the attached patch implements enumeration and cleanup for the IPA server
mode and also makes it possible to support enumeration and cleanup for
other subdomains in general (we already have a request from one of our
users to enumerate trusted AD domains).
Some of the changes can also be leveraged to special-case enumeration
requests in AD or IPA providers to e.g. download the master domain data
before enumerating the domain for the first time.
I hope the patches are split well to make it possible to review them
easily. The bigger patches usually just move code around.
currently in ipa-server-mode only the AD groups memberships are
available. This patch adds the IPA group memberships to trusted AD
This patch is missing some unit tests for some of the helper functions.
I will send them later, but I didn't want to delay the next release.
These patches make use of the krb5.conf for setting the default ccache
template instead of relying on a pre-configured default set a package
The build time parameter is still used as a fallback default if
krb5.conf and libkrb5 profile library returns no value.
Tested on my machine and works just fine (requires restart of sssd if
you change krb5.conf).
Simo Sorce * Red Hat, Inc * New York