sssd.git, branch gdm_sc_fix

pam_sss: check PKCS11_LOGIN_TOKEN_NAME

2016-09-13T08:46:21+00:00

p11: return a fully-qualified name

2016-09-13T07:25:01+00:00

Related to https://fedorahosted.org/sssd/ticket/3165

p11: only set PKCS11_LOGIN_TOKEN_NAME if gdm-smartcard is used

2016-09-13T07:25:01+00:00

Resolves https://fedorahosted.org/sssd/ticket/3165

MONITOR: Add disable_netlink option

2016-09-12T08:23:41+00:00

Adding a new monitor boolean option to disable netlink support.
This will give users more control over sssd state changes without
having to modify systemd unit files.

Resolves:
https://fedorahosted.org/sssd/ticket/3142

Reviewed-by: Petr Cech 
Reviewed-by: Jakub Hrozek

MONITOR: Remove --disable-netlink command-line option

2016-09-12T08:23:33+00:00

    Removing monitor command-line option, to be superceded by
    sssd.conf option

Reviewed-by: Petr Cech 
Reviewed-by: Jakub Hrozek

KRB5: Send the output username, not internal fqname to krb5_child

2016-09-08T21:04:30+00:00

krb5_child calls krb5_kuserok() during the access phase which checks if
a particular user is allowed to authenticate as a particular principal.
We used to pass the internal fqname to krb5_kuserok() which broke the
functionality and all users were denied access.

This patch changes that to send the 'output' username to krb5_child,
because that's the username the system receives through getpwnam() or
getpwuid() anyway. The patch also adds a new structure member fo the
krb5child_req structure to avoid reusing the pd->user variable but have
an explicit one that serves as the input for the child process.

Resolves:
https://fedorahosted.org/sssd/ticket/3172

Reviewed-by: Lukáš Slebodník

TESTS: Add FQDN variants for some tests

2016-09-07T18:38:54+00:00

Adds FQDN variants of some already existing tests.

Reviewed-by: Lukáš Slebodník

TOOLS: sss_mc_refresh_nested_group short/fqname usage

2016-09-07T18:38:54+00:00

We use shortname to refresh memory cache, but in case of nested groups,
we used internal_fqname to refresh parent groups.

We also wrongly used the shortname for sysdb_search operation.
Which caused error message to be printed when sss_usermod -a or
sss_groupmod -a where called.

Reviewed-by: Lukáš Slebodník

TESTS: Test for sss_user/groupmod -a

2016-09-07T18:38:54+00:00

Regression tests for ticket #3178.

Resolves:
https://fedorahosted.org/sssd/ticket/3178

Reviewed-by: Lukáš Slebodník

TOOLS: use internal fqdn for DN

2016-09-07T18:38:54+00:00

Use internal fqdn when creating sysdb group dn.

Resolves:
https://fedorahosted.org/sssd/ticket/3178

Reviewed-by: Lukáš Slebodník