Fix krb5 changepw when FAST-only preauth methods are used (like OTP)

Before this patch, a different set of options was used when calling
krb5_get_init_creds_password() for the changepw principal. Because
this set of options did not contain the same FAST settings as the
options for normal requests, all authentication would fail when the
password of a FAST-only account would expire.

The two sets approach was cargo-cult from kinit where multiple
requests could be issued using the same options set. However, in the
case of krb5_child, only one request (or occasionally a well-defined
second request) will be issued. Two option sets are therefore not
required.

To fix this problem we removed the second option set used for changepw
requests. All requests now use a single option set which is modified,
if needed, for well-defined subsequent requests.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
IPA: Use GC for AD initgroup requests

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Makefile: Add missing library to the dp_opt_tests

dp_opt_tests cannot be linked properly if link_all_deplibs is disabled (debian)

/usr/bin/ld: src/tests/cmocka/dp_opt_tests-test_dp_opts.o:
    undefined reference to symbol 'poptFreeContext@@LIBPOPT_0'
/usr/bin/ld: note: 'poptFreeContext@@LIBPOPT_0' is defined in DSO
/lib64/libpopt.so.0 so try adding it to the linker command line
/lib64/libpopt.so.0: could not read symbols: Invalid operation

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
AD: Only connect to GC for subdomain users

https://fedorahosted.org/sssd/ticket/2251

By connecting to GC for users from both trusted domains and parent
domain, we lose the ability to download the shell and homedir if these
are used with ID mapping.

This patch changes the user lookups only. Changing the logic for all
lookups would break cross-domain group memberships, for example.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
MAN: Clarify the GC support a bit

It should be noted that disabling GC does *not* disable lookups from
trusted domains. Disabling GC might be a a good way for admins who wish
to use POSIX attributes in trusted domains and the man page should hint
this option.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
IPA: Use the correct domain when processing SELinux rules

We blindly used the user's domain for everything. That wrong in case the
user comes from a subdomain. We should use the IPA domain for accessing
the SELinux rules and host data and the user domain only for the user.

https://fedorahosted.org/sssd/ticket/2270

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migration

Fixes https://fedorahosted.org/sssd/ticket/2279

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
AD: Continue if sssd failes to check extra members

Reported by scan-build

    for (mi = 0; group_only[mi]; mi++) {
                 ^~~~~~~~~~
warning: Array access (from variable 'group_only') results in a null pointer
dereference

It can happend if function ad_group_extra_members fails (ret != EOK)

Reviewed-by: Simo Sorce <simo@redhat.com>
TEST: Remove unused argument sysdb_path

Name of sysdb file is automatically generated from domain name and db_path
in function sysdb_domain_init.

talloc_asprintf is called with arguments "%s/cache_%s.ldb", db_path, dom->name

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
TEST: Use right domain name in negcache test

Directory tests_ncache was not removed after negcache test,
because sysdb cache had different name and was not removed in the function
test_dom_suite_cleanup.

[sssd] [test_dom_suite_cleanup] (0x0020):
               Could not delete the test dir (39) (Directory not empty)

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
TEST: Do not clean up if test fail.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
hbac-test: Use defined macros instead of strings

Macro HBAC_TEST_SRCHOSTGROUP2 was defined but it was not used anywhere.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
TESTS: Remove unused macros

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
KRB: Prevent dereference of a null pointer

Reported by: scan-build
    krb5_free_principal(cc->context, ccprinc);
                        ^~
warning: Access to field 'context' results in a dereference of a null pointer
(loaded from variable 'cc')

Variable 'cc' needn't be initialised if function sss_open_ccache_as_user
fails.

Reviewed-by: Sumit Bose <sbose@redhat.com>
IPA: Write SELinux usernames in the right case

https://fedorahosted.org/sssd/ticket/2282

Reviewed-by: Michal Židek <mzidek@redhat.com>
MAN: new general options section

Some options are relevant to multiple sections of sssd.conf. This patch adds
new sections for those.

Resolves:
https://fedorahosted.org/sssd/ticket/2218

Reviewed-by: Sumit Bose <sbose@redhat.com>
providers: Fix types passed to dbus varargs functions

Fix some incorrect types passed to dbus_message_get_args(),
dbus_message_append_args() or functions accepting similar
varargs and types.

In particular sizeof(bool) != sizeof(dbus_bool_t) on most
platforms. This probably only worked because the compiler
was aligning stack variables and so writing off the end of
one of them wasn't the end of the world.

In addition fix cases where int != int32_t != uint32_t.
Although these will work on many common platforms, assuming
these are interchangeable is not cross platform safe.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
sbus: Add struct sbus_request to represent a DBus invocation

struct sbus_request represents a request from a dbus client
being handled by a dbus server implementation. The struct
contains the message, connection and method (and in the
future teh property) which is being requested.

In the future it will contain caller information as well.

sbus_request is a talloc memory context, and is a good place to
attach any allocations and memory specific to the request.

Each handler accepts an sbus_request. If a handler returns
EOK, it is assumed that the handler will finish the request.
Any of the sbus_request_*finish() methods can be used to
complete the request and send back a reply.

sbus_request_return_and_finish() uses the same argument
varargs syntax as dbus_message_append_args(), which isn't
a great syntax. Document it a bit, but don't try to redesign:
The marshalling work (will follow this patch set) will remove
the need to use varargs for most DBus implementation code.

This patch migrates the monitor and data provider dbus code
to use sbus_request, but does not try to rework the talloc
context's to use it.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
sbus: Refactor how we export DBus interfaces

Most importantly, stop using per connection private data. This doesn't
scale when you have more than one thing exporting or exported on a
connection.

Remove struct sbus_interface and expand sbus_conn_add_interface()
function. Remove various struct sbus_interface args to connection
initialization functions and make callers use sbus_conn_add_interface()
directly. The old method was optimized for exporting one interface
on a connection. We'll have connections that export zero, one or more
interfaces.

To export an interface on a DBus server, call sbus_conn_add_interface()
from within the sbus_server_conn_init_fn. To export an interface on
a DBus client, call sbus_conn_add_interface() after sbus_new_connection()
returns.

As before struct sbus_interface represents an object exported via DBus.
However it is now talloc allocated. One can set instance data on the
struct sbus_interface. This instance data is passed to the various
handlers and used in their implementation.

However, we now have type safe interface exporting in the various
high level sss_process_init() sss_monitor_init() and so on.

Introspection support was not in use, and is now gone until we
implement it using the metadata (future patch).

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
sbus: Make sbus_new_server() work for non-priveleged processes

I'd like to use this during testing. We should check that the
socket ownership is the same as the process, rather than limiting
it to root.

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>