sssd.git/src/providers, branch certificate_mapping

IPA: add certmap support (wip)

2017-02-13T16:31:48+00:00

sss_cert_derb64_to_ldap_filter: add sss_certmap support

2017-02-13T16:31:48+00:00

LDAP: always store the certificate from the request

2017-02-13T16:31:48+00:00

sdap_get_users_send(): new argument extra_attrs

2017-02-13T16:31:48+00:00

extra_attrs can be a list of sysdb_attrs which are not available on the
server side but should be store with the cached user entry.

AD: Use ad_domain to match forest root domain, not the configured domain from sssd.conf

2017-02-08T10:17:51+00:00

If the sssd.conf domain name was different from the joined domain name,
but sssd was joined to the forest root, the AD subdomains code considered
sssd joined to a non-root domain and tried to discover the forest root.

This could be reproduced by joining sssd to a domain, for example
win.trust.test but calling the sssd.conf domain otherwise, for example:
[domain/addomain]
ad_domain = win.trust.test

This is/was a frequent use-case in the RHEL world, where authconfig
often names the sssd.conf domain 'default'.

Without the patch, the trusted domains were not detected.

Reviewed-by: Pavel Březina

SYSDB: Removing of sysdb_try_to_find_expected_dn()

2017-02-08T09:53:19+00:00

Currently in order to match multiple LDAP search results we
use two different functions - we have sysdb_try_to_find_expected_dn()
but also sdap_object_in_domain().

This patch removes sysdb_try_to_find_expected_dn() and add new
sdap_search_initgr_user_in_batch() based on sdap_object_in_domain().
This function covers necessary logic.

Resolves:
https://fedorahosted.org/sssd/ticket/3230

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek

LDAP: Better logging message

2017-02-08T09:53:11+00:00

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek

SUDO: Add skip_entry boolean to sudo conversions

2017-02-07T16:27:21+00:00

Add boolean to convert_attributes function and pass boolean as argument
to sudo conversion functions to add logic for skipping unexpected
entries like replication conflicts.

Resolves:
https://fedorahosted.org/sssd/ticket/3288

Reviewed-by: Jakub Hrozek

FAILOVER: Improve port status log messages

2017-02-06T15:17:29+00:00

It should be more clear to administrators that when SSSD internal
port status is set as PORT_NOT_WORKING, this does not directly relate
to an assumed network port-related issue.

Reviewed-by: Jakub Hrozek

ldap_child: Fix use after free

2017-02-01T13:42:56+00:00

In case on any krb5 related error, we tried to send string
interpretation of krb5 error tb parrent in prepare_response.

However, we cannot use global krb5 context (krb5_error_ctx)
because the context is every time released in done section of
ldap_child_get_tgt_sync.

This patch rather return duplicated string to prevent use after free.

Backtrace:
 #0  __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
 100     ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory.

 Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)):
 #0  __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
 No locals.
 #1  0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm",
                                        code=-1765328230,
                                        err_fmt=) at kerrs.c:152
        buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10,
               space = 128, len = 0}
        p = 
        s = 0xdededededededede 
 #2  krb5_get_error_message (ctx=,
                             code=code@entry=-1765328230) at kerrs.c:184
        std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm"
 #3  0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=,
                                                       ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424
 No locals.
 #4  0x00007fc96cb1fbb0 in prepare_response (rsp=,
                                             kerr=-1765328230, expire_time=0,
                                             ccname=0x0,
                                             mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553
        ret = 
        r = 0x7fc96d1cd8b0
        krb5_msg = 0x0

Reviewed-by: Fabiano Fidêncio