SYSDB: sysdb_add_incomplete_group now returns EEXIST with a duplicate GID Related: https://pagure.io/SSSD/sssd/issue/2653 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

Fix minor spelling mistakes in tests/* Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains If a group was being looked by using sysdb_search_by_name() in a MPG domain, the code would search only for group objects -- but in a MPG domain, there may be none, the groups are typically inferred from a user object. This could have caused issues e.g. for IPA code with the following sequence: getent group aduser@windows.domain getent passwd aduser@windows.domain The former would fail to add the fallback subdomain homedir and the latter would then return a user entry without a homedir, with libc falling back to the "/" homedir. Resolves: https://pagure.io/SSSD/sssd/issue/3615 Reviewed-by: Pavel Březina <pbrezina@redhat.com>

sysdb-test: Fix warning may be used uninitialized It cannot be uninitialized because we will have some messages. 2243 2244 fail_unless(data->msgs_count == 10, 2245 "wrong number of results, found [%d] expected [10]", 2246 data->msgs_count); and it cannot be NULL 2257 for (j = 0; j < data->msgs_count; j++) { 2258 uid_str = talloc_asprintf(data, "%d", 27010 + j); 2259 fail_unless(uid_str != NULL, "talloc_asprintf failed."); src/tests/sysdb-tests.c: In function ‘test_sysdb_search_all_users’: src/tests/sysdb-tests.c:2266:9: error: ‘uid_str’ may be used uninitialized in this function [-Werror=maybe-uninitialized] fail_unless(strncmp(uid_str, ^~~~~~~~~~~ Reviewed-by: Michal Židek <mzidek@redhat.com>

sysdb: do not use objectClass for users and groups The majority of the object in the SSSD cache are users and groups. If there are many user and groups in the cache the index objects of the objectclass attributes 'user' and 'group' become large because the must hold references to all objects of those object classes. As a result the management of these index objects becomes costly because they must be parsed and split apart quite often. Additionally they are mostly useless because user and groups are lookup up by more specific attributes in general. Only when enumerating all user or groups this kind of index might be useful. There are two way of removing this kind of index from the user and group objects. Either by removing objectClass from the list of indexes and add a new attribute to all other type of object we want and index for. Or by replacing objectClass with a different attribute for the user and group objects. After some testing I think the latter one is the more reliable one and implemented it in this patch. Related to https://pagure.io/SSSD/sssd/issue/3503 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb: sanitize search filter input This patch sanitizes the input for sysdb searches by UPN/email, SID and UUID. This security issue was assigned CVE-2017-12173 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

TESTS: Add tests for sysdb_search_{users,groups}_by_orig_dn() Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

UTIL: Remove ctype.h from util/util.h ctype.h is not used directly by util/util.h. The header file ctype.h must be included in 32 files and after removing it from util.h it had to be added only to 8 missing files Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

SYSDB: Allow storing non-POSIX users Related to: https://pagure.io/SSSD/sssd/issue/3310 We already do the same for groups. If the user does not have UID number set but does have the POSIX: false attribute set, then we save the user with zero UID and the non-POSIX flag. Reviewed-by: Sumit Bose <sbose@redhat.com>

SUBDOMAINS: Allow use_fully_qualified_names for subdomains Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

LDAP: always store the certificate from the request Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: add sysdb_attrs_copy() Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: allow multiple results for searches by certificate Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SYSDB: When searching for UPNs, search either the whole DB or only the given domain The search-by-UPN functions always searched for the whole domain. In some cases, the caller depends on the result coming from the domain specified by the 'domain' parameter. This is the case in the cache_req code at least. Even though it should be safe to just switch to always searching the whole domain, in order to allow us to examine the code carefully and test each codepath, let's introduce a boolean option to the search functions. Currently it defaults to false in all codepaths and as we test the individual ones, we can flip the option to true until we finally remove the option altogether. Reviewed-by: Sumit Bose <sbose@redhat.com>

UTIL: Store UPN suffixes when creating a new subdomain We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>

sysdb-tests: Add test for sysdb_search_object_by_name Reviewed-by: Pavel Březina <pbrezina@redhat.com>

sysdb-tests: Add test for sysdb_search_object_by_id Reviewed-by: Pavel Březina <pbrezina@redhat.com>

sysdb: make subdomain calls aware of upn_suffixes sysdb_subdomain_store() and sysdb_update_subdomains() can now update upn_suffixes as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb-tests: Fix cast from pointer to integer src/tests/sysdb-tests.c: In function 'test_sysdb_memberof_close_loop': src/tests/sysdb-tests.c:2740:5: warning: passing argument 1 of '_ck_assert_msg' makes integer from pointer without a cast [enabled by default] fail_unless(data->attrlist[0], "talloc_array failed."); ^ In file included from src/tests/sysdb-tests.c:23:0: /usr/include/check.h:237:16: note: expected 'int' but argument is of type 'const char *' void CK_EXPORT _ck_assert_msg (int result, const char *file, ^ Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Fix sysdb tests to work with the new format The sysdb tests now user the qualified name to store users and groups. To avoid the sysdb interface being tied too tightly to our specific format, all names are constructed using a function, not hardcoded. Just swapping the functions that create or parse the names for a different format should not make the test fail. Reviewed-by: Sumit Bose <sbose@redhat.com>

TESTS: First pass on converting the sysdb tests to the fqname format Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sss_tools: create confdb if not exist So tools (especially sssctl) may be run even when databases where removed. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

tests: Check NULL context in sysdb-tests when removing group members This is done to make sure the memberof module does not leak memory. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

sysdb-tests: Fix warning - incompatible pointer type Reviewed-by: Sumit Bose <sbose@redhat.com>

IPA: fix override with the same name If the user name of a AD user is overridden with the name itself in an IPA override object SSSD adds this name twice to the alias list causing an ldb error when trying to write the user object to the cache. As a result the user is not available. This patch makes sure that there are no duplicated alias names. Resolves https://fedorahosted.org/sssd/ticket/2874 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb-tests: Use valid base64 encoded certificate for search sh$ printf "ABC" | base64 -d base64: invalid input Reviewed-by: Michal Židek <mzidek@redhat.com>

tests: Use unique name for TEST_PATH We had a cases in patch where two tests were using the same TEST_PATH and therefore they were stepping each other to the same files which caused failures. These failures are not easy to reproduce. This patch uses macro BASE_FILE_STEM for unique name. It should prevent copy&paste problem resulting to intermittent failures. @see also https://www.gnu.org/software/make/manual/html_node/Automatic-Variables.html Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SYSDB: Add function to expire entry Ticket: https://fedorahosted.org/sssd/ticket/2676 Added function to expire entry in sysdb using its DN. Reviewed-by: Pavel Reichl <preichl@redhat.com>

Fix minor typos Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: add sysdb_search_user_by_cert() and sysdb_search_object_by_cert() Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Add a test for sysdb_subdomains.c The sysdb_subdomains.c module should have its own sysdb test, not share the generic sysdb one. Reviewed-by: Sumit Bose <sbose@redhat.com>

SYSDB: Store trust direction for subdomains We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>

TESTS: Use the right testcase tc_autofs, not tc_subdomains.. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: add sysdb_cache_password_ex() Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

IPA: allow initgroups by UUID for FreeIPA users If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

IPA: allow initgroups by SID for AD users If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb-tests: test return value before output arguments Output arguments needn't be initialized if function failed. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb-tests: Add missing assertions The return valuee of functions test_remove_group_member sysdb_attrs_add_time_t were ignored and therefore this part of code was not tested. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP: Add UUID when saving incomplete groups Related to: https://fedorahosted.org/sssd/ticket/2571 Reviewed-by: Sumit Bose <sbose@redhat.com>

TESTS: Cover sysdb_gpo.c with unit tests Untested code is risky to change. Reviewed-by: Pavel Reichl <preichl@redhat.com>

TESTS: typo in 'assert message' Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SYSDB: sysdb_search_object_by_sid returns ENOENT sysdb_search_object_by_sid returns ENOENT if no results are found. Part od solution for: https://fedorahosted.org/sssd/ticket/1991 Fixes: https://fedorahosted.org/sssd/ticket/2520 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

TESTS: sysdb_delete_by_sid() test return value Check that return value of sysdb_delete_by_sid() is not changed as called SYSDB functions have changed the return value. Part of patches for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SYSDB: sysdb_get_bool() return ENOENT & unit tests sysdb_get_bool() return ENOENT if no result is found. Unit test for sysdb_get_bool() & sysdb_set_bool() was added. This patch also fixes ldap_setup_enumeration() to handle ENOENT returned by sysdb_has_enumerated(). Resolves: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: add sysdb_search_object_by_uuid() Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SYSDB: sysdb_idmap_get_mappings returns ENOENT sysdb_idmap_get_mappings returns ENOENT if no results were found. Part od solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sysdb: add sysdb_attrs_add_val_safe() and sysdb_attrs_add_string_safe() sysdb_attrs_add_val_safe() works like sysdb_attrs_add_val() but checks if the attribute value to add already exists. In this case the value list is not changed. This is useful if values are added from different sources at different times to avoid LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS errors from ldb_modify() later on. sysdb_attrs_add_string_safe() does the same for string arguments Reviewed-by: Pavel Březina <pbrezina@redhat.com>

tests: add test for sysdb_get_user_attr with subdomain user Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

SYSDB: move sysdb_get_real_name() from sysdb.c to sysdb_search.c The sysdb.c should be reserved for utility and setup functions. Search functions belong to sysdb_search.c Keeping functions in specialized modules helps to maintain nice dependencies and in overall makes unit testing easier. Moreover, the function was not unit tested, which needed fixing. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

tests: Add a test for storing custom attrs with automatic ID Reviewed-by: Daniel Gollub <dgollub@brocade.com>

TESTS: Add a case-insensitive group search sysdb test A recent fix enabled searching for groups by name in a case-insensitive domain. This patch adds a unit test to check that behaviour. Reviewed-by: Sumit Bose <sbose@redhat.com>

SYSDB: SSS_LDB_SEARCH - macro around ldb_search This patch amends previous patch 5153e8b9793dea1e212ca08af0f77ea1d023cbb7. Macro SSS_LDB_SEARCH is used instead of using fuction sss_ldb_search as a wrapper around ldb_search which could lead to premature expansion of variadic parameters. Part of solution for: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

TESTS: Add unit tests for the GPO interface Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

TOOLS: Always debug to stderr https://fedorahosted.org/sssd/ticket/2348 Programs that are supposed to only be executed on the foreground should log to stderr automatically. Reviewed-by: Michal Židek <mzidek@redhat.com>

TESTS: sysdb_getnetgr - return ENOENT Resolves: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

TESTS: add tests for sss_ldb_search Resolves: https://fedorahosted.org/sssd/ticket/1991 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

sysdb: add sysdb_search_user_by_upn() with tests Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

TESTS: sysdb_search_return_ENOENT - check mem leaks Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>

TEST: simple_access & sysdb tests - cleanup Before running tests do cleanup. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

TEST: unused variable Remove unused variable causing warning. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

tests: Add test for confdb_list_all_domain_names Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TEST: Test empty results from functions sysdb_search_* Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

SYSDB: return SYSDB_NAME from sysdb_initgroups For the GetGroupsList function it would be handy to get the user names as well with a single sysdb_initgroups() call. This patch adds SYSDB_NAME to the default attribute list. Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Update DEBUG* invocations to use new levels Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

Make DEBUG macro invocations variadic Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

DB: Add sss_ldb_el_to_string_list

Add sysdb_attrs_add_lc_name_alias

SYSDB: Sanitize filter before removing ghost attrs sysdb_add_user fails with EIO if enumeration is disabled and user contains backslashes. We try to remove ghost attributes from groups with disabled enumeration, but unsanitized filter is used to find ghost attributes "(|(ghost=usr\\\\002)" and ldb cannot parse this filter. Resolves: https://fedorahosted.org/sssd/ticket/2163

SYSDB: Sanitize filter before sysdb_search_groups sysdb_delete_user fails with EIO if user does not exist and contains backslashes. ldb could not parse filter (&(objectclass=group)(ghost=usr\\\\001)), because ghost value was not sanitized Resolves: https://fedorahosted.org/sssd/ticket/2163

SYSDB: Drop redundant sysdb_ctx parameter from sysdb.c

SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)

SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)

SYSDB: Drop the sysdb_ctx parameter from the sysdb_services module

SYSDB: Drop the sysdb_ctx parameter from the sysdb_search module

SYSDB: Drop the sysdb_ctx parameter from the autofs API

SYSDB: Add sysdb_delete_by_sid

IPA: store forest name for forest member domains In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.

sysdb: sysdb_update_members can take either name or dn We need to work with distinguish names when processing cross-domain membership, because groups and users may be stored in different sysdb tree. Resolves: https://fedorahosted.org/sssd/ticket/2066

DB: Add user/group lookup by SID

Read enumerate state for subdomains from cache The enumerate flag will be read from the cache for subdomains and the domain object will be created accordingly.

SYSDB: Store enumerate flag for subdomain

sysdb_add_incomplete_group: store SID string is available During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.

DB: sysdb_search_user_by_name: search by both name and alias

Read mpg state for subdomains from cache The mpg flag will be read from the cache for subdomains and the domain object will be created accordingly.

Save mpg state for subdomains The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.

Remove empty directories after tests run. Empty directory tests_path is removed in function test_dom_suite_cleanup. Function test_dom_suite_cleanup is reused in other tests.

Only try to relink ghost users if we're not enumerating https://fedorahosted.org/sssd/ticket/1893 When SSSD is not enumerating (which is the default), we are trying to link any "ghost" entries with a newly created user entry. However, when enumeration is on, this means a spurious search on adding any user.

Fixing duplicate const const char const * --> const char *const

tests: Print warning if LDB_MODULES_PATH is not set Print warning if sysdb-tests or sysdb-ssh test are run individually and LDB_MODULES_PATH was not set. https://fedorahosted.org/sssd/ticket/1820

Use SSSD specific errors for offline auth This prevents reportin false errors when internal functions return a generic EINVAL or EACCES that should just be treated as internal errors.

Change the way domains are linked. - Use a double-linked list for domains and subdomains. - Never remove a subdomain, simply mark it as disabled if it becomes unused. - Rework the way subdomains are refreshed. Now sysdb_update_subdomains() actually updates the current subdomains and marks as disabled the ones not found in the sysdb or add new ones found. It never removes them. Removal of missing domains from sysdb is deferred to the providers, which will perform it at refresh time, for the ipa provider that is done by ipa_subdomains_write_mappings() now. sysdb_update_subdomains() is then used to update the memory hierarchy of the subdomains. - Removes sysdb_get_subdomains() - Removes copy_subdomain() - Add sysdb_subdomain_delete()

Remove sysdb_subdom completely struct sss_domain_info is always used to represent domains now. Adjust tests accordingly.

Avoid sysdb_subdom in sysdb_get_subdomains()

Add realm info to sss_domain_info

TESTS: include error message on fail

TESTS: Fix coverity issues 13126, 13127 https://fedorahosted.org/sssd/ticket/1763

tests: unit test for sysdb_remove_attrs

tests: add unit test for sysdb_get_new_id

tests: test sysdb_initgroups

tests: adda a unit test for test_sysdb_search_groups

tests: unit test for test_sysdb_search_users

tests: add a unit test for sysdb_netgroup_base_dn

Add domain arguments to sysdb services functions also fix sysdb_svc_add declarations

Add domain argument to sysdb autofs functions

Add domain argument to sysdb_remove_attrs()

Add domain argument to sysdb_has/set_enumerated()

Add domain arg to sysdb_search/delete_netgroup()

Add domain argument to sysdb_delete_group() Also remove sysdb_delete_domgroup()

Add domain argument to sysdb_delete_user() Also remove sysdb_delete_domuser()

Add domain to sysdb_delete_custom

Add domain argument to sysdb_search_custom() Also changes sysdb_search_custom_by_name()

Add domain argument to sysdb_store_custom()

Add domain argument to sysdb_cache_auth()

Add domain argument to sysdb_cache_password()

Add domain arg to sysdb group member functions

Add domain argument to sysdb_store_group() Also remove sysdb_store_domgroup()

Add domain argument to sysdb_store_user() Also remove sysdb_store_domuser()

Add domain arguments to sysdb_add_inetgroup fns.

Add domain arguments to sysdb_add_group functions.

Add domain argument to sysdb_add_user()

Add domain argument to sysdb_add_basic_user()

Add domain argument to sysdb_set_netgroup_attr()

Add domain argument to sysdb_set_group_attr()

Add domain argument to sysdb_set_user_attr()

Add domain arg to sysdb_search_netgroup_by_name()

Add domain to sysdb_search_group_by_gid() Also remove unused sysdb_search_domgroup_by_gid()

Add domain to sysdb_search_group_by_name() Also remove unused sysdb_search_domgroup_by_name()

Add domain to sysdb_search_user_by_uid() Also remove unused sysdb_search_domuser_by_uid()

Add domain to sysdb_search_user_by_name() Also remove unused sysdb_search_domuser_by_name()

Add domain argument to sysdb_get_user_attr()

Add domain option to sysdb_get/netgr/attrs() fns

Pass domain to sysdb_enum<pw/gr>ebt() functions

Pass domain to sysdb_get<pwu/grg><id() functions

Pass domain to sysdb_get<pw/gr>nam() functions Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore fqnames proper value in subdomains, by testing for a parent domain being present or not.

Make sysdb_domain_dn() require a domain.

Make sysdb_netgroup_dn() require a domain explictly.

Make sysdb_group_dn() require a domain explictly.

Make sysdb_user_dn() require a domain explictly.

Refactor single domain initialization Bring it out of sysdb, which will slowly remove internal dependencies on domains and instead will always require them to be passed by callers.

Code can only check for cached passwords Make it clear to the API users that we can not take arbitrary auth tokens. We can only take a password for now so simplify and clarify the interface.

Remove dead netgroup functions

MEMBEROF: Keep inherited ghost users around on modify operation https://fedorahosted.org/sssd/ticket/1652 It is possible to simply reset the list of ghost users to a different one during a modify operation. It is also actually how we update entries that are expired in the SSSD cache. In this case, we must be careful and retain the ghost users that are not native to the group we are processing but are rather inherited from child groups. The intention of the replace operation after all is to set the list of direct members of that group, not direct and indirect.

MEMBEROF: Implement the modify operation for ghost users Similar to the add and delete operation, we also need to propagate the changes of the ghost user attribute to the parent groups so that if a nested group updates memberships, its parents also get the membership updated.

MEMBEROF: Implement delete operation for ghost users https://fedorahosted.org/sssd/ticket/1668 The memberof plugin did only expand the ghost users attribute to parents when adding a nested group, but didn't implement the reverse operation. This bug resulted in users being reported as group members even after the direct parent went away as the expanded ghost attributes were never removed from the parent entry. When a ghost entry is removed from a group, all its parent groups are expired from the cache by setting the expire timestamp to 1. Doing so would force the SSSD to re-read the group next time it is requested in order to make sure its members are really up-to-date.

TESTS: Test ghosts users in the RFC2307 schema

MEMBEROF: Do not add the ghost attribute to self When a nested group with ghost users is added, its ghost attribute should propagate within the nested group structure much like the memberuid attribute. Unlike the memberuid attribute, the ghost attribute is only semi-managed by the memberof plugin and added manually to the original entry. This bug caused LDB errors saying that attribute or value already exists when a group with a ghost user was added to the hierarchy as groups were updated with an attribute they already had.

LDAP: Only convert direct parents' ghost attribute to member https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.

Include talloc log in our debug facility https://fedorahosted.org/sssd/ticket/1495

SYSDB: Remove unnecessary domain parameter from several sysdb calls The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.

AUTOFS: Use both key and value in entry RDN This patch switches from using just key in the RDN to using both key and value. That is neccessary to allow multiple direct mounts in a single map.

AUTOFS: Add entry objects below map objects https://fedorahosted.org/sssd/ticket/1506 Changes how the new autofs entry objects are handled. Instead of creating the entry on the cn=autofs,cn=custom level, the entry is created below the map it belongs to.

AUTOFS: Add sysdb tests

SYSDB: NULL-terminate the output of sysdb_get_{ranges,subdomains}

SYSDB: Abort unit test if sysdb_getpwnam fails

Change refreshing of subdomains This patch keeps a local copy of the subdomains in the ipa subdomains plugin context. This has 2 advantages: 1. allows to check if anything changed w/o always hitting the sysdb. 2. later will allows us to dump this information w/o having to retrieve it again. The timestamp also allows to avoid refreshing too often.

Add realm paramter to subdomain list This will be used later for setting domain_realm mappings in krb5.conf

tests: Remove useless consts Declaring a bunch of structures as const and then wrapping all uses in discard_const_p() is a bit silly. Remove all these useless decorations.

Change subdomain_info Rename the structure to use a standard name prefix so it is properly name-spaced, in preparation for changing the structure itself.

Cast uid_t to unsigned long long in DEBUG messages

Ghost members - various small changes

SYSDB: Handle user and group renames better Fixes a regression in the local domain tools where sss_groupadd no longer detected a GID duplicate. The check for EEXIST is moved one level up into more high level function. The patch also adds the same rename support for users. I found it odd that we allowed a rename of groups but not users. There is a catch when storing a user -- his cached password would be gone. I think that renaming a user is such a rare operation that it's not severe, plus there is a warning in the logs.

Sysdb routines for subdomains

Keep sysdb context in domain info struct

Delete missing attributes from netgroups to be stored https://fedorahosted.org/sssd/ticket/1136

SYSDB: extend sysdb_store_service() to accept additional attributes

SYSDB: Add indexes for servicePort and serviceProtocol

SYSDB: Add sysdb routines for manipulating service entries

SysDB commands that save lastUpdate allows this value to be passed in https://fedorahosted.org/sssd/ticket/836

New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0 Removed: SSS_UNRESOLVED_DEBUG_LEVEL (completely replaced with SSSDBG_UNRESOLVED) Added new macro: CONVERT_AND_SET_DEBUG_LEVEL(new_value) Changes unresolved debug level value (SSSDBG_UNRESOLVED) from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway, it has a minor effect, every time you want to load debug_level from command line parameters, you have to use following pattern: /* Set debug level to invalid value so we can deside if -d 0 was used. */ debug_level = SSSDBG_INVALID; pc = poptGetContext(argv[0], argc, argv, long_options, 0); while((opt = poptGetNextOpt(pc)) != -1) { ... } CONVERT_AND_SET_DEBUG_LEVEL(debug_level);

New DEBUG facility - conversion https://fedorahosted.org/sssd/ticket/925 Conversion of the old debug_level format to the new one. (only where it was necessary) Removed: SSS_DEFAULT_DEBUG_LEVEL (completely replaced with SSSDBG_DEFAULT)

sysdb refactoring: memory context deleted This patch deletes memory context parameter in those places in sysdb where it is not necessary. The code using modified functions has been updated. Tests updated as well.

sysdb refactoring: deleted domain variables in sysdb API The patch also updates code using modified functions. Tests have also been adjusted.

Non-posix group processing - sysdb changes

Case insensitive originalDN test

Add originalDN to fake groups

Delete attributes that are removed from LDAP Sometimes, a value in LDAP will cease to exist (the classic example being shadowExpire). We need to make sure we purge that value from SSSD's sysdb as well. https://fedorahosted.org/sssd/ticket/750

Add sysdb_has_enumerated and sysdb_set_enumerated helper functions Includes a unit test

Fix unchecked return value in test_sysdb_attrs_to_list https://fedorahosted.org/sssd/ticket/714

Fix const cast warnings in tests

Fix const cast warning for sysdb_update_members

Add unit tests for users and groups with odd characters

Modify sysdb_[add|remove]_group_member to accept users and groups Previously, it assumed that all members were users. This changes the interface so that either a user or a group can be specified. Also, it eliminates the need for a memory context to be passed, since the internal memory should be self-contained.

sysdb interface for adding incomplete groups Useful for optimizing the initgroups operation.

Also return member groups to the client

netgroup tests

Use POPT_TABLEEND to close option table

Fix sysdb_group_dn_name

Add parameter to skip cleanup in sysdb test This might be useful for examining the test database manually with LDB tools

Add sysdb_update_members function This function will take a user, a list of groups that this user should be added to and a list of groups the user should be removed from and will recursively call sysdb_[add|remove]_group_member Includes a unit test

Add sysdb_attrs_to_list() utility function

Add support for delayed kinit if offline If the configuration option krb5_store_password_if_offline is set to true and the backend is offline the plain text user password is stored and used to request a TGT if the backend becomes online. If available the Linux kernel key retention service is used.

Fix warning in sysdb-tests.c When we converted to the synchronous sysdb interface, the synchronous-simulating function test_loop() became unnecessary, but we forgot to remove it.

sysydb: Finally stop using a common event context This commit completes the migration to a synchronous sysdb

sysdb: remove remaining traces of sysdb_handle

sysdb: convert sysdb_enumgrent

sysdb: convert sysdb_enumpwent

sysdb: convert sysdb_get_user_attr

sysdb: convert sysdb_getgrgid

sysdb: convert sysdb_getgrnam

sysdb: convert sysdb_getpwuid

sysdb: convert sysdb_getpwnam

tests: remove use of asynchronus transactions now all calls are synchronous

sysdb: convert sysdb_cache_auth

sysdb: delete sysdb_delete_group

sysdb: convert sysdb_delete_user

sysdb: convert sysdb_asq_search

sysdb: convert sysdb_store_custom

sysdb: convert sysdb_search_custom

sysdb: convert sysdb_cache_password

sysdb: convert sysdb_mod/add/remove_group_member

sysdb: convert sysdb_store/add(_basic)_group

sysdb: convert sysdb_store/add(_basic)_user

sysdb: convert sysdb_set_entry/user/group_attr

sysdb: convert sysdb_search_group_by_name/gid

sysdb: convert sysdb_search_entry and sysdb_delete_recursive

sysdb: convert sysdb_delete_custom

sysdb: convert sysdb_delete_entry

Add --with-test-dir option to configure All 'make check' tests will chdir() into this directory before running the suite. This provides the option of having temporary files generated in a tmpfs or ramdisk

Rename server/ directory to src/ Also update BUILD.txt