sssd.git/src/config/etc, branch certificate_mapping

RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idle

2017-01-23T17:46:37+00:00

This commit introduces a new option for the responders called
responder_idle_timeout, which specifies the number of seconds that the
responder process can be up without being used. The default value is
300 seconds (5 minutes) and can be configured per responder, being 60
seconds the minimum acceptable value.

Is important to note that setting "responder_idle_timeout = 0" disables
the responder timeout, which makes sense for the responders that always
will be running.

The shutdown timeout is activated per responder in case the responder
has been {dbus,socket}-activated. In case of any commnunication with the
responder the timeout is reset thereby ensuring we won't shutdown a
responder that is not idle.

Setting the responder's last request time is done slightly differently
for socket-activated and dbus-activated responders. In both cases it's
updated in any internal communication in sbus_message_handler(), but
for the socket-activated responders it's also updated when the
responder's socket is used.

Currently it works properly with all responders but the secrets one,
which has a different logic and must be treated separately in case some
change is required there.

Is worth to mention that this commit does not affect the responders
explicitly configured in the "services" line of sssd.conf.

Related:
https://fedorahosted.org/sssd/ticket/3245

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

SECRETS: Add configurable payload size limit of a secret

2016-11-24T08:55:45+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3169

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

PAM: add pam_response_filter option

2016-11-02T10:30:20+00:00

Currently the main use-case for this new option is to not set the
KRB5CCNAME environment varible for services like 'sudo-i'.

Resolves https://fedorahosted.org/sssd/ticket/2296

Reviewed-by: Jakub Hrozek

SECRETS: Add a configurable limit of secrets that can be stored

2016-10-05T09:57:20+00:00

Related:
https://fedorahosted.org/sssd/ticket/3169

Reviewed-by: Jakub Hrozek

SECRETS: Add a configurable depth limit for nested containers

2016-10-03T13:32:33+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3168

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

CONFIG: Add secrets provider options

2016-10-03T13:32:23+00:00

Related:
https://fedorahosted.org/sssd/ticket/3207

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

PROXY: Adding proxy_max_children option

2016-09-13T14:22:26+00:00

The new option 'proxy_max_children' is applicable
in domain section. Default value is 10.

Resolves:
https://fedorahosted.org/sssd/ticket/3153

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina

MONITOR: Add disable_netlink option

2016-09-12T08:23:41+00:00

Adding a new monitor boolean option to disable netlink support.
This will give users more control over sssd state changes without
having to modify systemd unit files.

Resolves:
https://fedorahosted.org/sssd/ticket/3142

Reviewed-by: Petr Cech 
Reviewed-by: Jakub Hrozek

MONITOR: Remove leftovers from kill_service

2016-08-31T07:13:41+00:00

Seems that wen I sent the v2 of ac35fe74 I attached the wrong pacth that
ended up being pushed.
The patch was incomplete as there are still some leftovers.

The .po and sssd-docs.pot were not touched as I do believe they are
autogenerated from Zanata.

Related:
https://fedorahosted.org/sssd/ticket/3052

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Petr Čech

MONITOR: Remove leftovers from diag_cmd

2016-08-31T07:13:35+00:00

Seems that when I sent the v2 of 7579cf99 I attached the wrong patch
that ended up being pushed.
That patch was incomplete as there are still some leftovers.

Related:
https://fedorahosted.org/sssd/ticket/3051

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Petr Čech