sssd.git/src/providers, branch master

IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifier

2017-04-24T08:21:24+00:00

There was an issue in a production deployment where the admin selected a
GID outside the IDM range for a group that contained a user from the
trusted domain. This resulted in not adding a SID for the IPA group,
which in turn meant the group couldn't be resolved on the client.

This patch just improves the DEBUG message so that it's clearer for the
admins where the issue is.

Reviewed-by: Lukáš Slebodník

DP: Fix typo

2017-04-06T12:36:43+00:00

Reviewed-by: Lukáš Slebodník

selinux: Do not fail if SELinux is not managed

2017-04-06T11:41:33+00:00

Previously we failed if semanage_is_managed returned 0 or -1 (not
managed or error). With this patch we only fail in case of error and
continue normally if selinux is not managed by libsemanage at all.

Resolves:
https://fedorahosted.org/sssd/ticket/3297

Reviewed-by: Lukáš Slebodník

ipa_s2n_get_acct_info_send: provide correct req_input name

2017-04-03T14:07:45+00:00

To avoid crash.

Resolves:
https://pagure.io/SSSD/sssd/issue/3358

Reviewed-by: Sumit Bose 
Reviewed-by: Lukáš Slebodník

KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccache

2017-03-30T12:10:16+00:00

Related to:
https://pagure.io/SSSD/sssd/issue/3310

The following changes were done to the Kerberos authentication code
in order to support authentication in a non-POSIX environment:
    - delayed authentication is disabled in non-POSIX domains
    - when a user logs in in a non-POSIX domain, SSSD uses a
      MEMORY:$username ccache and destroys is then krb5_child finishes
      so that just the numeric result is used
    - krb5_child doesn't drop privileges in this configuration because
      there is nothing to drop privileges to

Reviewed-by: Sumit Bose

LDAP: Relax search filters in application domains

2017-03-30T12:10:11+00:00

Related to:
https://pagure.io/SSSD/sssd/issue/3310

If a request comes towards an application domain, we can drop the part
of the filter that asserts that the object has a valid UID/GID. Instead,
we just search by name.

Reviewed-by: Sumit Bose

LDAP: save non-POSIX users in application domains

2017-03-30T12:10:06+00:00

Related to:
https://pagure.io/SSSD/sssd/issue/3310

If a user being saved by the LDAP provider does not have a UID or GID
and the domain type is application, we save the user entry as non-POSIX.

Reviewed-by: Sumit Bose

IPA: enable AD user lookup by certificate

2017-03-29T13:09:51+00:00

Without this the lookup by certificate for AD users on an IPA client
will just error out.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek

IPA: lookup AD users by certificates on IPA clients

2017-03-29T13:09:48+00:00

Get a list of users mapped to a certificate back from the IPA server,
look them up and store them together with the certificate used for the
search as mapped attribute to the cache.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek

IPA: add mapped attributes to user from trusted domains

2017-03-29T13:09:44+00:00

Allow the usage of the mapped attribute for the lookup of AD users on
IPA clients as already used for the normal LDAP lookup.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek