sssd.git/src/confdb, branch sudo1-13

config: Allow timeout for all sevices

2017-05-26T13:01:29+00:00

Allow option "timeout" for all sevices.
Also remove unused macro CONFDB_SERVICE_TIMEOUT.

Resolves:
https://fedorahosted.org/sssd/ticket/3068

Reviewed-by: Lukáš Slebodník 
(cherry picked from commit 1b9b5477027d86a2afb2e72981253d108c5398da)

PAM: add pam_response_filter option

2016-11-02T13:02:18+00:00

Currently the main use-case for this new option is to not set the
KRB5CCNAME environment varible for services like 'sudo-i'.

Resolves https://fedorahosted.org/sssd/ticket/2296

Reviewed-by: Jakub Hrozek

PROXY: Adding proxy_max_children option

2016-09-14T10:41:22+00:00

The new option 'proxy_max_children' is applicable
in domain section. Default value is 10.

Resolves:
https://fedorahosted.org/sssd/ticket/3153

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
(cherry picked from commit aef0171e0bdc9a683958d69c7ee984fb10cd5de7)

REFACTOR: umask(0177) --> umask(SSS_DFL_UMASK)

2016-04-07T12:24:51+00:00

There are many calls of umask function with 0177 argument. This patch
add new constant SSS_DFL_UMASK which stands for 0177. So all occurences
of umask(0177) (except responder code) are replaced by constant
SSS_DFL_UMASK.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek 
(cherry picked from commit c299f997e20011536e365bc18e59e73f68629d2c)

PAM: Pass account lockout status and display message

2016-02-17T14:48:31+00:00

Tested against Windows Server 2012.

Resolves:
https://fedorahosted.org/sssd/ticket/2839

Reviewed-by: Jakub Hrozek 
(cherry picked from commit 4180d485829969d4626cc7d49d2b5f7146512f21)

p11: enable ocsp checks

2015-11-26T15:45:15+00:00

This patch enables the Online Certificate Status Protocol in NSS and
adds an option to disable it if needed. To make further tuning of
certificate verification more easy it is not an option on its own but an
option to the new certificate_verification configuration option.

Resolves https://fedorahosted.org/sssd/ticket/2812

Reviewed-by: Jakub Hrozek 
(cherry picked from commit 544a20de7667f05c1a406c4dea0706b0ab507430)

util: Update get_next_domain's interface

2015-10-30T21:34:41+00:00

Update get next domain to be able to
include disbled domains and change the
interface to accept flags instead of
multiple booleans.

Ticket:
https://fedorahosted.org/sssd/ticket/2673

Reviewed-by: Jakub Hrozek 
(cherry picked from commit 877b92e80bde510d5cd9f03dbf01e2bcf73ab072)

confdb: warn if memcache_timeout > than entry_cache

2015-09-30T14:37:57+00:00

Only group and user records are cached in memory cache so only timeouts
for those are checked.

Resolves:
https://fedorahosted.org/sssd/ticket/2176

Reviewed-by: Pavel Březina

PAM: Make p11_child timeout configurable

2015-09-23T21:08:50+00:00

Ticket:
https://fedorahosted.org/sssd/ticket/2773

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Pavel Reichl

UTIL: Convert domain->disabled into tri-state with domain states

2015-09-21T15:03:01+00:00

Required for:
https://fedorahosted.org/sssd/ticket/2637

This is a first step towards making it possible for domain to be around,
but not contacted by Data Provider.

Also explicitly create domains as active, previously we only relied on
talloc_zero marking dom->disabled as false.

Reviewed-by: Pavel Březina