There was an issue in a production deployment where the admin selected a
GID outside the IDM range for a group that contained a user from the
trusted domain. This resulted in not adding a SID for the IPA group,
which in turn meant the group couldn't be resolved on the client.

This patch just improves the DEBUG message so that it's clearer for the
admins where the issue is.

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Resolves:
    https://pagure.io/SSSD/sssd/issue/3268

Uses the common function sized_domain_name() to format a group the user
is a member of to the appropriate format.

To see the code is working correctly, run:
        dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe
                  /org/freedesktop/sssd/infopipe
                  org.freedesktop.sssd.infopipe.GetUserGroups
                  string:trusted_user

Where trusted_user is a user from a trusted domain that is a member of groups
from the joined domain and a trusted domain as well. The groups from the
joined domain should not be qualified, the groups from the trusted
domain should be qualified.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

These functions are used to format a name into a format that the user
configured for output, including case sensitiveness, replacing
whitespace and qualified format. They were used only in the NSS
responder, which typically returns strings to the NSS client library and
then the user.

But it makes sense to just reuse the same code in the IFP responder as
well, since it does essentially the same job.

The patch also renames sized_member_name to sized_domain_name.
Previously, the function was only used to format a group member, the IFP
responder would use the same function to format a group the user is a
member of.

Related to:
    https://pagure.io/SSSD/sssd/issue/3268

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Old links are redirected to information about Fedorahosted-retirement

e.g.
  https://fedorahosted.org/mailman/listinfo/sssd-devel
  -> https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

It was mainly aimed for time when stable CentOS and
rhel nightly had different versions of krb5.

Anyway, rhel7.0 and rhel <= 6.6 are already out of support

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

Merges: https://pagure.io/SSSD/sssd/pull-request/3374

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>

We do not want to use host principal with AD
"host/name.domain.tld@DOMAIN.TLD" because it does not work.
We need to use correct user principal for AD hosts. And we cannot
rely all fallback "*$" because of other principals in keytab.

The NetBIOS naming convention allows for 16 characters in a NetBIOS
name. Microsoft, however, limits NetBIOS names to 15 characters and
uses the 16th character as a NetBIOS suffix.
https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name

Resolves:
https://pagure.io/SSSD/sssd/issue/3329

Reviewed-by: Michal Židek <mzidek@redhat.com>

There seem to be code paths where the data is a added to the hash before
the connection is properly initialized, to avoid core dump during shut
down we only call dbus_conection_unregister_object_path() if there is a
connection.

Resolves:
https://pagure.io/SSSD/sssd/issue/3367

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

If the new environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any
value SSSD's krb5 locator plugin is disabled. The variable is needed
because there is currently no other way than removing the plugin
completely to disable it. For a use-case see e.g.
https://bugzilla.redhat.com/show_bug.cgi?id=1072939.

Resolves:
https://pagure.io/SSSD/sssd/issue/3359

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>