sssd.git/src/providers, branch sudo

sudo: always use srv_opts from id context

2017-10-31T09:48:55+00:00

Prior this patch, we remember id_ctx->srv_opts in sudo request to switch
the latest usn values. This works fine most of the time but it may cause
a crash.

If we have two concurrent sudo refresh and one of these fails, it causes
failover to try the next server and possibly replacing the old srv_opts
with new one and it causes an access after free in the other refresh.

DP: Log to syslog whether it's online or offline

2017-10-18T19:06:24+00:00

Instead of requiring that admins enable and look at our logs, let's log
to syslog what's the DP status.

Resolves:
https://pagure.io/SSSD/sssd/issue/3307

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Pavel Březina

DP: Fix the output type used in dp_req_recv_ptr()

2017-10-18T19:06:15+00:00

Related: https://pagure.io/SSSD/sssd/issue/3307

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Pavel Březina

IPA: sanitize name in override search filter

2017-10-18T10:35:59+00:00

Resolves:
https://pagure.io/SSSD/sssd/issue/3545

Reviewed-by: Fabiano Fidêncio

GPO: Don't use freed LDAPURLDesc if domain for AD DC cannot be found

2017-10-05T18:01:43+00:00

If a referral returned during AD GPO processing cannot be assigned to a
known domain, at the moment SSSD accesses memory that was freed
previously with ldap_free_urldesc().

This patch moves the ldap_free_urldesc() call to both the error handler
and the success branch after we are done working with the LDAPURLDesc
instance.

Reviewed-by: Fabiano Fidêncio

ldap: Change ldap_user_certificate to userCertificate;binary

2017-10-04T06:54:41+00:00

IPA and AD providers default to userCertificate;binary for the
ldap_user_certificate option. It will be good to default that value
also for the generic LDAP provider.

Resolves:
https://pagure.io/SSSD/sssd/issue/3499

Reviewed-by: Jakub Hrozek

IPA: fix handling of certmap_ctx

2017-09-14T14:57:09+00:00

This patch fixes a use-after-free in the AD provider part and
initializes the certmap_ctx with data from the cache at startup.

Related to https://pagure.io/SSSD/sssd/issue/3508

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek

IPA: check if IPA hostname is fully qualified

2017-09-13T19:03:26+00:00

Some users change the IPA hostname post-install which results in
strange bugs. Code change make sure that the ipa_hostname contains
at least one domain component.

Resolves: https://pagure.io/SSSD/sssd/issue/1946

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio

DP: Add Generic DP Request Probes

2017-09-08T14:09:30+00:00

Add the ability to analyze performance and monitor Data Provider
requests at a high-level, probes fire when a request is sent and when
a request is completed.

Request name, domain, target, method, and return code information
is passed as target variables to the systemtap probe tapsets which
can be used in systemtap scripts.

Resolves:
https://pagure.io/SSSD/sssd/issue/3061

Reviewed-by: Jakub Hrozek

ipa: make sure view name is initialized at startup

2017-09-06T14:28:26+00:00

sysdb_master_domain_update() can only set the view name properly if it was not
set before but it might be called multiple times before the view name is
available if the cache is empty. Since ipa_apply_view() keeps track if
the view name was already set at startup or not the name can safely be
cleaned here before sysdb_master_domain_update() is called.

Resolves:
https://pagure.io/SSSD/sssd/issue/3501

Reviewed-by: Jakub Hrozek