sssd.git/src/responder, branch master

SECRETS: remove unused variable

2017-04-21T11:45:02+00:00

Reviewed-by: Pavel Březina

IFP: Use sized_domain_name to format the groups the user is a member of

2017-04-21T09:24:41+00:00

Resolves:
    https://pagure.io/SSSD/sssd/issue/3268

Uses the common function sized_domain_name() to format a group the user
is a member of to the appropriate format.

To see the code is working correctly, run:
        dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe
                  /org/freedesktop/sssd/infopipe
                  org.freedesktop.sssd.infopipe.GetUserGroups
                  string:trusted_user

Where trusted_user is a user from a trusted domain that is a member of groups
from the joined domain and a trusted domain as well. The groups from the
joined domain should not be qualified, the groups from the trusted
domain should be qualified.

Reviewed-by: Pavel Březina

Move sized_output_name() and sized_domain_name() into responder common code

2017-04-21T09:24:41+00:00

These functions are used to format a name into a format that the user
configured for output, including case sensitiveness, replacing
whitespace and qualified format. They were used only in the NSS
responder, which typically returns strings to the NSS client library and
then the user.

But it makes sense to just reuse the same code in the IFP responder as
well, since it does essentially the same job.

The patch also renames sized_member_name to sized_domain_name.
Previously, the function was only used to format a group member, the IFP
responder would use the same function to format a group the user is a
member of.

Related to:
    https://pagure.io/SSSD/sssd/issue/3268

Reviewed-by: Pavel Březina

responders: do not leak selinux context on clients destruction

2017-04-03T13:37:27+00:00

The SELinux context created in get_client_cred is not talloc bound and
we were leaking it if available with each client's destruction.

Resolves:
https://pagure.io/SSSD/sssd/issue/3360

Reviewed-by: Lukáš Slebodník

secrets: always add Content-Length header

2017-03-30T17:08:20+00:00

If custodia server does not reply with Content-Length header, curl may
wait for non-existing body of http reply if such body does not exist
(for example during POST operation when creating a container).

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek

secrets: fix debug message

2017-03-30T17:08:10+00:00

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek

secrets: support HTTP basic authentication with proxy provider

2017-03-30T17:08:05+00:00

Even though configuration options auth_type = basic, username and password
are read they were not used anywhere prior this patch.

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek

secrets: allow to configure certificate check

2017-03-30T17:08:00+00:00

Some users may want to use TLS with unverified peer (for example if
they use self-signed certificate) or if unverified hostname (if
certificate hostname does not match with the real hostname). On the
other side it may be useful to point to a directory containing custom
certificate authorities.

This patch add three new options to secrets responder:
verify_peer => peer's certificate must be valid
verify_host => hostnames must match
capath => path to directory containing CA certs
cacert => ca certificate
cert => client certificate
key => client private key

Resolves:
https://pagure.io/SSSD/sssd/issue/3192

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek

secrets: remove http-parser code in proxy provider

2017-03-30T17:07:55+00:00

We switche to libcurl in previous patch. This just removes the unused code.

Resolves:
https://pagure.io/SSSD/sssd/issue/3192

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek

secrets: use tcurl in proxy provider

2017-03-30T17:07:50+00:00

We switch from http-parser to libcurl for an http client. This gaves us many
features for free such as tls and http basic authentication support instead
of implementing it on our own.

Resolves:
https://pagure.io/SSSD/sssd/issue/3192

Reviewed-by: Simo Sorce 
Reviewed-by: Jakub Hrozek