sssd.git/src/responder/common, branch certificate_mapping

cache_req: always go to dp first when looking up host

2017-02-08T20:25:48+00:00

We need to always lookup host in DP first to update host certificates so
we are consinstent during ssh authentication.

Reviewed-by: Lukáš Slebodník

cache_req: add host by name search

2017-02-08T10:05:46+00:00

Reviewed-by: Jakub Hrozek

cache_req: move dp request to plugin

2017-02-08T10:05:42+00:00

This will allow to use cache req even for object that do not use
account request such as hosts.

Reviewed-by: Jakub Hrozek

cache_req: add api to create ldb_result from message

2017-02-08T10:05:38+00:00

Some sysdb methods doesn't return ldb_result as output but return
ldb_message instead. Changing sysdb to be consistent is too big
so I added this helper function that will wrap resulting message
into ldb_result.

Reviewed-by: Jakub Hrozek

cache_req: search user by name with attrs

2017-02-08T10:05:33+00:00

Sometime is is desirable to aquire more attribute from user object
than SYSDB_PW_ATTRS set. such as user's public key.

Reviewed-by: Jakub Hrozek

cache_req: add ability to not use default domain suffix

2017-02-08T10:05:29+00:00

This will be used in the next plugin "host by name" where
it is not desirable to use default domain suffix if set.

Reviewed-by: Jakub Hrozek

sss_parse_inp_send: provide default_domain as parameter

2017-02-08T10:05:23+00:00

It is not always desirable to consider default_domain from configuration
but expect none instead. For example when we search host certificates.

This is currently not used in this patch since host lookups parse
name directly with sss_parse_name but it will be used in the next
patch.

Reviewed-by: Jakub Hrozek

Suppres implicit-fallthrough from gcc 7

2017-02-01T13:10:44+00:00

Some kind of comments are recognized by gcc7 but they are ignored with
-Wimplicit-fallthrough=5 and only attributes disable the warning.

Reviewed-by: Fabiano Fidêncio

RESPONDER: Change how client timeout is calculated

2017-01-23T17:46:37+00:00

Taking Pavel Březina's suggestion, let's avoid always re-creating the
idle timer and go for a simpler and not so precise approach where we
store the time of the last operation done and then have a simple
periodic timer that fires each "client_idle_time/2" and there it checks
whether the "current time - last request time > client_idle_time".

As said, it won't be as precise as the way done currently but it will
save us lots of memory operations.

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idle

2017-01-23T17:46:37+00:00

This commit introduces a new option for the responders called
responder_idle_timeout, which specifies the number of seconds that the
responder process can be up without being used. The default value is
300 seconds (5 minutes) and can be configured per responder, being 60
seconds the minimum acceptable value.

Is important to note that setting "responder_idle_timeout = 0" disables
the responder timeout, which makes sense for the responders that always
will be running.

The shutdown timeout is activated per responder in case the responder
has been {dbus,socket}-activated. In case of any commnunication with the
responder the timeout is reset thereby ensuring we won't shutdown a
responder that is not idle.

Setting the responder's last request time is done slightly differently
for socket-activated and dbus-activated responders. In both cases it's
updated in any internal communication in sbus_message_handler(), but
for the socket-activated responders it's also updated when the
responder's socket is used.

Currently it works properly with all responders but the secrets one,
which has a different logic and must be treated separately in case some
change is required there.

Is worth to mention that this commit does not affect the responders
explicitly configured in the "services" line of sssd.conf.

Related:
https://fedorahosted.org/sssd/ticket/3245

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník