sssd.git/src/responder/nss, branch openssl

cache_req: switch to new code

2016-10-20T07:56:38+00:00

This patch switch the old switch-based cache req code to
the new plugin-based.

Reviewed-by: Jakub Hrozek

nss: allow UPNs in SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME

2016-10-10T10:31:33+00:00

When adding support for UPNs, email addresses and aliases the
SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME request were forgotten.
This patch adds the missing support because it might be irritating if
getpwnam() can resolve the name but the other requests fail. The same
logic as for the plain user lookup is used, this add some code
duplication which is expected to be removed when the nss responder will
be switched to use the new cache_req code.

Resolves https://fedorahosted.org/sssd/ticket/3194

Reviewed-by: Jakub Hrozek

NSS: Fix offline resolution of netgroups

2016-09-21T08:13:18+00:00

If talking to the Data Provider failed, we never re-tried looking into
the cache. We should consult the cache on DP failures and return cached
results, if possible.

Resolves:
https://fedorahosted.org/sssd/ticket/3123

Reviewed-by: Pavel Březina

NSS: Remove unused functions

2016-08-16T12:54:54+00:00

When removing the old data provider I noticed that those functions
are not used at all.

Reviewed-by: Lukáš Slebodník

DP: Remove old data provider interface

2016-08-16T12:54:50+00:00

Reverse data provider interface is moved to a better location in
NSS responder. All responders now can have an sbus interface
defined per data provider connection. The unused old data provider
interface is removed.

Reviewed-by: Lukáš Slebodník

NSS: Use correct name for invalidating memory cache

2016-08-10T09:39:46+00:00

After refactoring of sysdb, we get and internal fully qualified
name from backend in org.freedesktop.sssd.dataprovider_rev.initgrCheck
Previously we got short name and we created fq name in
nss_update_initgr_memcache. Memory cache still need to use short names
if it was specified.

This patch uses right name in different places.

Reviewed-by: Petr Cech 
Reviewed-by: Jakub Hrozek

NSS: use different neg cache name for UPN searches

2016-07-29T12:45:11+00:00

If Kerberos principals or email address have the same domain suffix as
the domain itself the first user lookup by name might have already added
the name to the negative cache and the second lookup by UPN/email will
skip the domain because of the neg cache entry. To avoid this a special
name with a '@' prefix is used here.

Reviewed-by: Jakub Hrozek

NSS: continue with UPN/email search if name was not found

2016-07-29T12:45:04+00:00

Currently we only search for UPNs if the domain part of the name was not
know, with Kerberos aliases and email addresses we have to do this even
if the domain name is a know domain.

Reviewed-by: Jakub Hrozek

NSS: add user email to fill_orig()

2016-07-29T12:44:54+00:00

The IPA server must send the email address of a user to the clients to
allow login by email.

Reviewed-by: Jakub Hrozek

views: properly override group member names

2016-07-29T12:44:28+00:00

Resolves https://fedorahosted.org/sssd/ticket/2948

Reviewed-by: Jakub Hrozek