sssd.git/src/providers/simple, branch ad_domain_local_groups

SIMPLE: Make the DP handlers testable

2016-08-10T14:55:53+00:00

To make it possible to call the whole DP handler in the unit test, not
just the evaluator part.

Reviewed-by: Lukáš Slebodník

SIMPLE: Fail on any error parsing the access control list

2016-08-10T14:55:53+00:00

Luckily this error was hidden by the fact that SSSD didn't start at all
when an unparseable name was encountered after startup. Otherwise, this
would have been a security issue.

Nonetheless, we should just fail and deny access if we can't parse a
name in a simple access list.

Reviewed-by: Lukáš Slebodník

SIMPLE: Do not parse names on startup

2016-08-10T14:55:53+00:00

It's not required to parse names on SSSD startup in the simple access
provider. We can instead just parse the name when the access request is
processed.

Resolves:
https://fedorahosted.org/sssd/ticket/3101

Reviewed-by: Lukáš Slebodník

DP: rename be_acct_req to dp_id_data

2016-07-15T11:14:12+00:00

Reviewed-by: Lukáš Slebodník

SIMPLE: Make the simple access provider work with qualified names

2016-07-07T08:25:21+00:00

This patch adds a behaviour change to the simple access provider - the
simple access list is parsed on the access check itself, which is when
the name contexts of all domains have already been established and we
are already able to parse the names in the config files with
sss_parse_names. We need to support "input names" in the simple access
provider because it needs to support flat names which rely on knowing
the details about a domain.

The simple_access_obtain_filter_lists is intentionally made non-static
in order to be called from tests which initialize the name contexts on
their own.

Reviewed-by: Sumit Bose

DP: Switch to new interface

2016-06-20T12:48:47+00:00

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

Rename dp_backend.h to backend.h

2016-06-20T12:48:46+00:00

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

simple-access-provider: make user grp res more robust

2015-04-28T09:58:53+00:00

Not all user groups need to be resolved if group deny list is empty.

Resolves:
https://fedorahosted.org/sssd/ticket/2519

Reviewed-by: Jakub Hrozek

simple-access-provider: break matching allowed users

2014-12-08T09:55:47+00:00

Stop matching username with names in simple_allow_users after positive
match.

Reviewed-by: Lukáš Slebodník

simple access provider: non-existing object

2014-12-08T09:55:40+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2519

Not existing user/group in simple_allow_users/simple_allow_groups should not
imply access denied.

Reviewed-by: Lukáš Slebodník