sssd.git/src/providers/ipa, branch sudo

IPA: sanitize name in override search filter

2017-10-18T10:35:59+00:00

Resolves:
https://pagure.io/SSSD/sssd/issue/3545

Reviewed-by: Fabiano Fidêncio

IPA: fix handling of certmap_ctx

2017-09-14T14:57:09+00:00

This patch fixes a use-after-free in the AD provider part and
initializes the certmap_ctx with data from the cache at startup.

Related to https://pagure.io/SSSD/sssd/issue/3508

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek

IPA: check if IPA hostname is fully qualified

2017-09-13T19:03:26+00:00

Some users change the IPA hostname post-install which results in
strange bugs. Code change make sure that the ipa_hostname contains
at least one domain component.

Resolves: https://pagure.io/SSSD/sssd/issue/1946

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio

ipa: make sure view name is initialized at startup

2017-09-06T14:28:26+00:00

sysdb_master_domain_update() can only set the view name properly if it was not
set before but it might be called multiple times before the view name is
available if the cache is empty. Since ipa_apply_view() keeps track if
the view name was already set at startup or not the name can safely be
cleaned here before sysdb_master_domain_update() is called.

Resolves:
https://pagure.io/SSSD/sssd/issue/3501

Reviewed-by: Jakub Hrozek

SELINUX: Use getseuserbyname to get IPA seuser

2017-09-06T06:17:53+00:00

The libselinux function getseuserbyname is more reliable method to retrieve
SELinux usernames then functions from libsemanage `semanage_user_query`
and is recommended by libsemanage developers.
Replace get_seuser function with getseuserbyname.

Resolves:
https://pagure.io/SSSD/sssd/issue/3308

Reviewed-by: Michal Židek 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Petr Lautrbach

IPA: Use sysdb_search_*_by_orig_dn() in _subdomains_ext_group.c

2017-09-05T09:13:57+00:00

Methods for searching the users, groups and entries by their orig dn
have been introduced in one of the previous commit.

Let's make use of those whenever it makes sense.

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

IPA: Use sysdb_search_*_by_orig_dn() _hbac_users.c

2017-09-05T09:13:31+00:00

Methods for searching the users, groups and entries by their orig dn
have been introduced in one of the previous commit.

Let's make use of those whenever it makes sense.

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

IPA: Only generate kdcinfo files on clients

2017-09-04T14:41:46+00:00

In some cases, IPA masters end up having a broken SSSD configuration
that also includes the SRV records. This can cause the kdcinfo files to
point to a different master which uses a different PKINIT certificate
which is only valid for that IPA master. This can result e.g. in webui
not working.

This patch prevents the kdcinfo files from being generated on the IPA
masters, but keep generating them on the clients.

Not generating kdcinfo files on masters has no negative performance
impact, because libkrb5 is configured via krb5.conf to point to self
anyway.

Reviewed-by: Pavel Březina

IPA: Reword the DEBUG message about SRV resolution on IDM masters

2017-09-04T14:41:27+00:00

Reviewed-by: Pavel Březina

IPA: Only attempt migration for the joined domain

2017-09-01T16:21:10+00:00

After the recent changes in commit a5e134b22aa27ff6cd66a7ff47089788ebc098a1
to fix ticket #3394, the PAM_CRED_ERR error would try to start migration
for any account. Further down the request, a sysdb search would try to find
the user in the joined domain only because the migration code presumes the
user is in the IPA domain which would error out and return System Error
to the PAM client.

This patch changes the migration somewhat to only attempt the migration
for IPA users.

Reviewed-by: Pavel Březina