sssd.git/src/providers/ipa, branch ad_domain_local_groups

dyndns: fix typo and unify ipa with ad debug message when off

2016-08-30T12:30:53+00:00

Reviewed-by: Petr Čech 
Reviewed-by: Lukáš Slebodník

IPA: Parse qualified names when guessing AD user principal

2016-08-26T19:17:16+00:00

Most AD users store their UPN in an attribute. If they don't, or the sssd
was configured (typically in earlier versions to work around a bug) to not
look at the principal attribute, then sssd is supposed to guess
the attribute.

That currently doesn't work in 1.14, because the username is already
qualified and then we also append the realm name to it. We need to parse
the simple username from the qualified name first.

The issue can be reproduced simply by authenticating as the Administrator
account in IPA-AD trust setups.

Resolves:
https://fedorahosted.org/sssd/ticket/3127

Reviewed-by: Sumit Bose

Warn if IP address is used as option for ipa_server/ad_server

2016-08-16T18:21:29+00:00

GSSAPI is dependent on DNS with hostnames and we should warn about this.

Resolves:
https://fedorahosted.org/sssd/ticket/2789

Reviewed-by: Jakub Hrozek

failover: mark subdomain service with sd_ prefix

2016-08-16T12:39:15+00:00

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Jakub Hrozek

IPA: Check the return value of sss_parse_internal_fqname

2016-08-08T14:35:15+00:00

We should fail the request if sss_parse_internal_fqname() fails.

Reviewed-by: Lukáš Slebodník

IPA: Changing of confusing debug message

2016-08-05T11:14:38+00:00

This debug message used to confuse our users. So this patch changes it.
Old version: "Trust direction of %s is %s\n"
New version: "Trust type of [%s]: %s\n"

Resolves:
https://fedorahosted.org/sssd/ticket/3090

Reviewed-by: Pavel Březina

LDAP/IPA: add local email address to aliases

2016-07-29T12:45:00+00:00

Adding email-addresses from the local domain to the alias names is
strictly not needed by might help to speed up lookups in the NSS
responder.

Reviewed-by: Jakub Hrozek

LDAP: new attribute option ldap_user_email

2016-07-29T12:44:44+00:00

Reviewed-by: Jakub Hrozek

IPA: fix lookup by UPN for subdomains

2016-07-29T12:44:38+00:00

Currently the user name used in the extdom exop request is
unconditionally set to the short name. While this is correct for the
general name based lookups it breaks UPN/email based lookups where the
name part after the @-sign might not match to domain name. I guess this
was introduce during the sysdb refactoring.

Reviewed-by: Jakub Hrozek

IPA: expand ghost members of AD groups in server-mode

2016-07-29T12:44:22+00:00

Reviewed-by: Jakub Hrozek