sssd.git/src/providers/ipa, branch master

IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifier

2017-04-24T08:21:24+00:00

There was an issue in a production deployment where the admin selected a
GID outside the IDM range for a group that contained a user from the
trusted domain. This resulted in not adding a SID for the IPA group,
which in turn meant the group couldn't be resolved on the client.

This patch just improves the DEBUG message so that it's clearer for the
admins where the issue is.

Reviewed-by: Lukáš Slebodník

selinux: Do not fail if SELinux is not managed

2017-04-06T11:41:33+00:00

Previously we failed if semanage_is_managed returned 0 or -1 (not
managed or error). With this patch we only fail in case of error and
continue normally if selinux is not managed by libsemanage at all.

Resolves:
https://fedorahosted.org/sssd/ticket/3297

Reviewed-by: Lukáš Slebodník

ipa_s2n_get_acct_info_send: provide correct req_input name

2017-04-03T14:07:45+00:00

To avoid crash.

Resolves:
https://pagure.io/SSSD/sssd/issue/3358

Reviewed-by: Sumit Bose 
Reviewed-by: Lukáš Slebodník

IPA: enable AD user lookup by certificate

2017-03-29T13:09:51+00:00

Without this the lookup by certificate for AD users on an IPA client
will just error out.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek

IPA: lookup AD users by certificates on IPA clients

2017-03-29T13:09:48+00:00

Get a list of users mapped to a certificate back from the IPA server,
look them up and store them together with the certificate used for the
search as mapped attribute to the cache.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek

IPA: add mapped attributes to user from trusted domains

2017-03-29T13:09:44+00:00

Allow the usage of the mapped attribute for the lookup of AD users on
IPA clients as already used for the normal LDAP lookup.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek

IPA: Get ipaDomainsResolutionOrder from IPA ID View

2017-03-29T12:00:17+00:00

ipaDomainsResolutionOrder provides a list of domains that have to be
looked up firstly during cache_req searches.

This commit only fetches this list from the server and stores its value
at sysdb so we can make use of it later on this patch series.

There are no tests for newly introduced sysdb methods are those are
basically only calling sysdb_update_domain_resolution_order(),
sysdb_get_domain_resolution_order() and
sysdb_get_use_domain_resolution_order() which are have tests written
for.

Related:
https://pagure.io/SSSD/sssd/issue/3001

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Sumit Bose 
Reviewed-by: Pavel Březina

IPA_SUBDOMAINS: Rename _refresh_view() to _refresh_view_name()

2017-03-29T12:00:17+00:00

This method got renamed in order to match better with what it does
currently.

Related:
https://pagure.io/SSSD/sssd/issue/3001

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Sumit Bose 
Reviewed-by: Pavel Březina

IPA: Get ipaDomainsResolutionOrder from ipaConfig

2017-03-29T12:00:17+00:00

ipaDomainsResolutionOrder provides a list of domains that have to be
looked up firstly during cache_req searches.

This commit only fetches this list from the server and stores its value
at sysdb so we can make use of it later on this patch series.

There are no tests for newly introduced sysdb methods are those are
basically only calling sysdb_update_domain_resolution_order(),
sysdb_get_domain_resolution_order() and
sysdb_get_use_domain_resolution_order() which are have tests written
for.

Related:
https://pagure.io/SSSD/sssd/issue/3001

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Sumit Bose 
Reviewed-by: Pavel Březina

SUBDOMAINS: Allow use_fully_qualified_names for subdomains

2017-03-29T12:00:17+00:00

Allow option use_fully_qualified_names in subdomain section.
This option was recently added to subdomain_inherit.

Resolves:
https://pagure.io/SSSD/sssd/issue/3337

Reviewed-by: Fabiano Fidêncio