sssd.git/src/providers/ad, branch subdommem

KRB5: Do not send PAC in server mode

2013-07-23T12:18:03+00:00

The krb5 child contacts the PAC responder for any user except for the
IPA native users if the PAC is configured. This works fine for the
general case but the ipa_server_mode is a special one. The PAC responder
is there, but since in the server mode we should be operating as AD
provider default, the PAC shouldn't be analyzed either in this case.

AD: Set the bool value same as default value in opts

2013-07-19T11:51:17+00:00

https://fedorahosted.org/sssd/ticket/2023

When the option values are copied using dp_opt_copy_map, the .val member
is used if it's not NULL. At the same time, the bool options are never
NULL, unlike integers or strings that can have special NULL-like values
such as NULL_STRING. This effectively means that when copying a bool
option, the .val member is always used.

But in the AD maps, some .val fields were set differently from the
.def_val fields. The effect was that when the AD subdomain provider was
initialized from IPA subdomain provider using only the defaults, some
options (notably referral chasing) were set to a value that didn't make
sense for the AD provider.

This patch makes sure that for all boolean option, the .val is always
the same as .def_val.

IPA: Look up AD users directly if IPA server mode is on

2013-06-28T20:22:20+00:00

https://fedorahosted.org/sssd/ticket/1962

If the ipa_server_mode is selected IPA subdomain user and group lookups
are not done with the help of the extdom plugin but directly against AD
using the AD ID code.

AD: Move storing sdap_domain for subdomain to generic LDAP code

2013-06-28T20:22:20+00:00

Makes creating the sdap_domain structure for a subdomain reusable
outside AD subdomain code where it was created initially.

Subtask of:
    https://fedorahosted.org/sssd/ticket/1962

AD: initialize failover with custom realm, domain and failover service

2013-06-28T20:22:20+00:00

This is needed so we can initialize failover using IPA realm and
on-the-fly discovered DNS domain. The subdomains discovered on-thefly
will use the subdomain name for realm, domain and failover service to
avoid conflicts.

Subtaks of:
https://fedorahosted.org/sssd/ticket/1962

AD: decouple ad_id_ctx initialization

2013-06-28T20:22:20+00:00

The IPA subdomain code will perform lookups on its own in the server
mode. For this, the AD provider must offer a way to initialize the
ad_id_ctx for external consumers.

Subtask of:
https://fedorahosted.org/sssd/ticket/1962

Save mpg state for subdomains

2013-06-28T18:20:59+00:00

The information of a subdomain will use magic private groups (mpg) or
not will be stored together with other information about the domain in
the cache.

Replace new_subdomain() with find_subdomain_by_name()

2013-06-28T18:20:59+00:00

new_subdomain() will create a new domain object and should not be used
anymore in the priovder code directly. Instead a reference to the domain
from the common domain object should be used.

Add now options ldap_min_id and ldap_max_id

2013-06-28T18:20:59+00:00

Currently the range for Posix IDs stored in an LDAP server is unbound.
This might lead to conflicts in a setup with AD and trusts when the
configured domain uses IDs from LDAP. With the two noe options this
conflict can be avoided.

AD: Write out domain-realm mappings

2013-06-27T16:43:57+00:00

This patch reuses the code from IPA provider to make sure that
domain-realm mappings are written even for AD sub domains.