sysdb: try dealing with binary-content attributes

https://fedorahosted.org/sssd/ticket/1818

I have here a LDAP user entry which has this attribute

	loginAllowedTimeMap::
	 AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA

In the function sysdb_attrs_add_string(), called from
sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is
the wrong thing to do. The result of strlen is then used to populate
the .v_length member of a struct ldb_val - and this will set it to
zero in this case. (There is also the problem that there may not be
a '\0' at all in the blob.)

Subsequently, .v_length being 0 makes ldb_modify(), called from
sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End
result is that users do not get stored in the sysdb, and programs like
`id` or `getent ...` show incomplete information.

The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave
fine, but that may not mean that is the absolute lower boundary of
introduction of the problem.
Remove enumerate=true from man sssd-ldap

https://fedorahosted.org/sssd/ticket/1737
sdap_fill_memberships: continue if a member is not foud in sysdb

https://fedorahosted.org/sssd/ticket/1755

sdap_find_entry_by_origDN() may return ENOENT in these
non-error scenarios:

If a member is out of scope of configured nesting level, sssd
produces few noise lines indicating failure.

The worse case is when a member is outside of configured search
bases. In this case we save the group with incomplete membership,
autofs: fix invalid header 'number of entries' in packet

https://fedorahosted.org/sssd/ticket/1739

Pointer to packet body may change while filling packet with autofs
mount points. As a consequence, we sometimes wrote the number of
entries into invalid body and we recieved an arbitrary number
on the client side.

If the number was 0, there were some skipped entries. If the number
was greater than 0, everything worked correctly, because we iterate
through the cached entries until we reach packet length - we don't
compare to the number.
if selinux is disabled, ignore that selogin dir is missing

https://fedorahosted.org/sssd/ticket/1817
Don't treat 0 as default for pam_pwd_expiration warning
File descriptor leak in nss responder.

File descriptors leaked every time sss_mmap_cache_reinit was
called and also the old memory cache was still maped in memory
(munmap was not called). This patch adds destructor for memory
cache context to call close() and munmap() automaticly.

https://fedorahosted.org/sssd/ticket/1826
Debug message in sss_mc_create_file.

This patch adds debug message for the case if sssd
fails to open old mc file for some other reason than
the file does not exist.
krb5-utils-tests: remove invalid condition

This condition is invalid because different_realm is not set, when
EINVAL is returned. It can make the test fail sometimes.
Provide a be_get_account_info_send function

In order to resolve group names in the simple access provider we need to
contact the Data Provider in a generic fashion from the access provider.
We can't call any particular implementation (like sdap_generic_send())
because we have no idea what kind of provider is configured as the
id_provider.

This patch splits introduces the be_file_account_request() function into
the data_provider_be module and makes it public.

A future patch should make the be_get_account_info function use the
be_get_account_info_send function.
Add unit tests for simple access test by groups

I realized that the current unit tests for the simple access provider
only tested the user directives. To have a baseline and be able to
detect new bugs in the upcoming patch, I implemented unit tests for the
group lists, too.
Do not compile main() in DP if UNIT_TESTING is defined

The simple access provider unit tests now need to link against the Data
Provider when they start using the be_file_account_request() function.
But then we would start having conflicts as at least the main()
functions would clash.

If UNIT_TESTING is defined, then the data_provider_be.c module does not
contain the main() function and can be linked against directly from
another module that contains its own main() function
Resolve GIDs in the simple access provider

Changes the simple access provider's interface to be asynchronous. When
the simple access provider encounters a group that has gid, but no
meaningful name, it attempts to resolve the name using the
be_file_account_request function.

Some providers (like the AD provider) might perform initgroups
without resolving the group names. In order for the simple access
provider to work correctly, we need to resolve the groups before
performing the access check. In AD provider, the situation is
even more tricky b/c the groups HAVE name, but their name
attribute is set to SID and they are set as non-POSIX
ldap: Fallback option for rfc2307 schema

Add option to fallback to fetch local users if rfc2307is being used.
This is useful for cases where people added local users as LDAP members
and rely on these group memberships to be maintained on the local host.

Disabled by default as it violates identity domain separation.

Ticket:
https://fedorahosted.org/sssd/ticket/1020
Document what does access_provider=ad do

https://fedorahosted.org/sssd/ticket/1841
sssd-1.8.0: work around a bug in cov-build from Coverity
Allocate PAM DP request data on responder context

https://fedorahosted.org/sssd/ticket/1869

Currently the private data passed to the PAM request is a structure
allocated on the client context. But in the odd case where the back end
would be stopped or stuck until the idle timeout hits, the DP callback
would access data that were freed when the client timed out.

This patch introduces a new structure allocated on responder context,
whose only purpose is to live as long as the request is active.