account sources. It is also the basis to provide client auditing and policy

  services for projects like FreeIPA.

  the existing back ends.

  %package common

  Requires(postun): /sbin/ldconfig

  %description -n libsss_idmap

  %package -n libsss_idmap-devel

  Summary: FreeIPA Idmap library

  Requires: libsss_idmap = %{version}-%{release}

  %description -n libsss_idmap-devel

  %package -n libipa_hbac

  Summary: FreeIPA HBAC Evaluator library

  /* The utility function to create a subdomain sss_domain_info object is handy

   * for unit tests, so it should be available in a header, but not a public util

   * the sysdb domain object and calling sysdb_update_subdomains()

   */

  struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,

          goto done;

      }

      for (c = 0; allowed_attrs[c] != NULL; c++) {

          el = ldb_msg_find_element(orig_obj->msgs[0], allowed_attrs[c]);

          if (el != NULL) {

      el = ldb_msg_find_element(orig_obj->msgs[0], SYSDB_NAME_ALIAS);

      if (el != NULL) {

          for (c = 0; c < el->num_values; c++) {

               * override name are the same, we use the *_safe version here. */

              ret = sysdb_attrs_add_val_safe(attrs, SYSDB_NAME_ALIAS,

                                             &el->values[c]);

  # An example Active Directory domain. Please note that this configuration

  # works for AD 2003R2 and AD 2008, because they use pretty much RFC2307bis

  # compliant attribute names. To support UNIX clients with AD 2003 or older,

  # msSFU30* attribute names.

  ; [domain/AD]

  ; id_provider = ldap

  EXCLUDE                =

  # The EXCLUDE_SYMLINKS tag can be used to select whether or not files or

  # from the input.

  EXCLUDE_SYMLINKS       = NO

               project was born to deal with this problem in cloud like

               environments, but we found the idea compelling even at a

               single system level. As a security service, SSSD is ideal to

               Socket. This will make it possible to use local calls and have

               them transparently routed to a local or a remote key management

               store like IPA Vault for storage, escrow and recovery.

   * named "ApplyGroupPolicy" (AGP) is allowed, by comparing the specified

   * user_sid and group_sids against the specified access control entry (ACE).

   * This function returns ALLOWED, DENIED, or NEUTRAL depending on whether

   *

   * Note that the 'M' abbreviation used in the evaluation algorithm stands for

   * "access_mask", which represents the set of access rights associated with an

      ret = sysdb_attrs_get_int32_t(result, AD_AT_FUNC_VERSION,

                                    &gp_gpo->gpo_func_version);

      if (ret == ENOENT) {

           * be filtered out according to MS-GPOL:

           * https://msdn.microsoft.com/en-us/library/cc232538.aspx */

          DEBUG(SSSDBG_TRACE_ALL, "GPO with GUID %s is missing attribute "

          return;

      }

       * No need to retry again. */

      ret = EOK;

  {

      if (dp_req->handler_req == NULL) {

          /* This may occur when the handler already finished but the caller

           * return here. */

          return;

      }

          goto done;

      }

       * right principal...

       */

      kerr = sss_krb5_check_ccache_princ(kr->ctx, kr->ccname, kr->creds->client);

      }

      in_transaction = false;

      /* remember new usn */

      ret = sysdb_get_highest_usn(state, rules, rules_count, &usn);

  /*

   * Creates an array of principal elements that will be used later

   * in the form of:

   */

  static json_t *princ_data_to_json(TALLOC_CTX *mem_ctx,

                                    krb5_principal princ)

      case HASH_ERROR_KEY_NOT_FOUND:

          /* No request for this UID yet. Enqueue this request in case

           * another one comes in and return EOK to run the current request

           */

          DEBUG(SSSDBG_TRACE_LIBS, "No existing queue for this ID\n");

   * Enqueue a request.

   *

   * If the request queue /for the given ID/ is empty, that is, if this

   *

   * Otherwise just add it to the queue and wait until the previous request

   * finishes and only at that point mark the current request as done, which

      conn->incoming_signals = sbus_incoming_signal_hash_init(conn);

      if (conn->incoming_signals == NULL) {

                "hash table\n");

          talloc_free(conn);

          return EIO;

  /*

   * sbus_get_connection

   * from a sbus_connection

   */

  DBusConnection *sbus_get_connection(struct sbus_connection *conn)

      SAFEALIGN_SETMEM_VALUE(dest, value, uint16_t, pctr)

  /* These macros are the same as their equivalents without _CHECK suffix,

  #define SAFEALIGN_COPY_UINT32_CHECK(dest, src, len, pctr) do { \

      if ((*(pctr) + sizeof(uint32_t)) > (len) || \

          SIZE_T_OVERFLOW(*(pctr), sizeof(uint32_t))) { return EINVAL; } \

  #define MAX_AUTOMNTMAPNAME_LEN  NAME_MAX

  #define MAX_AUTOMNTKEYNAME_LEN  PATH_MAX

  #define GETAUTOMNTENT_MAX_ENTRIES   512

  struct automtent {

      data_len = sizeof(uint32_t) +            /* mapname len */

                 name_len + 1 +                /* mapname\0   */

                 sizeof(uint32_t) +            /* index into the map */

      data = malloc(data_len);

      if (!data) {

  EXCLUDE                =

  # The EXCLUDE_SYMLINKS tag can be used select whether or not files or

  # from the input.

  EXCLUDE_SYMLINKS       = NO

      WBC_SSSD_NOT_IMPLEMENTED;

  }

  wbcErr wbcGetGroups(const char *account,

              uint32_t *num_groups,

              gid_t **_groups)

  };

  /**

   * user.

   *

   * @param[in] domainname  The domain name the user is a member of.

   * @param[out] _error     The result of the search in SSSD's domains. If the

   *                        user was present in the domain, the _error code is

   * @brief Send a request to SSSD to retrieve the default options, commonly

   * stored in the "cn=defaults" record,

   *

   *

   *

   * @param[out] _error      The result of the search in SSSD's domains. If the

   *                         options were present in the domain, the _error code

  #include "responder/common/responder.h"

  #include "tests/cmocka/common_mock_resp.h"

   * mocked values as per previous set by mock_account_recv

   */

  struct tevent_req *

      escaped = sbus_opath_escape_part(mem_ctx, "path_with_underscore");

      assert_non_null(escaped);

      assert_string_equal(escaped, "path_5fwith_5funderscore");

      raw = sbus_opath_unescape_part(mem_ctx, escaped);

      talloc_free(escaped);

      return ret;

  }

  {

      return sss_signal(0) == EOK;

  }

  #include "util/util.h"

  errno_t sss_signal(int signum);

  #endif /* _SSS_PROCESS_H_ */

      enum sssctl_prompt_result prompt;

      errno_t ret;

          return true;

      }

      enum sssctl_prompt_result prompt;

      errno_t ret;

          return true;

      }

          return ret;

      }

          return ERR_SSSD_RUNNING;

      }

   *  Sumit Bose <sbose@redhat.com>

   *  George McCollister <georgem@novatech-llc.com>

   */

     Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>.  */

  #include "config.h"

   *

   *  Sumit Bose <sbose@redhat.com>

   */

     Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>.  */

  #include "config.h"

  #endif

  }

  {

      _exit(0);

  }

          pid = fork();

          if (pid != 0) {

              /* Terminate parent process on demand so we can hold systemd

               * We use signals directly here because we don't have a tevent

               * context yet. */

              /* or exit when sssd monitor is terminated */

              do {

  struct ref_array *

  sss_ini_get_ra_error_list(struct sss_ini_initdata *init_data);

  struct ref_array *

  sss_ini_get_ra_success_list(struct sss_ini_initdata *init_data);

  struct tcurl_sock {

      struct tcurl_ctx *tctx;     /* Backchannel to the main context */

      struct tevent_fd *fde;      /* tevent tracker of the fd events */

  };

                  return ret;

              }

          } else if (ret == 0) {

              break;

          }

      }