ipa: implement method to refresh HBAC rules Related: https://pagure.io/SSSD/sssd/issue/2840 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

IPA_ACCESS: Make hbac_get_cache_rules() more generic This method can also be reused in the future for new backend modules. In order to make it more generic, let's just move it to ipa_rules_common.[ch], rename it to ipa_common_get_cached_rules() and make the rule, subtree name and the attributes to be searched new parameters of this method. In order to not be declaring the enourmous list of attributes HBAC uses when calling this method, a new hbac_get_attrs_to_get_cached_rules() method has been introduced. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

IPA_ACCESS: Remove not used attribute struct time_rules_ctx * is not used anywhere in in the access handler, thus there's no need to store it. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

DP: Switch to new interface Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

IPA: Remove the ipa_hbac_treat_deny_as option https://fedorahosted.org/sssd/ticket/2603 Since deny rules are no longer supported on the server, the client should no longer support them either. Remove the option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Move hbac_ctx_is_offline()

Remove hbac_ctx_sdap_id_[ctx|op]()

Remove hbac_ctx_ev()

Remove hbac_ctx_be()

Remove hbac_ctx_sysdb()

Remove sysdb argument from hbac_get_cached_rules()

Remove sysdb as a be request structure member The sysdb context is already available through the 'domain' context.

Add domain argument to sysdb_search_custom() Also changes sysdb_search_custom_by_name()

Modify hbac_get_cached_rules() so it can be used outside of HBAC code

Utilize sysdb context within be_req in HBAC

IPA: Check nsAccountLock during PAM_ACCT_MGMT https://fedorahosted.org/sssd/ticket/1227

IPA hosts refactoring

Delete unused structure in IPA access code

Separate the host-retrieval code from IPA HBAC to common IPA code

Implemented support for multiple search bases in HBAC rules and services

Support multiple search bases in HBAC

Add ipa_hbac_refresh option This option describes the time between refreshes of the HBAC rules on the IPA server.

Add new HBAC lookup and evaluation routines

Remove old HBAC implementation

Add ipa_hbac_search_base config option

Handle host objects like other objects

Use new LDAP connection framework in IPA access backend.

Remove service groups Because the memberOf attribute is now set for the service objects we do not need to fetch the service groups separately anymore.

Use new schema for HBAC service checks

Fix LDAP search paths for IPA HBAC - use domain_to_basedn() to construct LDAP search paths for IPA HBAC - move domain_to_basedn() to a separate file to simplify the build of a test

Rename server/ directory to src/ Also update BUILD.txt