sssd.git/src/responder/sudo, branch ad_domain_local_groups

DP: Remove old data provider interface

2016-08-16T12:54:50+00:00

Reverse data provider interface is moved to a better location in
NSS responder. All responders now can have an sbus interface
defined per data provider connection. The unused old data provider
interface is removed.

Reviewed-by: Lukáš Slebodník

fix some 'might be used uninitialized' warnings

2016-07-07T08:30:32+00:00

Reviewed-by: Jakub Hrozek

SUDO: Add more low-level tracing messages

2016-07-07T08:30:29+00:00

Just adds more debugging messages that are handy in seeing what gets
passed between sudo responder and client.

Reviewed-by: Sumit Bose

sudo: solve problems with fully qualified names

2016-07-07T08:30:26+00:00

sudo expects the same name in sudo rule as login name. Therefore
if fully qualified name is used or even enforced by setting
use_fully_qualified_names to true or by forcing default domain
with default_domain_suffix sssd is able to correctly return the
rules but sudo can't match the user with contect of sudoUser
attribute since it is not qualified.

This patch changes the rules on the fly to avoid using names at all.
We do this in two steps:
1. We fetch all rules that match current user name, id or groups and
   replace sudoUser attribute with sudoUser: #uid.
2. We fetch complementry rules that contain netgroups since it is
   expected we don't have infromation about existing netgroups in
   cache, sudo still needs to evaluate it for us if needed.

This patch also remove test for sysdb_get_sudo_filter since it wasn't
sufficient anyway and I did not rewrite it since I don't thing it
is a good thing to have filter tests that depends on exact filter
order.

Resolves:
https://fedorahosted.org/sssd/ticket/2919

Reviewed-by: Jakub Hrozek

Responders: Make the client context more generic

2016-06-29T19:46:03+00:00

This is useufl to allow reusing the responder code with other protocols.
Store protocol data and responder state data behind opaque pointers and
use tallog_get_type to check they are of the right type.

This also allows to store per responder state_ctx so that, for example,
the autofs responder does not have to carry useless variables used only
by the nss responder.

Resolves:
https://fedorahosted.org/sssd/ticket/2918

Reviewed-by: Jakub Hrozek

RESPONDER: New interface for client registration

2016-06-20T12:48:47+00:00

This is just a beginning of new responder interface to data provider
and it is just to make the client registration work. It needs further
improvement.

The idea is to take the existing interface and make it work better
with further extensions of data provider. The current interface has
several disadvantages such as it is originally build only for
account requests and doesn't take different set of output parameters.
It also doesn't work well with integration into tevent-made responders.

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

DP: Switch to new interface

2016-06-20T12:48:47+00:00

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

Remove braces from DEBUG statements

2016-06-18T16:14:03+00:00

Reviewed-by: Lukáš Slebodník

RESPONDER: Removing ncache from sudo_ctx

2016-05-11T11:43:24+00:00

This patch switches ncache from sudo_ctx to resp_ctx.

Reviewed-by: Pavel Březina

RESPONDER: Removing neg_timeout from sudo resp.

2016-05-11T10:52:01+00:00

Timout of negative cache is handled by context of negative cache. So
this parameter is not needed now.

Resolves:
https://fedorahosted.org/sssd/ticket/2137

Reviewed-by: Pavel Březina