From 3f1466274d70e3e275b53bab99549c3e0d4f2a30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
Date: Fri, 8 Jul 2016 11:32:50 +0200
Subject: [PATCH] config: Some fixes to schema

Fixes:
https://fedorahosted.org/sssd/ticket/3068

Option "timeout" must be allowed for all
responders.
Option "user_attributes" is
also available in NSS responder.
Option override_space is read from monitor
section, not NSS.
---
 src/config/SSSDConfig/__init__.py.in |  3 ++-
 src/config/SSSDConfigTest.py         |  3 ++-
 src/config/cfg_rules.ini             | 11 +++++++++--
 src/config/etc/sssd.api.conf         |  6 +++---
 4 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 52af138..ea29000 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -63,6 +63,7 @@ option_strings = {
     'default_domain_suffix' : _('Domain to add to names without a domain component.'),
     'user' : _('The user to drop privileges to'),
     'certificate_verification' : _('Tune certificate verification'),
+    'override_space': _('All spaces in group or user names will be replaced with this character'),
 
     # [nss]
     'enum_cache_timeout' : _('Enumeration cache timeout length (seconds)'),
@@ -81,7 +82,7 @@ option_strings = {
     'shell_fallback' : _('If a shell stored in central directory is allowed but not available, use this fallback'),
     'default_shell': _('Shell to use if the provider does not list one'),
     'memcache_timeout': _('How long will be in-memory cache records valid'),
-    'override_space': _('All spaces in group or user names will be replaced with this character'),
+    'user_attributes': _('List of user attributes the NSS is allowed to publish'),
 
     # [pam]
     'offline_credentials_expiration' : _('How long to allow cached logins between online logins (days)'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 6ec3023..5fa9bce 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -310,7 +310,8 @@ class SSSDConfigTestSSSDService(unittest.TestCase):
             'client_idle_timeout',
             'diag_cmd',
             'description',
-            'certificate_verification']
+            'certificate_verification',
+            'override_space']
 
         self.assertTrue(type(options) == dict,
                         "Options should be a dictionary")
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index d738ddf..bcc3d2e 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -38,6 +38,7 @@ option = krb5_rcache_dir
 option = user
 option = default_domain_suffix
 option = certificate_verification
+option = override_space
 
 [rule/allowed_nss_options]
 validator = ini_allowed_options
@@ -57,6 +58,8 @@ option = description
 option = diag_cmd
 
 # Name service
+option = timeout
+option = user_attributes
 option = enum_cache_timeout
 option = entry_cache_nowait_percentage
 option = entry_negative_timeout
@@ -75,7 +78,6 @@ option = shell_fallback
 option = default_shell
 option = get_domains_timeout
 option = memcache_timeout
-option = override_space
 
 [rule/allowed_pam_options]
 validator = ini_allowed_options
@@ -95,6 +97,7 @@ option = description
 option = diag_cmd
 
 # Authentication service
+option = timeout
 option = offline_credentials_expiration
 option = offline_failed_login_attempts
 option = offline_failed_login_delay
@@ -128,6 +131,7 @@ option = description
 option = diag_cmd
 
 # sudo service
+option = timeout
 option = sudo_timed
 option = sudo_inverse_order
 
@@ -149,6 +153,7 @@ option = description
 option = diag_cmd
 
 # autofs service
+option = timeout
 option = autofs_negative_timeout
 
 [rule/allowed_ssh_options]
@@ -169,6 +174,7 @@ option = description
 option = diag_cmd
 
 # ssh service
+option = timeout
 option = ssh_hash_known_hosts
 option = ssh_known_hosts_timeout
 option = ca_db
@@ -191,8 +197,8 @@ option = description
 option = diag_cmd
 
 # PAC responder
+option = timeout
 option = allowed_uids
-option = user_attributes
 option = pac_lifetime
 
 [rule/allowed_ifp_options]
@@ -213,6 +219,7 @@ option = description
 option = diag_cmd
 
 # InfoPipe responder
+option = timeout
 option = allowed_uids
 option = user_attributes
 
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 9114659..413e9c6 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -3,6 +3,7 @@
 
 [service]
 # Options available to all services
+timeout = int, None, false
 debug = int, None, false
 debug_level = int, None, false
 debug_timestamps = bool, None, false
@@ -20,7 +21,6 @@ diag_cmd = str, None, false
 # Monitor service
 services = list, str, true, nss, pam
 domains = list, str, true
-timeout = int, None, false
 sbus_timeout = int, None, false
 re_expression = str, None, false
 full_name_format = str, None, false
@@ -28,9 +28,11 @@ krb5_rcache_dir = str, None, false
 user = str, None, false
 default_domain_suffix = str, None, false
 certificate_verification = str, None, false
+override_space = str, None, false
 
 [nss]
 # Name service
+user_attributes = str, None, false
 enum_cache_timeout = int, None, false
 entry_cache_nowait_percentage = int, None, false
 entry_negative_timeout = int, None, false
@@ -49,7 +51,6 @@ shell_fallback = str, None, false
 default_shell = str, None, false
 get_domains_timeout = int, None, false
 memcache_timeout = int, None, false
-override_space = str, None, false
 
 [pam]
 # Authentication service
@@ -86,7 +87,6 @@ ca_db = str, None, false
 [pac]
 # PAC responder
 allowed_uids = str, None, false
-user_attributes = str, None, false
 pac_lifetime = int, None, false
 
 [ifp]
-- 
2.5.0

