FILES: Skip files that are not created yet In order to avoid complex ordering logic, even if one file is updated, we flush all the entries. In theory, we could only flush the individual file and all the files preceding it, but it's safer to just create a complete mirror every time. And this can be problematic if one of the files we try to update is not created yet during the update. This can happen e.g. when a file is not created during early boot. To solve this, try to be very defensive and always flush the whole database, ignore ENOENT errors, but abort on all other errors. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Add a test for the multiple files feature Adds an integration test for the new feature. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Fix minor spelling mistakes in tests/* Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

test_files_provider: Regression test for implicit_files + proxy Related to: https://pagure.io/SSSD/sssd/issue/3590 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

confdb: Fix starting of implicit files domain We did not start implicit_files domain when sssd configuration contains files domain which was disabled. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

TESTS: Add files provider tests that request a user and group by ID Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

INTG/FILES_PROVIDER: Test user and group override User and group override have been failing when using it with files provider. This test helps us to avoid such regression in the future. As mentioned in the comment added to the test's code, there's an issue in nss_wrapper [0] and nss_wrapper always looks into the files first before using the NSS module, causing a test failure in case the fully-qualified name is not used when looking up for the original (not overriden) user and group. Related: https://pagure.io/SSSD/sssd/issue/3391 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>

INTG: Do not use configure time option enable-files-domain The implicit_files was started with each test even though was not required. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

minor typo fixes Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>

CONFDB: If no configuration file is provided, create a fallback configuration This functionality is only enabled in case SSSD is configured with with --enable-files-domain. If not, the behaviour is as it used to -- SSSD returns an error, instructing the admin to create a configuration file. If the option is enabled, a very minimal confdb that only enables the NSS responder is created. The confdb later adds the implicit files domain. Resolves: https://pagure.io/SSSD/sssd/issue/2229 Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Test the files domain autoconfiguration Adds tests that exercise the implicit files domain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

FILES: Fix reallocation logic There were two bugs in the files provider reallocation logic: 1) the reallocated array was not NULL-terminated properly 2) talloc_get_size was used in place of talloc_array_length This bug could have resulted in a crash when the passwd or groups file contained more than FILES_REALLOC_CHUNK entries. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Add files provider integration tests Implements integration tests for the files provider. In order to change entries in the nss-wrapped passwd and group files, this commit also implements a helper module that creates a new passwd and group file and moves it in place of the nss-wrapped files. We move the files instead of modifying them in-place in order to trigger similar inotify notifications as shadow-utils would. The unit test uses sleep on several places. This is suboptimal, but during testing especially on slow machines, it became apparent that sometimes the inotify message arrives later than the test would check for the changed entries. Therefore, the check would query the NSS responder even before the sss-files domain was invalidated. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>