:packaging:Support of OpenSSL older than 1.0.1 was dropped

Reviewed-by: Sumit Bose <[email protected]>

The krb5 backend will only returns that Smartcard authentication is
available if a Smartcard is present. That means if the user
authenticates with a different method and a Smartcard is not present at
this time 'sc_allow' will be 'false' and might overwrite a 'true' value
written during a previous authentication attempt where a Smartcard was
present. To avoid this we only write 'true' values. Since the default if
SYSDB_LOCAL_SMARTCARD_AUTH is missing is 'false' local Smartcard
authentication (offline) will still only be enabled if online Smartcard
authentication was detected.

Resolves: SSSD#7532

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Justin Stephenson <[email protected]>

To allow to lookup group memberships of other objects similar to user
objects but with different attribute mappings, e.g. host objects in AD,
a new option to provide an alternative attribute map is added.

Resolves: SSSD#7590

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

Use the default AD user attribute map to lookup the group membership of
the AD host object. This should help to avoid issues if user attributes
are overwritten in the user attribute map.

Resolves: SSSD#7590

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

Reviewed-by: Tomáš Halman <[email protected]>

sss_ssh_knownhosts was only accepting a hostname or IP address, but no
port number. Because token %H of ssh(1) could pass a port number, it
must be accepted.

The %H token can provide the hostname and port number in the
following format:

hostname
canonical.host.name
IP-address
[hostname]:port
[canonical.host.name]:port
[IP-address]:port

The port is specified only when a non-default port is used.

Identifiers without the brackets are also recognized in case a user
invokes the tool directly.

Reviewed-by: Alexey Tikhonov <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

with `sss_erase_mem_securely()`

Resolves: SSSD#7606

Reviewed-by: Alejandro López <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

Take a note that usage of cap_dac_override + chown to create cache path
components could be changed to use cap_dac_override + (granted anyway) setuid,
but not sure if it's worth the trouble.

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>

'sssd_nss' won't handle this request anyway.

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>

This is an addition to SSSD#7667

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>

Test transformation of bash-ldap-id-ldap-auth netgroup

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Iker Pedrosa <[email protected]>

Reviewed-by: Justin Stephenson <[email protected]>

Reviewed-by: Sumit Bose <[email protected]>

Currently, the test will blindly fail if someone carelessly adds IPA to the topologies.

Reviewed-by: Pavel Březina <[email protected]>

Resolves: SSSD#7715

Reviewed-by: Alejandro López <[email protected]>
Reviewed-by: Alexey Tikhonov <[email protected]>

Reviewed-by: Shridhar Gadekar <[email protected]>

OSError from 'sss_analyze error list'

PermissionError from 'sss_analyze request list' run without sudo

Reviewed-by: Alejandro López <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

It looks like in current code the assumption is that the nsupdate
command can just send its debug output into the backend log by
duplicating the file descriptor. This won't work since the logs file is
opened with O_CLOEXEC so that it is closed when nsupdate is started.

Additionally it is questionable if this approach is a good idea because
it would lead to a random intermixing of debug information. This patch
collects the output on strderr of nsupdate separately and adds it into
the backend log similar to the input send to nsupdate.

Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>

Reviewed-by: Alejandro López <[email protected]>
Reviewed-by: Jakub Vávra <[email protected]>

… empty

SSSD fails to store users if any of the requested attribute is empty

Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Jakub Vávra <[email protected]>

This fixes mh critical tests that are failing.

Reviewed-by: Shridhar Gadekar <[email protected]>

Would reformat system/tests/test_ldap.py

Reviewed-by: Alexey Tikhonov <[email protected]>
Reviewed-by: Jakub Vávra <[email protected]>

DNS-over-TLS is a new standard for encrypting DNS traffic.

SSSD does not implement the DoT itself but relies on other
components of the system. This modification allows as to set
a DoT for dynamic DNS updates

:config: the `dyndns_server` option is extended so it can
  be in form of URI (dns+tls://1.2.3.4:853#servername).
  New set of options `dyndns_dot_cacert`,
  `dyndns_dot_cert` and `dyndns_dot_key` allows to configure
  DNS-over-TLS communication.

:relnote: The DoT for dynamic DNS updates is supported now.
  It requires new version of `nsupdate` from BIND 9.19+.

Reviewed-by: Alexander Bokovoy <[email protected]>
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>

Similar to AD server/service discovery initialization,
Allows callers to provide a service, and not just use "IPA"

ipa_srv_* functions will handle IPA and AD subdomains, not only
AD.

After b3d7a4f we no longer use
the 'upn' variable. During certain codepaths to ipa_s2n_save_objects()
SYSDB_UPN is expected to be missing, so no need to check for it.

This gets executed when a one-way or two-way trust ipa
is added. Rename this to avoid confusion.

SSSD goes offline in IPA trusted user look due to the IPA user private group:

    [ipa_get_ad_acct_ad_part_done] (0x0020): [RID#7] Cannot find a SID.

In IPA-IPA trust, user private groups do not contain a SID. Lookup the
equivalent user object of the same name in IPA and use this SID instead.

Don't fail when processing the IPA user private group retrieved
from the IPA server in a trusted user lookup. It is expected
this object will have no SID.