sssd.git/src/responder/common/cache_req, branch sudo

Fix warning declaration of 'index' shadows a global declaration

2017-09-25T19:35:39+00:00

src/responder/common/cache_req/cache_req.c: In function 'cache_req_add_result':
src/responder/common/cache_req/cache_req.c:587: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_cmd.c:387: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_getent_get_result':
src/responder/nss/nss_cmd.c:433: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_endent':
src/responder/nss/nss_cmd.c:671: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_protocol_netgr.c: In function 'nss_protocol_fill_netgrent':
src/responder/nss/nss_protocol_netgr.c:113: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

Reviewed-by: Fabiano Fidêncio

Print a warning when enumeration is requested but disabled

2017-09-25T12:33:06+00:00

Add an explanatory message to be logged once, at the start-up,
mentioning that in case enumeration is not enabled, getent passwd won't
return all users by design.
The debug level chosen to show the message is SSS_LOG_NOTICE.

Resolves:
https://pagure.io/SSSD/sssd/issue/2301

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

cache_req: Look for name attribute also in nss_cmd_getsidbyid

2017-09-06T11:16:03+00:00

We always check negcache after getting data from backend since commit
4c09cd008967c5c0ec358dc658ffc6fc1cef2697 because we usually do have a name
in begging of requests "* by ID".

We were not interested in name in request sid by id before. However, function
cache_req_search_ncache_filter always expect name otherwise it returns
ERR_INTERNAL.

[sssd[nss]] [cache_req_set_plugin] (0x2000): CR #8: Setting "Object by ID" plugin
[sssd[nss]] [cache_req_send] (0x0400): CR #8: New request 'Object by ID'
[sssd[nss]] [cache_req_select_domains] (0x0400): CR #8: Performing a multi-domain search
[sssd[nss]] [cache_req_search_domains] (0x0400): CR #8: Search will check the cache and check the data provider
[sssd[nss]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain sssdad2012r2.com type POSIX is valid
[sssd[nss]] [cache_req_set_domain] (0x0400): CR #8: Using domain [sssdad2012r2.com]
[sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Looking up ID:233600513@sssdad2012r2.com
[sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: Checking negative cache for [ID:233600513@sssdad2012r2.com]
[sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/sssdad2012r2.com/233600513]
[sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: [ID:233600513@sssdad2012r2.com] is not present in negative cache
[sssd[nss]] [cache_req_search_cache] (0x0400): CR #8: Looking up [ID:233600513@sssdad2012r2.com] in cache
[sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Returning [ID:233600513@sssdad2012r2.com] from cache
[sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #8: Filtering out results by negative cache
[sssd[nss]] [cache_req_search_ncache_filter] (0x0020): CR #8: sss_get_name_from_msg() returned NULL, which should never happen in this scenario!
[sssd[nss]] [cache_req_process_result] (0x0400): CR #8: Finished: Error 1432158209: Internal Error
[sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: error [1432158209]: Internal Error
[sssd[nss]] [client_recv] (0x0200): Client disconnected!

Resolves:
https://pagure.io/SSSD/sssd/issue/3485

Reviewed-by: Pavel Březina

CACHE_REQ: Don't error out when searching by id = 0

2017-08-28T18:55:07+00:00

This code path can be easily triggered by calling `id 0` and SSSD should
not error out in this case.

Previous patches in this series already add uid and gid 0 to the
negative cache and we can properly handle this situation.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

CACHE_REQ: Fix warning may be used uninitialized

2017-07-31T10:17:06+00:00

Setting ret as EOK in case everything goes well.

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Nikolai Kondrashov

CACHE_REQ: Pull sessionRecording attrs from initgr

2017-07-27T08:33:08+00:00

After entires are retrieved by cache_req for user info requests (except
initgr), overlay them with sessionRecording attribute retrieved from an
initgr request made additionally for each entry.

Do not do additional initgr requests with selective session recording
enabled, if we don't have any group names to match against in session
recording configuration. Only do user name matches instead.

Reviewed-by: Pavel Březina

CACHE_REQ: Propagate num_results to cache_req_state

2017-07-27T08:32:09+00:00

The num_results field in struct cache_req_state was only set in case of
well-known objects, set it also for the regular results for uniformity,
and for later use by session recording code.

Reviewed-by: Pavel Březina

DOMAIN: Add sss_domain_info_{get,set}_output_fqnames()

2017-06-21T09:28:15+00:00

Let's avoid setting a domain's property directly from cr_domain code.

In order to do so, let's introduce a setter, which may help us in the
future whenever we decide to make sss_domain_info an opaque structure.

For completeness, a getter has also been introduced and used in the
usertools code.

Related:
https://pagure.io/SSSD/sssd/issue/3403

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

RESPONDER: Use fqnames as output when needed

2017-06-21T09:28:08+00:00

As some regressions have been caused by not handling properly naming
conflicts when using shortnames, last explicitly use fully qualified
names as output in the following situations:
- domain resolution order is set;
- a trusted domain has been using `use_fully_qualified_name = false`

In both cases we want to ensure that even handling shortnames as input,
the output will always be fully qualified.

As part of this patch, our tests ended up being modified to reflect the
changes done. In other words, the tests related to shortnames now return
expect as return a fully qualified name for trusted domains.

Resolves:
https://pagure.io/SSSD/sssd/issue/3403

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

cache_req: Do not use default_domain_suffix with netgroups

2017-06-08T15:30:31+00:00

Resolves:
https://pagure.io/SSSD/sssd/issue/3428

Reviewed-by: Pavel Březina