sssd.git/src/responder/common/cache_req, branch certificate_mapping

cache_req: always go to dp first when looking up host

2017-02-08T20:25:48+00:00

We need to always lookup host in DP first to update host certificates so
we are consinstent during ssh authentication.

Reviewed-by: Lukáš Slebodník

cache_req: add host by name search

2017-02-08T10:05:46+00:00

Reviewed-by: Jakub Hrozek

cache_req: move dp request to plugin

2017-02-08T10:05:42+00:00

This will allow to use cache req even for object that do not use
account request such as hosts.

Reviewed-by: Jakub Hrozek

cache_req: add api to create ldb_result from message

2017-02-08T10:05:38+00:00

Some sysdb methods doesn't return ldb_result as output but return
ldb_message instead. Changing sysdb to be consistent is too big
so I added this helper function that will wrap resulting message
into ldb_result.

Reviewed-by: Jakub Hrozek

cache_req: search user by name with attrs

2017-02-08T10:05:33+00:00

Sometime is is desirable to aquire more attribute from user object
than SYSDB_PW_ATTRS set. such as user's public key.

Reviewed-by: Jakub Hrozek

cache_req: add ability to not use default domain suffix

2017-02-08T10:05:29+00:00

This will be used in the next plugin "host by name" where
it is not desirable to use default domain suffix if set.

Reviewed-by: Jakub Hrozek

sss_parse_inp_send: provide default_domain as parameter

2017-02-08T10:05:23+00:00

It is not always desirable to consider default_domain from configuration
but expect none instead. For example when we search host certificates.

This is currently not used in this patch since host lookups parse
name directly with sss_parse_name but it will be used in the next
patch.

Reviewed-by: Jakub Hrozek

nss: rewrite nss responder so it uses cache_req

2016-12-19T22:28:55+00:00

Given the size of the current nss responder it was quite impossible
to simply switch into using the cache_req interface, especially
because most of the code was duplication of cache lookups.

This patch completely rewrites the responder from scratch. The amount
of code was reduced to less than a half lines of code with no code duplication,
better documentation and better maintainability and readability.

All functionality should be intact.

*Code organization*
All protocol (parsing input message and send a reply) is placed
in nss_protocol.c. Functions that deals with creating a reply
packet are placed into their specific nss_protocol_$object.c files.

All supported commands are placed into nss_cmd.c. Functions that
deals with cache req are in nss_get_object.c and nss_enum.c.

*Code flow for non-enumeration*
An nss_getby_$input-type is called for each non-enumeration command.
This function parses the input message, creates a cache_req_data
structure and issues nss_get_object that calls cache_req. When
this request is done nss_getby_done make sure a reply is sent to
the client.

*Comments on enumeration*
I made some effort to make sure enumeration shares the same code
for users, groups, services and netgroups. Netgroups now uses
nss negative cache instead of implementing its own.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník

cache_req: do not set ncache if dp request fails

2016-12-19T22:24:36+00:00

We will only remember entry in the negative cache if the data provider
requests succeeded because only then we can be sure that the entry
does not exist.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník

cache_req: allow to search subdomains without fqn

2016-12-19T22:24:32+00:00

This patch allows plugins that do not require name qualification
on multi-domain search to perform lookup also in subdomains.

Resolves:
https://fedorahosted.org/sssd/ticket/3151

Reviewed-by: Lukáš Slebodník