sssd.git/src/confdb, branch certificate_mapping

Partially revert "CONFIG: Use default config when none provided"

2017-02-07T13:47:48+00:00

This reverts part of commit 59744cff6edb106ae799b2321cb8731edadf409a.

Removed is copying of default configuration into /etc/sssd/sssd.conf
Sample configurations is still part of installation.

Reviewed-by: Jakub Hrozek

RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idle

2017-01-23T17:46:37+00:00

This commit introduces a new option for the responders called
responder_idle_timeout, which specifies the number of seconds that the
responder process can be up without being used. The default value is
300 seconds (5 minutes) and can be configured per responder, being 60
seconds the minimum acceptable value.

Is important to note that setting "responder_idle_timeout = 0" disables
the responder timeout, which makes sense for the responders that always
will be running.

The shutdown timeout is activated per responder in case the responder
has been {dbus,socket}-activated. In case of any commnunication with the
responder the timeout is reset thereby ensuring we won't shutdown a
responder that is not idle.

Setting the responder's last request time is done slightly differently
for socket-activated and dbus-activated responders. In both cases it's
updated in any internal communication in sbus_message_handler(), but
for the socket-activated responders it's also updated when the
responder's socket is used.

Currently it works properly with all responders but the secrets one,
which has a different logic and must be treated separately in case some
change is required there.

Is worth to mention that this commit does not affect the responders
explicitly configured in the "services" line of sssd.conf.

Related:
https://fedorahosted.org/sssd/ticket/3245

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

common: Fix domain case sensitivity init

2016-12-15T09:43:20+00:00

The domain case sensitivity was wrongly set in the domain
context after initialization if the provider was AD.

Resolves:
https://fedorahosted.org/sssd/ticket/3235

Reviewed-by: Jakub Hrozek

CONFDB: Supress clang false passitive warnings

2016-11-29T08:46:20+00:00

The errno is macro expandee into '(*__errno_location ())'.
The reason is that errno is private in glibc and and the
function __errno_location return address of private errno.

  sh$ objdump -T /lib64/libc.so.6 | grep errno
  00000010 g    D  .tbss  00000004  GLIBC_PRIVATE errno
  000208a0 g    DF .text  00000011  GLIBC_2.2.5 __errno_location
  001366b0 g    DF .text  0000005f  GLIBC_2.2.5 clnt_sperrno
  00136710 g    DF .text  00000074  GLIBC_2.2.5 clnt_perrno
  00000064 g    D  .tbss  00000004  GLIBC_PRIVATE __h_errno
  0011aad0 g    DF .text  00000011  GLIBC_2.2.5 __h_errno_location

It looks like clang static analyzer assume that value can be
changed due to function call.

  errno = 0;
  val = strtol(values[0], NULL, 0);
  // Taking true branch => assuming "errno != 0"
  if (errno) {
      ret = errno;
      // errno was stored to ret but clang later assumes
      // that ret can be 0
      goto failed;

Reviewed-by: Fabiano Fidêncio

SECRETS: Add configurable payload size limit of a secret

2016-11-24T08:55:45+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3169

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

PAM: add pam_response_filter option

2016-11-02T10:30:20+00:00

Currently the main use-case for this new option is to not set the
KRB5CCNAME environment varible for services like 'sudo-i'.

Resolves https://fedorahosted.org/sssd/ticket/2296

Reviewed-by: Jakub Hrozek

SECRETS: Add a configurable limit of secrets that can be stored

2016-10-05T09:57:20+00:00

Related:
https://fedorahosted.org/sssd/ticket/3169

Reviewed-by: Jakub Hrozek

SECRETS: Add a configurable depth limit for nested containers

2016-10-03T13:32:33+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3168

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

PROXY: Adding proxy_max_children option

2016-09-13T14:22:26+00:00

The new option 'proxy_max_children' is applicable
in domain section. Default value is 10.

Resolves:
https://fedorahosted.org/sssd/ticket/3153

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina

MONITOR: Add disable_netlink option

2016-09-12T08:23:41+00:00

Adding a new monitor boolean option to disable netlink support.
This will give users more control over sssd state changes without
having to modify systemd unit files.

Resolves:
https://fedorahosted.org/sssd/ticket/3142

Reviewed-by: Petr Cech 
Reviewed-by: Jakub Hrozek