sssd.git/src/responder, branch memberof_default_view

SSH-CERT: always initialize cert_verify_opts

2016-07-07T16:13:27+00:00

Currently cert_verify_opts is only initialized when there is an option
in the config file. This might cause issues later when the struct is
accessed. Since parse_cert_verify_opts() can already handle an empty
option the additional check is not needed at all.

Reviewed-by: Jakub Hrozek

Fix packet size calculation in sss_packet_new

2016-07-07T10:52:01+00:00

Use division instead of modulo while rounding the created packet size up
to a multiple of SSSSRV_PACKET_MEM_SIZE in sss_packet_new. This fixes
potentially packet buffer overflows with certain body sizes.

Reviewed-by: Pavel Březina

fix some 'might be used uninitialized' warnings

2016-07-07T08:30:32+00:00

Reviewed-by: Jakub Hrozek

SUDO: Add more low-level tracing messages

2016-07-07T08:30:29+00:00

Just adds more debugging messages that are handy in seeing what gets
passed between sudo responder and client.

Reviewed-by: Sumit Bose

sudo: solve problems with fully qualified names

2016-07-07T08:30:26+00:00

sudo expects the same name in sudo rule as login name. Therefore
if fully qualified name is used or even enforced by setting
use_fully_qualified_names to true or by forcing default domain
with default_domain_suffix sssd is able to correctly return the
rules but sudo can't match the user with contect of sudoUser
attribute since it is not qualified.

This patch changes the rules on the fly to avoid using names at all.
We do this in two steps:
1. We fetch all rules that match current user name, id or groups and
   replace sudoUser attribute with sudoUser: #uid.
2. We fetch complementry rules that contain netgroups since it is
   expected we don't have infromation about existing netgroups in
   cache, sudo still needs to evaluate it for us if needed.

This patch also remove test for sysdb_get_sudo_filter since it wasn't
sufficient anyway and I did not rewrite it since I don't thing it
is a good thing to have filter tests that depends on exact filter
order.

Resolves:
https://fedorahosted.org/sssd/ticket/2919

Reviewed-by: Jakub Hrozek

SYSDB: Remove useless parameter from sysdb_init()

2016-07-07T08:29:49+00:00

The function sysdb_init() is never used to allow upgrade, so the
allow_upgrade parameter was pointless.

Reviewed-by: Sumit Bose

IFP: Amend the InfoPipe responder for fqdns

2016-07-07T08:29:30+00:00

Parses the internal sysdb names and puts them on the bus using the
sss_output_name() helper. Previously, the raw sysdb names were used.

Reviewed-by: Sumit Bose

RESPONDERS: Return the sysdb name from cache_req

2016-07-07T08:29:17+00:00

name.name is the input name. Since cache_req is an internal interface,
we need to return the sysdb name instead.

Reviewed-by: Sumit Bose

SSH: Use a qualified name for user searches in the SSH responder

2016-07-07T08:26:26+00:00

The name is converted from whatever we receive on input to the internal
format before processing the data further.

Reviewed-by: Sumit Bose

PAM: Use qualified names internally in the PAM responder

2016-07-07T08:26:20+00:00

The name is converted from whatever we receive on input to the internal
format before processing the data further.

Reviewed-by: Sumit Bose