sssd.git/src/responder/sudo, branch sudo

SUDO: Use initgr_with_views when looking up a sudo user

2017-09-08T15:02:49+00:00

The sudo responder code didn't take views into account when looking for
rules, which resulted in sudo rules being ignored if the user's name was
overriden.

Please see the ticket for a detailed info on how to reproduce the bug.

Resolves:
https://pagure.io/SSSD/sssd/issue/3488

Reviewed-by: Pavel Březina

sudo: add a threshold option to reduce size of rules refresh filter

2017-08-18T06:52:25+00:00

If a large number of rules is expired at one time the ldap filter may
become too large to be processed by server. This commits adds a new
option "sudo_threshold" to sudo responder. If the threshold is
exceeded a full refreshed is done instead of rules refresh.

Resolves:
https://pagure.io/SSSD/sssd/issue/3478

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio

CACHE_REQ: Domain type selection in cache_req

2017-03-30T12:09:22+00:00

Related to:
    https://pagure.io/SSSD/sssd/issue/3310

Adds a new enumeration cache_req_dom_type. It is a tri-state that
allows the caller to select which domains can be contacted - either only
POSIX, only application domains or any type.

Not all plugins of cache_req have the new parameter added -- only those
that are usable/useful in a non-POSIX environment. For example, it makes
no sense to allow the selection for calls by ID because those are
inherently POSIX-specific. Also, services or netgroups are supported
only coming from POSIX domains.

At the moment, the patch should not change any behaviour as all calls
default to contacting POSIX domains only.

Reviewed-by: Pavel Březina

SUDO: Make Sudo responder socket-activatable

2017-01-23T17:46:37+00:00

As part of the effort of making all responder socket-activatable, let's
make Sudo responder ready for this by providing its systemd's units.

In case the administrators want to use Sudo responder taking advantage
of socket-activation they will need to enable sssd-sudo.socket and
after a restart of the sssd service, the Sudo socket will be ready
waiting for any activity in order to start the Sudo responder. Also,
the Sudo responder must be removed from the services line on sssd.conf.

The Sudo responder service is binded to the SSSD service, which means
that the responder will be restarted in case SSSD is restarted and
shutdown in case SSSD is shutdown/crashes.

Related:
https://fedorahosted.org/sssd/ticket/2243

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

cache_req: encapsulate output data into structure

2016-12-19T22:22:54+00:00

In enumeration calls we want to get objects from all domains, not
only from the first matched domain. We move the cache search result
into a structure that contains combination of domain and ldb_result.

This is preparation for enumeration support inside cache_req.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník

MONITOR: Remove unused shutDown sbus method

2016-11-09T12:32:32+00:00

The shutDown method has not been used or set for a long time. Trim the
internal interface by removing all references to this internal method.

Reviewed-by: Lukáš Slebodník

MONITOR: Remove deprecated pong sbus method

2016-11-09T12:32:27+00:00

The pong method is deprecated since we started using the watchdog. Since
this is dead code, it makes sense to just remove it.

Reviewed-by: Lukáš Slebodník

cache_req: switch to new code

2016-10-20T07:56:38+00:00

This patch switch the old switch-based cache req code to
the new plugin-based.

Reviewed-by: Jakub Hrozek

DP: Remove old data provider interface

2016-08-16T12:54:50+00:00

Reverse data provider interface is moved to a better location in
NSS responder. All responders now can have an sbus interface
defined per data provider connection. The unused old data provider
interface is removed.

Reviewed-by: Lukáš Slebodník

fix some 'might be used uninitialized' warnings

2016-07-07T08:30:32+00:00

Reviewed-by: Jakub Hrozek