Fix minor spelling mistakes in tests/cmocka/* Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: do not use objectClass for users and groups The majority of the object in the SSSD cache are users and groups. If there are many user and groups in the cache the index objects of the objectclass attributes 'user' and 'group' become large because the must hold references to all objects of those object classes. As a result the management of these index objects becomes costly because they must be parsed and split apart quite often. Additionally they are mostly useless because user and groups are lookup up by more specific attributes in general. Only when enumerating all user or groups this kind of index might be useful. There are two way of removing this kind of index from the user and group objects. Either by removing objectClass from the list of indexes and add a new attribute to all other type of object we want and index for. Or by replacing objectClass with a different attribute for the user and group objects. After some testing I think the latter one is the more reliable one and implemented it in this patch. Related to https://pagure.io/SSSD/sssd/issue/3503 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

UTIL: Remove fcntl.h from util/util.h fcntl.h is not used directly by util/util.h. The header file fcntl.h must be included in 49 files and after removing it from util.h it had to be added only to 7 missing file which were using either directly syscall fcntl or syscall open. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

SUBDOMAINS: Allow use_fully_qualified_names for subdomains Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

sysdb: make subdomain calls aware of upn_suffixes sysdb_subdomain_store() and sysdb_update_subdomains() can now update upn_suffixes as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

test_ipa_subdom_server: Workaround for slow krb5 + SELinux There is an overhead caused by SELinux after fixing memory leak in krb5. https://bugzilla.redhat.com/show_bug.cgi?id=1311287. The overhead is mainly visible with valgrind and moreover it causes failures due to timeouts. sh$ time libtool --mode=execute ./test_ipa_subdom_server enabled/permissive SELinux real 0m7.976s user 0m6.680s sys 0m0.189s disabled SELinux real 0m2.111s user 0m0.071s sys 0m0.043s valgrind + enabled/permissive SELinux real 2m7.310s user 2m17.080s sys 0m0.786s valgrind + disabled SELinux real 0m5.510s user 0m3.396s sys 0m0.309s Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

test_ipa_subdomains_server: Use unique dorectory for keytabs Resolves: https://fedorahosted.org/sssd/ticket/2694 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

tests: Use unique name for TEST_PATH We had a cases in patch where two tests were using the same TEST_PATH and therefore they were stepping each other to the same files which caused failures. These failures are not easy to reproduce. This patch uses macro BASE_FILE_STEM for unique name. It should prevent copy&paste problem resulting to intermittent failures. @see also https://www.gnu.org/software/make/manual/html_node/Automatic-Variables.html Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

IPA: Always re-fetch the keytab from the IPA server Even if a keytab for one-way trust exists, re-fetch the keytab again and try to use it. Fall back to the previous one if it exists. This is in order to allow the admin to re-establish the trust keytabs with a simple sssd restart. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

tests: Reduce duplication with new function test_ev_done Reviewed-by: Sumit Bose <sbose@redhat.com>

test_ipa_subdomains_server: Fix build with --coverage It seems that gcc did some optimization and used execve instead of execle when the code was instrumented for coverage analysis. So the exec* function was not wrapped and it tried to call real binary ipa-getkeytab Reviewed-by: Michal Židek <mzidek@redhat.com>

test_ipa_subdom_server: Add missing assert Reviewed-by: Michal Židek <mzidek@redhat.com>

test_ipa_subdomains_server: Run clean-up after success Reviewed-by: Michal Židek <mzidek@redhat.com>

IPA: Utility function for setting up one-way trust context Related: https://fedorahosted.org/sssd/ticket/2638 Reviewed-by: Sumit Bose <sbose@redhat.com>

IPA: Fetch keytab for 1way trusts Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>

TESTS: Add unit test for the subdomain_server.c module Reviewed-by: Sumit Bose <sbose@redhat.com>