sssd.git/src, branch jhrozek_sysdb_fqdn

expand name in ipa_add_ad_memberships_get_next()

2016-07-06T18:45:39+00:00

PAM/KRB5: optional otp and password prompting

2016-07-06T18:28:11+00:00

Depending on the available Kerberos pre-authentication methods pam_sss
will prompt the user for a password, 2 authentication factors or both.

Resolves https://fedorahosted.org/sssd/ticket/2988

LDAP: fix typo

2016-07-06T15:40:23+00:00

fix some 'might be used uninitialized' warnings

2016-07-06T15:40:23+00:00

Reviewed-by: Jakub Hrozek

SUDO: Add more low-level tracing messages

2016-07-06T15:40:23+00:00

Just adds more debugging messages that are handy in seeing what gets
passed between sudo responder and client.

sudo: solve problems with fully qualified names

2016-07-06T15:40:23+00:00

sudo expects the same name in sudo rule as login name. Therefore
if fully qualified name is used or even enforced by setting
use_fully_qualified_names to true or by forcing default domain
with default_domain_suffix sssd is able to correctly return the
rules but sudo can't match the user with contect of sudoUser
attribute since it is not qualified.

This patch changes the rules on the fly to avoid using names at all.
We do this in two steps:
1. We fetch all rules that match current user name, id or groups and
   replace sudoUser attribute with sudoUser: #uid.
2. We fetch complementry rules that contain netgroups since it is
   expected we don't have infromation about existing netgroups in
   cache, sudo still needs to evaluate it for us if needed.

This patch also remove test for sysdb_get_sudo_filter since it wasn't
sufficient anyway and I did not rewrite it since I don't thing it
is a good thing to have filter tests that depends on exact filter
order.

Resolves:
https://fedorahosted.org/sssd/ticket/2919

Reviewed-by: Jakub Hrozek

TOOLS: Add the upgrade-cache command

2016-07-06T15:40:22+00:00

Allows to upgrade the cache using the sssctl tool, which might be useful
e.g. in RPM %post scripts.

TOOLS: Some tools command might not need initialization to succeed

2016-07-06T15:40:22+00:00

Since we want to use the sssctl tool during upgrade, we need to amend
the tools initialization code to not error out if sysdb can't be
instantiated, but rather return errno and let the tool handle the error.

Each tool command now has a 'allowed errno' the command is able to
handle. In this patch iteration, only a single errno can be handled and
only the upgrade command is able to do so.

SYSDB: qualify_attr: create new attribute only once

2016-07-06T15:40:22+00:00

Reviewed-by: Jakub Hrozek

SYSDB: Upgrade sysdb to use qualified names for users and groups, sudo rules and override objects

2016-07-06T15:40:22+00:00

Runs a sysdb upgrade that changes objects that represent users, groups,
sudo rules and overrides to the new schema, which uses the fully
qualified names.