sssd.git/src/providers, branch token3

AD: Enable TokenGroups initgroups lookup

2013-09-11T16:03:53+00:00

This is first implementation of getting TokenGroups lookup working.

If all of the group SIDs that are fetched via the users TokenGroups
attribute are in sysdb, the membership is processed this way. If any of
the groups is missing in the cache, it falls back to rfc2307bis
initgroups lookup.

Resolves:
https://fedorahosted.org/sssd/ticket/1568

LDAP: Make sdap_add_incomplete_groups public

2013-09-11T16:03:53+00:00

Explanation

Resolves:
https://fedorahosted.org/sssd/ticket/XXXX

LDAP: move sdap_get_initgr_state structure to private header

2013-09-11T16:03:53+00:00

is_dn(): free dn

2013-09-10T15:37:26+00:00

krb5: Fix warning sometimes uninitialized

2013-09-10T15:32:33+00:00

warning: variable 'ret' is used uninitialized whenever
'if' condition is false
    if (kerr) {
        ^~~~

krb5_child: Simplify ccache creation

2013-09-09T19:11:46+00:00

The containing ccache directory is precreated by the parent code,
so there is no special need to do so here for any type.
Also the special handling for the FILE ccache temporary file is not really
useful, because libkrb5 internally unlinks and then recreate the file, so
mkstemp cannot really prevent subtle races, it can only make sure the file is
unique at creation time.

Resolves:
https://fedorahosted.org/sssd/ticket/2061

krb5: Add file/dir path precheck

2013-09-09T19:11:46+00:00

Add a precheck on the actual existence at all of the file/dir ccname
targeted (for FILE/DIR types), and bail early if nothing is available.

While testing I found out that without this check, the krb5_cc_resolve()
function we call as user to check old paths would try to create the
directory if it didn't exist.

With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would
cause two undesirable side effects:

First it would actually create a directory with the old name, when it
should not.

Second, because for some reason the umask is set to 0127 in sssd_be, it
would create the directory with permission 600 (missing the 'x' traverse
bit on the directory. If the new ccache has the same name it would cause
the krb5_child process to fal to store the credential cache in it.

Related:
https://fedorahosted.org/sssd/ticket/2061

krb5: Remove unused ccache backend infrastructure

2013-09-09T19:11:46+00:00

Remove struct sss_krb5_cc_be and the remaining functions that reference
it as they are all unused now.

Resolves:
https://fedorahosted.org/sssd/ticket/2061

krb5: Unify function to create ccache files

2013-09-09T19:11:46+00:00

Only 2 types (FILE and DIR) need to precreate files or directories
on the file system, and the 2 functions were basically identical.

Consolidate all in one common function and use that function directly
where needed instead of using indirection.

Resolves:
https://fedorahosted.org/sssd/ticket/2061

krb5: Use new function to validate ccaches

2013-09-09T19:11:45+00:00

This function replaces and combines check_for_valid_tgt() and type specific
functions that checked for ccache existence by using generic krb5 cache
function and executing them as the target user (implicitly validate the
target use rcan properly access the ccache).

Resolves:
https://fedorahosted.org/sssd/ticket/2061