as confdb)

Reviewed-by: Lukáš Slebodník

LDAP: imposing sizelimit=1 for single-entry searches breaks overlapping domains

2015-09-22T11:45:50+00:00

https://fedorahosted.org/sssd/ticket/2723

In case there are overlapping sdap domains, a search for a single user
might match and return multiple entries. For instance, with AD domains
represented by search bases:
    DC=win,DC=trust,DC=test
    DC=child,DC=win,DC=trust,DC=test

A search for user from win.trust.test would be based at:
    DC=win,DC=trust,DC=test
but would match both search bases and return both users.

Instead of performing complex filtering, just save both users. The
responder would select the entry that matches the user's search.

Reviewed-by: Lukáš Slebodník

SDAP: Do not set is_offline if ignore_mark_offline is set

2015-09-21T15:04:02+00:00

Required for:
https://fedorahosted.org/sssd/ticket/2637

The caller of the sdap_id_op requests can set the ignore_mark_offline
flag to avoid the sdap_id_op from marking the whole back end as offline.

However, there was a small bug - the is_offline internal sdap_id_op flag
was still being set. As a consequence, the error code from the
connection was ignored and EAGAIN was always returned.

Reviewed-by: Pavel Březina

LDAP: Sanitize group dn before using in filter

2015-09-18T15:20:42+00:00

Each string should be sanitized(rfc4515) before using ldbsearch.
A group dn was not sanitized in the function cleanup_groups.

Resolves:
https://fedorahosted.org/sssd/ticket/2744

Reviewed-by: Pavel Březina

Partially revert "LDAP: sanitize group name when used in filter"

2015-09-18T15:20:40+00:00

This reverts commit e2e334b2f51118cb14c7391c4e4e44ff247ef638.
+ temporary disable unit test

Reviewed-by: Pavel Březina