sssd.git/src/confdb, branch sssctl

CONFDB: Remove the obsolete option magic_private_groups

2017-10-26T08:10:58+00:00

Since this confdb definition was completely unused across the codebase,
this patch just removes the definition.

Reviewed-by: Pavel Březina 
Reviewed-by: Fabiano Fidêncio

CONFIG: Add a new option auto_private_groups

2017-10-26T08:10:49+00:00

The auto_private_groups option is used to configure the domain->mpg flag
which was already set automatically for subdomains, but for some time was
not settable by the admin via the configuration file.

The new option name, instead of the old magic_private_groups, was chosen
purely because this name would hopefully be better understood by admins.

The option doesn't do anything yet, it is just added to all the places a
new option should be added to.

Related:
    https://pagure.io/SSSD/sssd/issue/1872

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina

Print a warning when enumeration is requested but disabled

2017-09-25T12:33:06+00:00

Add an explanatory message to be logged once, at the start-up,
mentioning that in case enumeration is not enabled, getent passwd won't
return all users by design.
The debug level chosen to show the message is SSS_LOG_NOTICE.

Resolves:
https://pagure.io/SSSD/sssd/issue/2301

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

SECRETS: Add a new option to control per-UID limits

2017-09-01T18:26:45+00:00

Adds a new option max_uid_secrets that allows to set a limit of secrets
for this particular client so that the user cannot starve other users.

Resolves:
https://pagure.io/SSSD/sssd/issue/3363

Reviewed-by: Simo Sorce 
Reviewed-by: Fabiano Fidêncio

CONFDB: Do not crash with an invalid domain_type or case_sensitive value

2017-08-31T10:07:06+00:00

If the domain_type parameter contained an invalid value, the error
branch wouldn't have set the 'ret' parameter to an error condition,
which might crash sssd.

The same problem occured with CONFDB_DOMAIN_CASE_SENSITIVE

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

CONFDB: Set a default value for subdomain_refresh_interval in case an invalid value is set

2017-08-30T19:07:15+00:00

The code as it was seemed wrong as when an invalid value as set we
neither error out nor set a default valid value there.

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

DESKPROFILE: Introduce the new IPA session provider

2017-08-28T18:41:04+00:00

In order to provide FleetCommander[0] integration, a session provider
has been introduced for IPA. The design of this feature and more
technical details can be found at [1] and [2], which are the design
pages of both freeIPA and SSSD parts.

As there's no way to test freeIPA integration with our upstream tests,
no test has been provided yet.

Is also worth to mention that the name "deskprofile" has been chosen
instead of "fleetcmd" in order to match with the freeIPA plugin. It
means that, for consistence, all source files, directories created,
options added, functions prefixes and so on are following the choice
accordingly.

[0]: https://wiki.gnome.org/Projects/FleetCommander
[1]: https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/Feature.mediawiki
[2]: https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.html

Resolves:
https://pagure.io/SSSD/sssd/issue/2995

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek

sudo: add a threshold option to reduce size of rules refresh filter

2017-08-18T06:52:25+00:00

If a large number of rules is expired at one time the ldap filter may
become too large to be processed by server. This commits adds a new
option "sudo_threshold" to sudo responder. If the threshold is
exceeded a full refreshed is done instead of rules refresh.

Resolves:
https://pagure.io/SSSD/sssd/issue/3478

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio

CONFIG: Add session_recording section

2017-07-27T08:32:21+00:00

Add information on "session_recording" config section, having three
options: "scope", "users", and "groups".

The section is intended for disabling session recording ("scope = none",
default), enabling session recording for all users ("scope = all"), and
enabling it for some specific users and/or groups ("scope = some",
"users = ", "groups = ").

Reviewed-by: Pavel Březina

DOMAIN: Add sss_domain_info_{get,set}_output_fqnames()

2017-06-21T09:28:15+00:00

Let's avoid setting a domain's property directly from cr_domain code.

In order to do so, let's introduce a setter, which may help us in the
future whenever we decide to make sss_domain_info an opaque structure.

For completeness, a getter has also been introduced and used in the
usertools code.

Related:
https://pagure.io/SSSD/sssd/issue/3403

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek