sssd.git/src/providers/ad, branch certificate_mapping

AD: Use ad_domain to match forest root domain, not the configured domain from sssd.conf

2017-02-08T10:17:51+00:00

If the sssd.conf domain name was different from the joined domain name,
but sssd was joined to the forest root, the AD subdomains code considered
sssd joined to a non-root domain and tried to discover the forest root.

This could be reproduced by joining sssd to a domain, for example
win.trust.test but calling the sssd.conf domain otherwise, for example:
[domain/addomain]
ad_domain = win.trust.test

This is/was a frequent use-case in the RHEL world, where authconfig
often names the sssd.conf domain 'default'.

Without the patch, the trusted domains were not detected.

Reviewed-by: Pavel Březina

Suppres implicit-fallthrough from gcc 7

2017-02-01T13:10:44+00:00

Some kind of comments are recognized by gcc7 but they are ignored with
-Wimplicit-fallthrough=5 and only attributes disable the warning.

Reviewed-by: Fabiano Fidêncio

gpo: Improve debug messages

2017-01-25T14:50:01+00:00

Improve debug messages during security filtering. It was not possible
to figure out why the GPO was filtered by reading the logs, because
we use the same debug message in various cases.

Reviewed-by: Lukáš Slebodník

GPO: Skip GPOs without gPCFunctionalityVersion

2017-01-25T14:50:01+00:00

We falsely stopped GPO processing when Group Policy Container
in AD did not contain gPCFunctionalityVersion. Such GPOs
should be ignored by SSSD according to MS-GPOL:
https://msdn.microsoft.com/en-us/library/cc232538.aspx

Resolves:
https://fedorahosted.org/sssd/ticket/3269

Reviewed-by: Lukáš Slebodník

IPA/AD: check auth ctx before using it

2016-11-10T20:50:22+00:00

In e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483 a feature was introduced to
set the 'canonicalize' option in the system-wide Kerberos configuration
according to the settings in SSSD if the AD or IPA provider were used.
Unfortunately the patch implied that the auth provider is the same as
the id provider which might not always be the case. A different auth
provider caused a crash in the backend which is fixed by this patch.

Resolves https://fedorahosted.org/sssd/ticket/3234

Reviewed-by: Petr Cech

Remove double semicolon at the end of line

2016-09-21T13:10:11+00:00

Reviewed-by: Pavel Březina

dyndns: fix typo and unify ipa with ad debug message when off

2016-08-30T12:30:53+00:00

Reviewed-by: Petr Čech 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: ad_enabled_domains - other then master

2016-08-17T14:08:58+00:00

We can skip looking up other domains if
option ad_enabled_domains doesn't contain them.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: ad_enabled_domains - only master

2016-08-17T14:08:43+00:00

We can skip looking up other domains if option ad_enabled_domains
contains only master domain.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

AD_PROVIDER: Initializing of ad_enabled_domains

2016-08-17T14:08:36+00:00

We add ad_enabled_domains into ad_subdomains_ctx.

Resolves:
https://fedorahosted.org/sssd/ticket/2828

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník