sssd.git/src/db, branch jhrozek_sysdb_fqdn

sudo: solve problems with fully qualified names

2016-07-06T15:40:23+00:00

sudo expects the same name in sudo rule as login name. Therefore
if fully qualified name is used or even enforced by setting
use_fully_qualified_names to true or by forcing default domain
with default_domain_suffix sssd is able to correctly return the
rules but sudo can't match the user with contect of sudoUser
attribute since it is not qualified.

This patch changes the rules on the fly to avoid using names at all.
We do this in two steps:
1. We fetch all rules that match current user name, id or groups and
   replace sudoUser attribute with sudoUser: #uid.
2. We fetch complementry rules that contain netgroups since it is
   expected we don't have infromation about existing netgroups in
   cache, sudo still needs to evaluate it for us if needed.

This patch also remove test for sysdb_get_sudo_filter since it wasn't
sufficient anyway and I did not rewrite it since I don't thing it
is a good thing to have filter tests that depends on exact filter
order.

Resolves:
https://fedorahosted.org/sssd/ticket/2919

Reviewed-by: Jakub Hrozek

SYSDB: qualify_attr: create new attribute only once

2016-07-06T15:40:22+00:00

Reviewed-by: Jakub Hrozek

SYSDB: Upgrade sysdb to use qualified names for users and groups, sudo rules and override objects

2016-07-06T15:40:22+00:00

Runs a sysdb upgrade that changes objects that represent users, groups,
sudo rules and overrides to the new schema, which uses the fully
qualified names.

SYSDB: Remove the timestamps cache on update

2016-07-06T15:40:22+00:00

When the cache is upgraded, we want to avoid upgrading the timestamps
cache, because it was only introduced recently in Beta, so it doesn't
make senes to write complex code to change the format.

This patch rather removes the cache during upgrade, it will be recreated
with later lookups anyway.

SYSDB: Fix small issues during db upgrade

2016-07-06T15:40:22+00:00

This patch fixes several issues introduced during the recent sysdb
upgrade:
    1) The upgrade code often accesses sysdb->ldb, but at this point,
    the ldb pointer might not be initialized yet. As a kind of an ugly,
    yet functional workaround, we pass in the ldb pointer that we
    received from the caller as part of the sysdb structure.

    2) the version that sysdb_domain_cache_upgrade() returns is not a
    talloc pointer, so the upgrade was crashing when we tried to steal
    it.

    3) the ldb pointer sysdb_cache_connect() returns was kept allocated
    on the tmp_ctx. We need to steal it instead.

SYSDB: Allow passing a context to sysdb upgrade functions

2016-07-06T15:40:22+00:00

We decide on whether to upgrade or not based on a pointer value, not a
boolean. This pointer points to a structure that the upgrade invoker
(typically the monitor) can use to fill auxilary data the sysdb upgrade
has no means of instantiating.

SYSDB: Remove useless parameter from sysdb_init()

2016-07-06T15:40:22+00:00

The function sysdb_init() is never used to allow upgrade, so the
allow_upgrade parameter was pointless.

SYSDB: Construct internal fqnames, not NSS names in sysdb_add_group_member_overrides

2016-07-06T15:33:00+00:00

Because all users and groups are stored the same way in sysdb, we can
avoid parsing and unparsing the name with NSS functions and instead just
grab the name from the FQDN in the cache.

SYSDB: Add a utility function to return a list of qualified names

2016-07-06T15:32:59+00:00

Adds a utility function the LDAP provider can use. This is different
from sss_create_internal_fqname_list in the sense that the LDAP provider
passes in the attribute name that contains the name attribute value.

SYSDB: add_name_and_aliases_for_name_override no longer needs to special case subdomain users

2016-07-06T15:32:58+00:00

All user and group names use the same unified format in the cache, so
there's no need to special-case subdomains and create different names
for the main domain and a subdomain.