sssd.git/src/providers/ad, branch sudo

GPO: Don't use freed LDAPURLDesc if domain for AD DC cannot be found

2017-10-05T18:01:43+00:00

If a referral returned during AD GPO processing cannot be assigned to a
known domain, at the moment SSSD accesses memory that was freed
previously with ldap_free_urldesc().

This patch moves the ldap_free_urldesc() call to both the error handler
and the success branch after we are done working with the LDAPURLDesc
instance.

Reviewed-by: Fabiano Fidêncio

UTIL: Set udp_preference_limit=0 in krb5 snippet

2017-08-14T13:26:29+00:00

We add udp_preference_limit = 0 to krb5 snippet if ad provider is
used. This option enable TCP connection before UDP, when sending
a message to the KDC.

Resolves:
https://pagure.io/SSSD/sssd/issue/3254

Signed-off-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Robbie Harwood

Fix minor typos

2017-07-26T15:46:11+00:00

Merges: https://pagure.io/SSSD/sssd/pull-request/3456

Reviewed-by: Michal Židek

ad_account_can_shortcut: shortcut if ID is unknown

2017-07-25T08:48:55+00:00

If sss_idmap_unix_to_sid() returns an error we can assume that the given
POSIX ID is not from the current domain and can be skipped. This is e.g.
the case in the IPA provider if a POSIX ID used in the IPA domain is
checked in a trusted id-mapped AD domain before the IPA domain is
checked.

Resolves https://pagure.io/SSSD/sssd/issue/3452

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek

SDAP: Add sdap_domain_copy_search_bases

2017-07-11T10:09:48+00:00

Add function to copy search bases from one sdap_domain to
another.

Resolves:
https://pagure.io/SSSD/sssd/issue/3435

Reviewed-by: Fabiano Fidêncio

SDAP: Update parent sdap_list

2017-06-21T09:36:51+00:00

Update parent sdap_list with newly created subdomain sdap domain.

Preiously, we inherited the parent sdap_list and used it also in the
subdomain's context (this was introduced recently with commit
c4ddb9ccab670f9c0d0377680237b62f9f91c496), but it caused problems
that were difficult to debug (we somewhere rewrite part of the list
incorrectly).

This patch reverses to the previous bahavior, where every subdomain
has it's own sdap_list, however this time the parrent domain's
sdap_list is updated so that it has correct information about
search bases of the child domains.

We should ideally have just one sdap_list to avoid the updating
completely, but this would require more refactoring in the sdap
code.

Resolves:
https://pagure.io/SSSD/sssd/issue/3421

Reviewed-by: Jakub Hrozek

GPO: Fix typo in DEBUG message

2017-06-21T09:35:59+00:00

Reviewed-by: Jakub Hrozek

AD SUBDOMAINS: Fix search bases for child domains

2017-05-19T14:43:46+00:00

When using direct AD integration, child domains did not respect
the sssd.conf configuration of search bases.

There were few issues all of which are fixed in this small
patch.

First problem was that the sdap domain list was not properly
inherited from the parent in the child domains and the children
always created their own sdap domains lists that were disconnected
from the parent context and never used.

Second issue was that the child domain did not call the function
to reinit the search bases after the sdap_domain was added to the
list of sdap domains. This caused that child domains always used
automatically detected search bases and never used the configured
ones even though they were properly read into the ID options
context attached to the subdomain.

Also there has been an issue that the sdap search bases
were rewritten by the new child domain initialization
(this only happened with more than one child domain)
because the sdap domain list was 'updated' every time
a new child domain was initialized, which caused that
only the main domain and the last child domain had proper
search bases, the others only the auto-discovered ones
(because they were overwritten with the 'update').

Resolves:
https://pagure.io/SSSD/sssd/issue/3397

Reviewed-by: Sumit Bose

AD: Add debug messages

2017-05-19T14:43:41+00:00

Add debug messages when 1way or 2way trusts are created.

Reviewed-by: Sumit Bose

AD: Make ad_account_can_shortcut() reusable by SSSD on an IPA server

2017-05-02T14:55:18+00:00

Resolves:
    https://pagure.io/SSSD/sssd/issue/3318

The ad_account_can_shortcut() function is helpful to avoid unnecessary
searches when SSSD is configured with an Active Directory domain that
uses ID-mapping in the sense that if we find that an ID is outside our
range, we can just abort the search in this domain and carry on.

This function was only used in the AD provider functions which are used
when SSSD is enrolled direcly with an AD server. This patch moves the
function to a codepath that is shared between directly enrolled SSSD and
SSSD running on an IPA server.

Apart from moving the code, there are some minor changes to the function
signature, namely the domain is passed as as struct (previously the
domain name from the DP input was passed).

Reviewed-by: Michal Židek