[SSSD] [PATCH SET] AD_PROVIDER: ad_enabled_domains

[Petr Cech]

Hello list,

there is patch set attached resolving:
https://fedorahosted.org/sssd/ticket/2828

You can also see:
https://github.com/celestian/sssd/commits/subdomains_v2


This patch set is without tests yet.
I will send tests after Pavel B. refactor of AD provider.


I would like to remark couple of things:

1) Option ad_enabled_domains disabled by default.

2) We use labels master domain and root domain in code. Master domain 
belongs to one that SSSD is connected to. Root domain means AD forest root.

3) There is a lot of different environment setup. So this option has 
slightly different meaning in each of them.

4) There is secret feature if you forget fill in master domain to the 
option it will be added automatically.


What is this option good for?
Let's imagine environment like:

A (forest root)
|
|-- S1 (SSSD client)
|
|-- B (AD client)
|   |
|   |-- S2 (SSSD client)
|
|-- C (AD client)
|
|-- D (AD client)

A ... forest root
B, C, D ... AD clients
S1 ... SSSD client connected to A
S2 ... SSSD client connected to B

We could write:

* on S1: ad_enabled_domain = A, B, C
and then S1 will not attempt to connect D.

* on S1: ad_enabled_domain = B, C
the same as above because A is automagically
filled in.

* on S2: ad_enabled_domain = A, C
and then B is filled in automatically
and S2 will not attempt to connect D.

* on S2: ad_enabled_domain = C
and then B is filled in automatically
and S2 will not attempt to connect D and A.
(I am wondering that it is possible but it
happened during manual testing.)


Regards

-- 
Petr^4 Čech