Blame SOURCES/0001-daemon-if-no-local-users-check-if-machine-is-enrolle.patch

0c7e6b
From 54b207649979475ea7f1fa5eaaea94be31d20935 Mon Sep 17 00:00:00 2001
8734ae
From: Ray Strode <rstrode@redhat.com>
8734ae
Date: Fri, 13 Dec 2019 15:16:06 -0500
8734ae
Subject: [PATCH] daemon: if no local users, check if machine is enrolled in
8734ae
 network
8734ae
8734ae
GDM will show gnome initial-setup if a machine has no local users.
8734ae
But it's totally possible that a machine has only remote users,
8734ae
and shouldn't have a local user.
8734ae
8734ae
This commit detects that case, and avoids setting the HasNoUsers
8734ae
property.
8734ae
---
8734ae
 data/org.freedesktop.realmd.xml | 730 ++++++++++++++++++++++++++++++++
0c7e6b
 src/daemon.c                    |  63 ++-
0c7e6b
 src/meson.build                 |   1 +
8734ae
 src/org.freedesktop.realmd.xml  | 730 ++++++++++++++++++++++++++++++++
0c7e6b
 4 files changed, 1520 insertions(+), 4 deletions(-)
8734ae
 create mode 100644 data/org.freedesktop.realmd.xml
8734ae
 create mode 100644 src/org.freedesktop.realmd.xml
8734ae
8734ae
diff --git a/data/org.freedesktop.realmd.xml b/data/org.freedesktop.realmd.xml
8734ae
new file mode 100644
8734ae
index 0000000..c34a47a
8734ae
--- /dev/null
8734ae
+++ b/data/org.freedesktop.realmd.xml
8734ae
@@ -0,0 +1,730 @@
8734ae
+
8734ae
+ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
8734ae
+<node name="/">
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Provider:
8734ae
+	  @short_description: a realm provider
8734ae
+
8734ae
+	  Various realm providers represent different software implementations
8734ae
+	  that provide access to realms or domains.
8734ae
+
8734ae
+	  This interface is implemented by individual providers, but is
8734ae
+	  aggregated globally at the system bus name
8734ae
+	  <literal>org.freedesktop.realmd</literal>
8734ae
+	  with the object path <literal>/org/freedesktop/realmd</literal>
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Provider">
8734ae
+
8734ae
+		
8734ae
+		  Name: the name of the provider
8734ae
+
8734ae
+		  The name of the provider. This is not normally displayed
8734ae
+		  to the user, but may be useful for diagnostics or debugging.
8734ae
+		-->
8734ae
+		<property name="Name" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Version: the version of the provider
8734ae
+
8734ae
+		  The version of the provider. This is not normally used in
8734ae
+		  logic, but may be useful for diagnostics or debugging.
8734ae
+		-->
8734ae
+		<property name="Version" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Realms: a list of realms
8734ae
+
8734ae
+		  A list of known, enrolled or discovered realms. All realms
8734ae
+		  that this provider knows about are listed here. As realms
8734ae
+		  are discovered they are added to this list.
8734ae
+
8734ae
+		  Each realm is represented by the DBus object path of the
8734ae
+		  realm object.
8734ae
+		-->
8734ae
+		<property name="Realms" type="ao" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Discover:
8734ae
+		  @string: an input string to discover realms for
8734ae
+		  @options: options for the discovery operation
8734ae
+		  @relevance: the relevance of the returned results
8734ae
+		  @realm: a list of realms discovered
8734ae
+
8734ae
+		  Discover realms for the given string. The input @string is
8734ae
+		  usually a domain or realm name, perhaps typed by a user. If
8734ae
+		  an empty string is provided, the realm provider should try to
8734ae
+		  discover a default realm, if possible (e.g. from DHCP).
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>client-software</literal>: a string
8734ae
+		      containing the client software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>server-software</literal>: a string
8734ae
+		      containing the client software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>membership-software</literal>: a string
8734ae
+		      containing the membership software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  The @relevance returned can be used to rank results from
8734ae
+		  different discover calls to different providers. Implementors
8734ae
+		  should return a positive number if the provider highly
8734ae
+		  recommends that the realms be handled by this provider,
8734ae
+		  or a zero if it can possibly handle the realms. Negative numbers
8734ae
+		  should be returned if no realms are found.
8734ae
+
8734ae
+		  This method does not return an error when no realms are
8734ae
+		  discovered. It simply returns an empty @realm list.
8734ae
+
8734ae
+		  To see diagnostic information about the discovery process,
8734ae
+		  connect to the org.freedesktop.realmd.Service::Diagnostics
8734ae
+		  signal.
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.discover-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may
8734ae
+		  return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the discovery could not be run for some reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform a discovery
8734ae
+		      operation.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Discover">
8734ae
+			<arg name="string" type="s" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+			<arg name="relevance" type="i" direction="out"/>
8734ae
+			<arg name="realm" type="ao" direction="out"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Service:
8734ae
+	  @short_description: the realmd service
8734ae
+
8734ae
+	  Global calls for managing the realmd service. Usually you'll want
8734ae
+	  to use #org.freedesktop.realmd.Provider instead.
8734ae
+
8734ae
+	  This interface is implemented by the realmd service, and is always
8734ae
+	  available at the object path <literal>/org/freedesktop/realmd</literal>
8734ae
+
8734ae
+	  The service also implements the
8734ae
+	  <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
8734ae
+	  makes it easy to retrieve all realmd objects and properties in one go.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Service">
8734ae
+
8734ae
+		
8734ae
+		  Cancel:
8734ae
+		  @operation: the operation to cancel
8734ae
+
8734ae
+		  Cancel a realmd operation. To be able to cancel an operation,
8734ae
+		  pass a uniquely chosen <literal>operation</literal> string
8734ae
+		  identifier as an option in the method's <literal>options</literal>
8734ae
+		  argument.
8734ae
+
8734ae
+		  These operation string identifiers should be unique per client
8734ae
+		  calling the realmd service.
8734ae
+
8734ae
+		  It is not guaranteed that the service can or will cancel the
8734ae
+		  operation. For example, the operation may have already completed
8734ae
+		  by the time this method is handled. The caller of the operation
8734ae
+		  method will receive a
8734ae
+		  <literal>org.freedesktop.realmd.Error.Cancelled</literal>
8734ae
+		  if the operation was cancelled.
8734ae
+		-->
8734ae
+		<method name="Cancel">
8734ae
+			<arg name="operation" type="s" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  SetLocale:
8734ae
+		  @locale: the locale for the client
8734ae
+
8734ae
+		  Set the language @locale for the client. This locale is used
8734ae
+		  for error messages. The locale is used until the next time
8734ae
+		  this method is called, the client disconnects, or the client
8734ae
+		  calls #org.freedesktop.realmd.Service.Release().
8734ae
+		-->
8734ae
+		<method name="SetLocale">
8734ae
+			<arg name="locale" type="s" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  Diagnostics:
8734ae
+		  @data: diagnostic data
8734ae
+		  @operation: the operation this data resulted from
8734ae
+
8734ae
+		  This signal is fired when diagnostics result from an operation
8734ae
+		  in the provider or one of its realms.
8734ae
+
8734ae
+		  It is not guaranteed that this signal is emitted once per line.
8734ae
+		  More than one line may be contained in @data, or a partial
8734ae
+		  line. New line characters are embedded in @data.
8734ae
+
8734ae
+		  This signal is sent explicitly to the client which invoked an
8734ae
+		  operation method. In order to tell which operation this
8734ae
+		  diagnostic data results from, pass a unique
8734ae
+		  <literal>operation</literal> string identifier in the
8734ae
+		  <literal>options</literal> argument of the operation method.
8734ae
+		  That same identifier will be passed back via the @operation
8734ae
+		  argument of this signal.
8734ae
+		-->
8734ae
+		<signal name="Diagnostics">
8734ae
+			<arg name="data" type="s"/>
8734ae
+			<arg name="operation" type="s"/>
8734ae
+		</signal>
8734ae
+
8734ae
+		
8734ae
+		  Release:
8734ae
+
8734ae
+		  Normally, realmd waits until all clients have disconnected
8734ae
+		  before exiting itself sometime later. Long lived clients
8734ae
+		  can call this method to allow the realmd service to quit.
8734ae
+		  This is an optimization. The daemon will not exit immediately.
8734ae
+		  It is safe to call this multiple times.
8734ae
+		-->
8734ae
+		<method name="Release">
8734ae
+			
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Realm:
8734ae
+	  @short_description: a realm
8734ae
+
8734ae
+	  Represents one realm.
8734ae
+
8734ae
+	  Contains generic information about a realm, and useful properties for
8734ae
+	  introspecting what kind of realm this is and how to work with
8734ae
+	  the realm.
8734ae
+
8734ae
+	  Use #org.freedesktop.realmd.Provider:Realms or
8734ae
+	  #org.freedesktop.realmd.Provider.Discover() to get access to some
8734ae
+	  kerberos realm objects.
8734ae
+
8734ae
+	  Realms will always implement additional interfaces, such as
8734ae
+	  #org.freedesktop.realmd.Kerberos.  Do not assume that all realms
8734ae
+	  implement that kerberos interface. Use the
8734ae
+	  #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
8734ae
+	  which interfaces are supported.
8734ae
+
8734ae
+	  Different realms support various ways to configure them on the
8734ae
+	  system. Use the #org.freedesktop.realmd.Realm:Configured property
8734ae
+	  to determine if a realm is configured. If it is configured, the
8734ae
+	  property will be set to the interface of the mechanism that was
8734ae
+	  used to configure it.
8734ae
+
8734ae
+	  To configure a realm, look in the
8734ae
+	  #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
8734ae
+	  recognized purpose-specific interface that can be used for
8734ae
+	  configuration, such as the
8734ae
+	  #org.freedesktop.realmd.KerberosMembership interface and its
8734ae
+	  #org.freedesktop.realmd.KerberosMembership.Join() method.
8734ae
+
8734ae
+	  To deconfigure a realm from the current system, you can use the
8734ae
+	  #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
8734ae
+	  of the configuration specific interfaces provide methods to
8734ae
+	  deconfigure a realm in a specific way, such as the
8734ae
+	  #org.freedesktop.realmd.KerberosMembership.Leave() method.
8734ae
+
8734ae
+	  The various properties are guaranteed to have been updated before
8734ae
+	  the operation methods return, if they change state.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Realm">
8734ae
+
8734ae
+		
8734ae
+		  Name: the realm name
8734ae
+
8734ae
+		  This is the name of the realm, appropriate for display to
8734ae
+		  end users where necessary.
8734ae
+		-->
8734ae
+		<property name="Name" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Configured: whether this domain is configured and how
8734ae
+
8734ae
+		  If this property is an empty string, then the realm is not
8734ae
+		  configured. Otherwise the realm is configured, and contains
8734ae
+		  a string which is the interface that represents how it was
8734ae
+		  configured, for example #org.freedesktop.realmd.KerberosMembership.
8734ae
+		-->
8734ae
+		<property name="Configured" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Deconfigure: deconfigure this realm
8734ae
+
8734ae
+		  Deconfigure this realm from the local machine with standard
8734ae
+		  default behavior.
8734ae
+
8734ae
+		  The behavior of this method depends on the which configuration
8734ae
+		  interface is present in the
8734ae
+		  #org.freedesktop.realmd.Realm.Configured property. It does not
8734ae
+		  always delete membership accounts in the realm, but just
8734ae
+		  reconfigures the local machine so it no longer is configured
8734ae
+		  for the given realm. In some cases the implementation may try
8734ae
+		  to update membership accounts, but this is not guaranteed.
8734ae
+
8734ae
+		  Various configuration interfaces may support more specific ways
8734ae
+		  to deconfigure a realm in a specific way, such as the
8734ae
+		  #org.freedesktop.realmd.KerberosMembership.Leave() method.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the deconfigure failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to deconfigure a
8734ae
+		      realm.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
8734ae
+		      returned if this realm is not configured on the machine.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Deconfigure">
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  SupportedInterfaces:
8734ae
+
8734ae
+		  Additional supported interfaces of this realm. This includes
8734ae
+		  interfaces that contain more information about the realm,
8734ae
+		  such as #org.freedesktop.realmd.Kerberos and interfaces
8734ae
+		  which contain methods for configuring a realm, such as
8734ae
+		  #org.freedesktop.realmd.KerberosMembership.
8734ae
+		-->
8734ae
+		<property name="SupportedInterfaces" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Details: informational details about the realm
8734ae
+
8734ae
+		  Informational details about the realm. The following values
8734ae
+		  should be present:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>server-software</literal>:
8734ae
+		      identifier of the software running on the server (e.g.
8734ae
+		      <literal>active-directory</literal>).</para></listitem>
8734ae
+		    <listitem><para><literal>client-software</literal>:
8734ae
+		      identifier of the software running on the client (e.g.
8734ae
+		      <literal>sssd</literal>).</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="Details" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  RequiredPackages: prerequisite software
8734ae
+
8734ae
+		  Software packages that are required in order for a join to
8734ae
+		  succeed. These are either simple strings like <literal>sssd</literal>,
8734ae
+		  or strings with an operator and version number like
8734ae
+		  <literal>sssd >= 1.9.0</literal>
8734ae
+
8734ae
+		  These values are specific to the packaging system that is
8734ae
+		  being run.
8734ae
+		-->
8734ae
+		<property name="RequiredPackages" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  LoginFormats: supported formats for login names
8734ae
+
8734ae
+		  Supported formats for login to this realm. This is only
8734ae
+		  relevant once the realm has been enrolled. The formats
8734ae
+		  will contain a <literal>%U</literal> in the string, which
8734ae
+		  indicate where the user name should be placed. The formats
8734ae
+		  may contain a <literal>%D</literal> in the string which
8734ae
+		  indicate where a domain name should be placed.
8734ae
+
8734ae
+		  The first format in the list is the preferred format for
8734ae
+		  login names.
8734ae
+		-->
8734ae
+		<property name="LoginFormats" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  LoginPolicy: the policy for logins using this realm
8734ae
+
8734ae
+		  The policy for logging into this computer using this realm.
8734ae
+
8734ae
+		  The policy can be changed using the
8734ae
+		  #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
8734ae
+
8734ae
+		  The following policies are predefined. Not all providers
8734ae
+		  support all these policies and there may be provider specific
8734ae
+		  policies or multiple policies represented in the string:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>allow-any-login</literal>: allow
8734ae
+		      login by any authenticated user present in this
8734ae
+		      realm.</para></listitem>
8734ae
+		    <listitem><para><literal>allow-realm-logins</literal>: allow
8734ae
+		      logins according to the realm or domain policy for logins
8734ae
+		      on this machine. This usually defaults to allowing any realm
8734ae
+		      user to log in.</para></listitem>
8734ae
+		    <listitem><para><literal>allow-permitted-logins</literal>:
8734ae
+		      only allow the logins permitted in the
8734ae
+		      #org.freedesktop.realmd.Realm:PermittedLogins
8734ae
+		      property.</para></listitem>
8734ae
+		    <listitem><para><literal>deny-any-login</literal>:
8734ae
+		      don't allow any logins via authenticated users of this
8734ae
+		      realm.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="LoginPolicy" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  PermittedLogins: the permitted login names
8734ae
+
8734ae
+		  The list of permitted authenticated users allowed to login
8734ae
+		  into this computer. This is only relevant if the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property
8734ae
+		  contains the <literal>allow-permitted-logins</literal>
8734ae
+		  string.
8734ae
+		-->
8734ae
+		<property name="PermittedLogins" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  PermittedGroups: the permitted group names
8734ae
+
8734ae
+		  The list of groups which users need to be in to be allowed
8734ae
+		  to log into this computer. This is only relevant if the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property
8734ae
+		  contains the <literal>allow-permitted-logins</literal>
8734ae
+		  string.
8734ae
+		-->
8734ae
+		<property name="PermittedGroups" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  ChangeLoginPolicy:
8734ae
+		  @login_policy: the new login policy, or an empty string
8734ae
+		  @permitted_add: a list of logins to permit
8734ae
+		  @permitted_remove: a list of logins to not permit
8734ae
+		  @options: options for this operation
8734ae
+
8734ae
+		  Change the login policy and/or permitted logins for this realm.
8734ae
+
8734ae
+		  Not all realms support all the various login policies. An
8734ae
+		  error will be returned if the new login policy is not supported.
8734ae
+		  You may specify an empty string for the @login_policy argument
8734ae
+		  which will cause no change in the policy itself. If the policy
8734ae
+		  is changed, it will be reflected in the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property.
8734ae
+
8734ae
+		  The @permitted_add and @permitted_remove arguments represent
8734ae
+		  lists of login names that should be added and removed from
8734ae
+		  the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>groups</literal>: boolean which if
8734ae
+		    set to <literal>TRUE</literal> means that the names in
8734ae
+		    @permitted_add and @permitted_remove are group names instead
8734ae
+		    of login names.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.login-policy</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the policy change failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to change login policy
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
8734ae
+		      returned if the realm is not configured.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="ChangeLoginPolicy">
8734ae
+			<arg name="login_policy" type="s" direction="in"/>
8734ae
+			<arg name="permitted_add" type="as" direction="in"/>
8734ae
+			<arg name="permitted_remove" type="as" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Kerberos:
8734ae
+	  @short_description: a kerberos realm
8734ae
+
8734ae
+	  An interface that describes a kerberos realm in more detail. This
8734ae
+	  is always implemented on an DBus object path that also implements
8734ae
+	  the #org.freedesktop.realmd.Realm interface.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Kerberos">
8734ae
+
8734ae
+		
8734ae
+		  RealmName: the kerberos realm name
8734ae
+
8734ae
+		  The kerberos name for this realm. This is usually in upper
8734ae
+		  case.
8734ae
+		-->
8734ae
+		<property name="RealmName" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  DomainName: the DNS domain name
8734ae
+
8734ae
+		  The DNS domain name for this realm.
8734ae
+		-->
8734ae
+		<property name="DomainName" type="s" access="read"/>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.KerberosMembership:
8734ae
+
8734ae
+	  An interface used to configure this machine by joining a realm.
8734ae
+
8734ae
+	  It sets up a computer/host account in the realm for this machine
8734ae
+	  and a keytab to track the credentials for that account.
8734ae
+
8734ae
+	  The various properties are guaranteed to have been updated before
8734ae
+	  the operation methods return, if they change state.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.KerberosMembership">
8734ae
+
8734ae
+		
8734ae
+		  SuggestedAdministrator: common administrator name
8734ae
+
8734ae
+		  The common administrator name for this type of realm. This
8734ae
+		  can be used by clients as a hint when prompting the user for
8734ae
+		  administrative authentication.
8734ae
+		-->
8734ae
+		<property name="SuggestedAdministrator" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  SupportedJoinCredentials: credentials supported for joining
8734ae
+
8734ae
+		  Various kinds of credentials that are supported when calling the
8734ae
+		  #org.freedesktop.realmd.Kerberos.Join() method.
8734ae
+
8734ae
+		  Each credential is represented by a type and an owner. The type
8734ae
+		  denotes which kind of credential is passed to the method. The
8734ae
+		  owner indicates to the client how to prompt the user or obtain
8734ae
+		  the credential, and to the service how to use the credential.
8734ae
+
8734ae
+		  The various types are:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>ccache</literal>:
8734ae
+		      the credentials should contain an array of bytes as a
8734ae
+		      <literal>ay</literal> containing the data from a kerberos
8734ae
+		      credential cache file.</para></listitem>
8734ae
+		    <listitem><para><literal>password</literal>:
8734ae
+		      the credentials should contain a pair of strings as a
8734ae
+		      <literal>(ss)</literal> representing a name and
8734ae
+		      password. The name may contain a realm in the standard
8734ae
+		      kerberos format. If a realm is missing, it will default
8734ae
+		      to this realm. </para></listitem>
8734ae
+		    <listitem><para><literal>secret</literal>:
8734ae
+		      the credentials should contain a string secret as an
8734ae
+		      <literal>ay</literal> array of bytes. This is usually used
8734ae
+		      for one time passwords. To pass a string here, encode it
8734ae
+		      in UTF-8, and place the resulting bytes in the
8734ae
+		      value.</para></listitem>
8734ae
+		    <listitem><para><literal>automatic</literal>:
8734ae
+		      the credentials should contain an empty string as a
8734ae
+		      <literal>s</literal>. Using <literal>automatic</literal>
8734ae
+		      indicates that default or system credentials are to be
8734ae
+		      used.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  The various owners are:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>administrator</literal>:
8734ae
+		      the credentials belong to a kerberos administrator principal.
8734ae
+		      The caller may use this as a hint to prompt the user
8734ae
+		      for administrative credentials.</para></listitem>
8734ae
+		    <listitem><para><literal>user</literal>:
8734ae
+		      the credentials belong to a kerberos user principal.
8734ae
+		      The caller may use this as a hint to prompt the user
8734ae
+		      for his (possibly non-administrative)
8734ae
+		      credentials.</para></listitem>
8734ae
+		    <listitem><para><literal>computer</literal>:
8734ae
+		      the credentials belong to a computer account.</para></listitem>
8734ae
+		    <listitem><para><literal>none</literal>:
8734ae
+		      the credentials have an unspecified owner, such as a one
8734ae
+		      time password.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  SupportedLeaveCredentials: credentials supported for leaving
8734ae
+
8734ae
+		  Various kinds of credentials that are supported when calling the
8734ae
+		  #org.freedesktop.realmd.Kerberos.Leave() method.
8734ae
+
8734ae
+		  See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
8734ae
+		  a discussion of what the values represent.
8734ae
+		-->
8734ae
+		<property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Join:
8734ae
+
8734ae
+		  Join this machine to the realm and enroll the machine.
8734ae
+
8734ae
+		  If this method returns successfully, then the machine will be
8734ae
+		  joined to the realm. It is not necessary to restart services or the
8734ae
+		  machine afterward. Relevant properties on the realm will be updated
8734ae
+		  before the method returns.
8734ae
+
8734ae
+		  The @credentials should be set according to one of the
8734ae
+		  supported credentials returned by
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
8734ae
+		  The first string in the tuple is the type, the second string
8734ae
+		  is the owner, and the variant contains the credential contents
8734ae
+		  See the discussion at
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
8734ae
+		  for more information.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+                    <listitem><para><literal>automatic-id-mapping</literal>: a boolean
8734ae
+                      value whether to turn on automatic UID/GID mapping. If not
8734ae
+		      specified the default will come from realmd.conf
8734ae
+                      configuration.</para></listitem>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>computer-ou</literal>: a string
8734ae
+		      containing an LDAP DN for an organizational unit where the
8734ae
+		      computer account should be created</para></listitem>
8734ae
+		    <listitem><para><literal>user-principal</literal>: a string
8734ae
+		      containing an kerberos user principal name to be set on the
8734ae
+		      computer account</para></listitem>
8734ae
+		    <listitem><para><literal>membership-software</literal>: a string
8734ae
+		      containing the membership software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>manage-system</literal>: a boolean
8734ae
+		      which controls whether this machine should be managed by
8734ae
+		      the realm or domain or not. Defaults to true.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.configure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the join failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform a join
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
8734ae
+		      returned if the credentials passed did not authenticate against the realm
8734ae
+		      correctly. It is appropriate to prompt the user again.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
8734ae
+		      returned if already enrolled in this realm, or if already enrolled in another realm
8734ae
+		      (if enrolling in multiple realms is not supported).</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
8734ae
+		      returned if the machine has a hostname that is not usable for a join
8734ae
+		      or is in conflict with those in the domain.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Join">
8734ae
+			<arg name="credentials" type="(ssv)" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  Leave:
8734ae
+
8734ae
+		  Leave the realm and unenroll the machine.
8734ae
+
8734ae
+		  If this method returns successfully, then the machine will have
8734ae
+		  left the domain and been unenrolled. It is not necessary to restart
8734ae
+		  services or the machine afterward. Relevant properties on the realm
8734ae
+		  will be updated before the method returns.
8734ae
+
8734ae
+		  The @credentials should be set according to one of the
8734ae
+		  supported credentials returned by
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
8734ae
+		  The first string in the tuple is the type, the second string
8734ae
+		  is the owner, and the variant contains the credential contents
8734ae
+		  See the discussion at
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
8734ae
+		  for more information.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the unenroll failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform an unenroll
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
8734ae
+		      returned if the credentials passed did not authenticate against the realm
8734ae
+		      correctly. It is appropriate to prompt the user again.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
8734ae
+		      returned if not enrolled in this realm.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Leave">
8734ae
+			<arg name="credentials" type="(ssv)" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+</node>
8734ae
diff --git a/src/daemon.c b/src/daemon.c
0c7e6b
index c52bda3..5ce0216 100644
8734ae
--- a/src/daemon.c
8734ae
+++ b/src/daemon.c
8734ae
@@ -20,60 +20,61 @@
8734ae
  * Written by: Matthias Clasen <mclasen@redhat.com>
8734ae
  */
8734ae
 
8734ae
 #include "config.h"
8734ae
 
8734ae
 #include <stdlib.h>
8734ae
 #include <stdio.h>
8734ae
 #include <sys/types.h>
8734ae
 #include <sys/stat.h>
8734ae
 #include <fcntl.h>
8734ae
 #include <sys/wait.h>
8734ae
 #include <pwd.h>
8734ae
 #ifdef HAVE_SHADOW_H
8734ae
 #include <shadow.h>
8734ae
 #endif
8734ae
 #include <unistd.h>
8734ae
 #include <errno.h>
8734ae
 #include <sys/types.h>
8734ae
 
8734ae
 #include <glib.h>
8734ae
 #include <glib/gi18n.h>
8734ae
 #include <glib-object.h>
8734ae
 #include <glib/gstdio.h>
8734ae
 #include <gio/gio.h>
8734ae
 #include <polkit/polkit.h>
8734ae
 
8734ae
 #include "user-classify.h"
8734ae
 #include "wtmp-helper.h"
8734ae
 #include "daemon.h"
8734ae
 #include "util.h"
8734ae
+#include "realmd-generated.h"
8734ae
 
8734ae
 #define PATH_PASSWD "/etc/passwd"
8734ae
 #define PATH_SHADOW "/etc/shadow"
8734ae
 #define PATH_GROUP "/etc/group"
8734ae
 
8734ae
 enum {
8734ae
         PROP_0,
8734ae
         PROP_DAEMON_VERSION
8734ae
 };
8734ae
 
0c7e6b
 typedef struct {
8734ae
         GDBusConnection *bus_connection;
8734ae
 
8734ae
         GHashTable *users;
8734ae
         gsize number_of_normal_users;
8734ae
         GList *explicitly_requested_users;
8734ae
 
8734ae
         User *autologin;
8734ae
 
8734ae
         GFileMonitor *passwd_monitor;
8734ae
         GFileMonitor *shadow_monitor;
8734ae
         GFileMonitor *group_monitor;
8734ae
         GFileMonitor *gdm_monitor;
8734ae
         GFileMonitor *wtmp_monitor;
8734ae
 
0c7e6b
         GQueue *pending_list_cached_users;
0c7e6b
 
8734ae
         guint reload_id;
8734ae
         guint autologin_id;
8734ae
 
0c7e6b
@@ -425,110 +426,167 @@ load_entries (Daemon             *daemon,
8734ae
                         } else {
8734ae
                                 g_object_ref (user);
8734ae
                         }
8734ae
 
8734ae
                         /* freeze & update users not already in the new list */
8734ae
                         g_object_freeze_notify (G_OBJECT (user));
8734ae
                         user_update_from_pwent (user, pwent, spent);
8734ae
 
8734ae
                         g_hash_table_insert (users, g_strdup (user_get_user_name (user)), user);
8734ae
                         g_debug ("loaded user: %s", user_get_user_name (user));
8734ae
                 }
8734ae
 
8734ae
                 if (!explicitly_requested) {
8734ae
                         user_set_cached (user, TRUE);
8734ae
                 }
8734ae
         }
8734ae
 
8734ae
         /* Generator should have cleaned up */
8734ae
         g_assert (generator_state == NULL);
8734ae
 }
8734ae
 
8734ae
 static GHashTable *
8734ae
 create_users_hash_table (void)
8734ae
 {
8734ae
         return g_hash_table_new_full (g_str_hash,
8734ae
                                       g_str_equal,
8734ae
                                       g_free,
8734ae
                                       g_object_unref);
8734ae
 }
8734ae
 
8734ae
+static gboolean
8734ae
+ensure_bus_connection (Daemon *daemon)
8734ae
+{
0c7e6b
+        DaemonPrivate *priv = daemon_get_instance_private (daemon);
8734ae
+        g_autoptr (GError) error = NULL;
8734ae
+
0c7e6b
+        if (priv->bus_connection != NULL)
8734ae
+                return TRUE;
8734ae
+
0c7e6b
+        priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
0c7e6b
+        if (priv->bus_connection == NULL) {
8734ae
+                if (error != NULL)
8734ae
+                        g_critical ("error getting system bus: %s", error->message);
8734ae
+                return FALSE;
8734ae
+        }
8734ae
+
8734ae
+        return TRUE;
8734ae
+}
8734ae
+
8734ae
+static gboolean
8734ae
+has_network_realms (Daemon *daemon)
8734ae
+{
0c7e6b
+        DaemonPrivate *priv = daemon_get_instance_private (daemon);
8734ae
+        g_autoptr (AccountsRealmdProvider) realmd_provider = NULL;
8734ae
+        g_autoptr (GError) error = NULL;
8734ae
+        const char *const *realms = NULL;
8734ae
+
8734ae
+        if (!ensure_bus_connection (daemon)) {
8734ae
+                return FALSE;
8734ae
+        }
8734ae
+
0c7e6b
+        realmd_provider = accounts_realmd_provider_proxy_new_sync (priv->bus_connection,
8734ae
+                                                                   G_DBUS_PROXY_FLAGS_NONE,
8734ae
+                                                                   "org.freedesktop.realmd",
8734ae
+                                                                   "/org/freedesktop/realmd",
8734ae
+                                                                   NULL,
8734ae
+                                                                   &error);
8734ae
+        if (realmd_provider == NULL) {
8734ae
+                g_debug ("failed to contact realmd: %s", error->message);
8734ae
+                return FALSE;
8734ae
+        }
8734ae
+
8734ae
+        realms = accounts_realmd_provider_get_realms (realmd_provider);
8734ae
+
8734ae
+        if (!realms) {
8734ae
+                g_debug("realmd provider 'Realms' property is unset");
8734ae
+                return FALSE;
8734ae
+        }
8734ae
+
8734ae
+        return realms[0] != NULL;
8734ae
+}
8734ae
+
8734ae
 static void
8734ae
 reload_users (Daemon *daemon)
8734ae
 {
0c7e6b
         DaemonPrivate *priv = daemon_get_instance_private (daemon);
8734ae
         AccountsAccounts *accounts = ACCOUNTS_ACCOUNTS (daemon);
8734ae
         gboolean had_no_users, has_no_users, had_multiple_users, has_multiple_users;
8734ae
         GHashTable *users;
8734ae
         GHashTable *old_users;
8734ae
         GHashTable *local;
8734ae
         GHashTableIter iter;
8734ae
         gsize number_of_normal_users = 0;
8734ae
         gpointer name, value;
8734ae
 
8734ae
         /* Track the users that we saw during our (re)load */
8734ae
         users = create_users_hash_table ();
8734ae
 
8734ae
         /*
8734ae
          * NOTE: As we load data from all the sources, notifies are
8734ae
          * frozen in load_entries() and then thawed as we process
8734ae
          * them below.
8734ae
          */
8734ae
 
8734ae
         /* Load the local users into our hash table */
8734ae
         load_entries (daemon, users, FALSE, entry_generator_fgetpwent);
8734ae
         local = g_hash_table_new (g_str_hash, g_str_equal);
8734ae
         g_hash_table_iter_init (&iter, users);
8734ae
         while (g_hash_table_iter_next (&iter, &name, NULL))
8734ae
                 g_hash_table_add (local, name);
8734ae
 
8734ae
         /* and add users to hash table that were explicitly requested  */
8734ae
         load_entries (daemon, users, TRUE, entry_generator_requested_users);
8734ae
 
8734ae
         /* Now add/update users from other sources, possibly non-local */
8734ae
         load_entries (daemon, users, FALSE, entry_generator_cachedir);
8734ae
 
8734ae
         wtmp_helper_update_login_frequencies (users);
8734ae
 
8734ae
         /* Count the non-system users. Mark which users are local, which are not. */
8734ae
         g_hash_table_iter_init (&iter, users);
8734ae
         while (g_hash_table_iter_next (&iter, &name, &value)) {
8734ae
                 User *user = value;
8734ae
                 if (!user_get_system_account (user))
8734ae
                         number_of_normal_users++;
8734ae
                 user_update_local_account_property (user, g_hash_table_lookup (local, name) != NULL);
8734ae
         }
8734ae
         g_hash_table_destroy (local);
8734ae
 
8734ae
         had_no_users = accounts_accounts_get_has_no_users (accounts);
8734ae
         has_no_users = number_of_normal_users == 0;
8734ae
 
8734ae
+        if (has_no_users && has_network_realms (daemon)) {
8734ae
+                g_debug ("No local users, but network realms detected, presuming there are remote users");
8734ae
+                has_no_users = FALSE;
8734ae
+        }
8734ae
+
8734ae
         if (had_no_users != has_no_users)
8734ae
                 accounts_accounts_set_has_no_users (accounts, has_no_users);
8734ae
 
8734ae
         had_multiple_users = accounts_accounts_get_has_multiple_users (accounts);
8734ae
         has_multiple_users = number_of_normal_users > 1;
8734ae
 
8734ae
         if (had_multiple_users != has_multiple_users)
8734ae
                 accounts_accounts_set_has_multiple_users (accounts, has_multiple_users);
8734ae
 
8734ae
         /* Swap out the users */
0c7e6b
         old_users = priv->users;
0c7e6b
         priv->users = users;
8734ae
 
8734ae
         /* Remove all the old users */
8734ae
         g_hash_table_iter_init (&iter, old_users);
8734ae
         while (g_hash_table_iter_next (&iter, &name, &value)) {
8734ae
                 User *user = value;
8734ae
                 User *refreshed_user;
8734ae
 
8734ae
                 refreshed_user = g_hash_table_lookup (users, name);
8734ae
 
8734ae
                 if (!refreshed_user || (user_get_cached (user) && !user_get_cached (refreshed_user))) {
8734ae
                         accounts_accounts_emit_user_deleted (ACCOUNTS_ACCOUNTS (daemon),
8734ae
                                                              user_get_object_path (user));
8734ae
                         user_unregister (user);
8734ae
                 }
8734ae
         }
8734ae
 
8734ae
         /* Register all the new users */
8734ae
         g_hash_table_iter_init (&iter, users);
0c7e6b
@@ -766,64 +824,61 @@ daemon_finalize (GObject *object)
0c7e6b
         priv = daemon_get_instance_private (daemon);
8734ae
 
0c7e6b
         if (priv->bus_connection != NULL)
0c7e6b
                 g_object_unref (priv->bus_connection);
8734ae
 
0c7e6b
         g_queue_free_full (priv->pending_list_cached_users,
0c7e6b
                            (GDestroyNotify) list_user_data_free);
8734ae
 
0c7e6b
         g_list_free_full (priv->explicitly_requested_users, g_free);
8734ae
 
0c7e6b
         g_hash_table_destroy (priv->users);
8734ae
 
0c7e6b
         g_hash_table_unref (priv->extension_ifaces);
8734ae
 
8734ae
         G_OBJECT_CLASS (daemon_parent_class)->finalize (object);
8734ae
 }
8734ae
 
8734ae
 static gboolean
8734ae
 register_accounts_daemon (Daemon *daemon)
8734ae
 {
0c7e6b
         DaemonPrivate *priv = daemon_get_instance_private (daemon);
8734ae
         g_autoptr(GError) error = NULL;
8734ae
 
0c7e6b
         priv->authority = polkit_authority_get_sync (NULL, &error);
0c7e6b
         if (priv->authority == NULL) {
8734ae
                 if (error != NULL)
8734ae
                         g_critical ("error getting polkit authority: %s", error->message);
8734ae
                 return FALSE;
8734ae
         }
8734ae
 
0c7e6b
-        priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
0c7e6b
-        if (priv->bus_connection == NULL) {
8734ae
-                if (error != NULL)
8734ae
-                        g_critical ("error getting system bus: %s", error->message);
8734ae
+        if (!ensure_bus_connection (daemon)) {
8734ae
                 return FALSE;
8734ae
         }
8734ae
 
8734ae
         if (!g_dbus_interface_skeleton_export (G_DBUS_INTERFACE_SKELETON (daemon),
0c7e6b
                                                priv->bus_connection,
8734ae
                                                "/org/freedesktop/Accounts",
8734ae
                                                &error)) {
8734ae
                 if (error != NULL)
8734ae
                         g_critical ("error exporting interface: %s", error->message);
8734ae
                 return FALSE;
8734ae
         }
8734ae
 
8734ae
         return TRUE;
8734ae
 }
8734ae
 
8734ae
 Daemon *
8734ae
 daemon_new (void)
8734ae
 {
8734ae
         g_autoptr(Daemon) daemon = NULL;
8734ae
 
8734ae
         daemon = DAEMON (g_object_new (TYPE_DAEMON, NULL));
8734ae
 
8734ae
         if (!register_accounts_daemon (DAEMON (daemon))) {
8734ae
                 return NULL;
8734ae
         }
8734ae
 
8734ae
         return g_steal_pointer (&daemon);
8734ae
 }
8734ae
 
8734ae
 static void
0c7e6b
diff --git a/src/meson.build b/src/meson.build
0c7e6b
index 20d5276..3970749 100644
0c7e6b
--- a/src/meson.build
0c7e6b
+++ b/src/meson.build
0c7e6b
@@ -1,37 +1,38 @@
0c7e6b
 sources = []
0c7e6b
 
0c7e6b
 gdbus_headers = []
0c7e6b
 
0c7e6b
 ifaces = [
0c7e6b
   ['accounts-generated', 'org.freedesktop.', 'Accounts'],
0c7e6b
   ['accounts-user-generated', act_namespace + '.', 'User'],
0c7e6b
+  ['realmd-generated', 'org.freedesktop.', 'realmd'],
0c7e6b
 ]
0c7e6b
 
0c7e6b
 foreach iface: ifaces
0c7e6b
   gdbus_sources = gnome.gdbus_codegen(
0c7e6b
     iface[0],
0c7e6b
     join_paths(data_dir, iface[1] + iface[2] + '.xml'),
0c7e6b
     interface_prefix: iface[1],
0c7e6b
     namespace: 'Accounts',
0c7e6b
   )
0c7e6b
   sources += gdbus_sources
0c7e6b
   gdbus_headers += gdbus_sources[1]
0c7e6b
 endforeach
0c7e6b
 
0c7e6b
 deps = [
0c7e6b
   gio_dep,
0c7e6b
   gio_unix_dep,
0c7e6b
 ]
0c7e6b
 
0c7e6b
 cflags = [
0c7e6b
   '-DLOCALSTATEDIR="@0@"'.format(act_localstatedir),
0c7e6b
   '-DDATADIR="@0@"'.format(act_datadir),
0c7e6b
   '-DICONDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'icons')),
0c7e6b
   '-DUSERDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'users')),
0c7e6b
 ]
0c7e6b
 
0c7e6b
 libaccounts_generated = static_library(
0c7e6b
   'accounts-generated',
0c7e6b
   sources: sources,
0c7e6b
   include_directories: top_inc,
0c7e6b
   dependencies: deps,
8734ae
diff --git a/src/org.freedesktop.realmd.xml b/src/org.freedesktop.realmd.xml
8734ae
new file mode 100644
8734ae
index 0000000..c34a47a
8734ae
--- /dev/null
8734ae
+++ b/src/org.freedesktop.realmd.xml
8734ae
@@ -0,0 +1,730 @@
8734ae
+
8734ae
+ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
8734ae
+<node name="/">
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Provider:
8734ae
+	  @short_description: a realm provider
8734ae
+
8734ae
+	  Various realm providers represent different software implementations
8734ae
+	  that provide access to realms or domains.
8734ae
+
8734ae
+	  This interface is implemented by individual providers, but is
8734ae
+	  aggregated globally at the system bus name
8734ae
+	  <literal>org.freedesktop.realmd</literal>
8734ae
+	  with the object path <literal>/org/freedesktop/realmd</literal>
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Provider">
8734ae
+
8734ae
+		
8734ae
+		  Name: the name of the provider
8734ae
+
8734ae
+		  The name of the provider. This is not normally displayed
8734ae
+		  to the user, but may be useful for diagnostics or debugging.
8734ae
+		-->
8734ae
+		<property name="Name" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Version: the version of the provider
8734ae
+
8734ae
+		  The version of the provider. This is not normally used in
8734ae
+		  logic, but may be useful for diagnostics or debugging.
8734ae
+		-->
8734ae
+		<property name="Version" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Realms: a list of realms
8734ae
+
8734ae
+		  A list of known, enrolled or discovered realms. All realms
8734ae
+		  that this provider knows about are listed here. As realms
8734ae
+		  are discovered they are added to this list.
8734ae
+
8734ae
+		  Each realm is represented by the DBus object path of the
8734ae
+		  realm object.
8734ae
+		-->
8734ae
+		<property name="Realms" type="ao" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Discover:
8734ae
+		  @string: an input string to discover realms for
8734ae
+		  @options: options for the discovery operation
8734ae
+		  @relevance: the relevance of the returned results
8734ae
+		  @realm: a list of realms discovered
8734ae
+
8734ae
+		  Discover realms for the given string. The input @string is
8734ae
+		  usually a domain or realm name, perhaps typed by a user. If
8734ae
+		  an empty string is provided, the realm provider should try to
8734ae
+		  discover a default realm, if possible (e.g. from DHCP).
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>client-software</literal>: a string
8734ae
+		      containing the client software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>server-software</literal>: a string
8734ae
+		      containing the client software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>membership-software</literal>: a string
8734ae
+		      containing the membership software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  The @relevance returned can be used to rank results from
8734ae
+		  different discover calls to different providers. Implementors
8734ae
+		  should return a positive number if the provider highly
8734ae
+		  recommends that the realms be handled by this provider,
8734ae
+		  or a zero if it can possibly handle the realms. Negative numbers
8734ae
+		  should be returned if no realms are found.
8734ae
+
8734ae
+		  This method does not return an error when no realms are
8734ae
+		  discovered. It simply returns an empty @realm list.
8734ae
+
8734ae
+		  To see diagnostic information about the discovery process,
8734ae
+		  connect to the org.freedesktop.realmd.Service::Diagnostics
8734ae
+		  signal.
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.discover-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may
8734ae
+		  return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the discovery could not be run for some reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform a discovery
8734ae
+		      operation.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Discover">
8734ae
+			<arg name="string" type="s" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+			<arg name="relevance" type="i" direction="out"/>
8734ae
+			<arg name="realm" type="ao" direction="out"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Service:
8734ae
+	  @short_description: the realmd service
8734ae
+
8734ae
+	  Global calls for managing the realmd service. Usually you'll want
8734ae
+	  to use #org.freedesktop.realmd.Provider instead.
8734ae
+
8734ae
+	  This interface is implemented by the realmd service, and is always
8734ae
+	  available at the object path <literal>/org/freedesktop/realmd</literal>
8734ae
+
8734ae
+	  The service also implements the
8734ae
+	  <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
8734ae
+	  makes it easy to retrieve all realmd objects and properties in one go.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Service">
8734ae
+
8734ae
+		
8734ae
+		  Cancel:
8734ae
+		  @operation: the operation to cancel
8734ae
+
8734ae
+		  Cancel a realmd operation. To be able to cancel an operation,
8734ae
+		  pass a uniquely chosen <literal>operation</literal> string
8734ae
+		  identifier as an option in the method's <literal>options</literal>
8734ae
+		  argument.
8734ae
+
8734ae
+		  These operation string identifiers should be unique per client
8734ae
+		  calling the realmd service.
8734ae
+
8734ae
+		  It is not guaranteed that the service can or will cancel the
8734ae
+		  operation. For example, the operation may have already completed
8734ae
+		  by the time this method is handled. The caller of the operation
8734ae
+		  method will receive a
8734ae
+		  <literal>org.freedesktop.realmd.Error.Cancelled</literal>
8734ae
+		  if the operation was cancelled.
8734ae
+		-->
8734ae
+		<method name="Cancel">
8734ae
+			<arg name="operation" type="s" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  SetLocale:
8734ae
+		  @locale: the locale for the client
8734ae
+
8734ae
+		  Set the language @locale for the client. This locale is used
8734ae
+		  for error messages. The locale is used until the next time
8734ae
+		  this method is called, the client disconnects, or the client
8734ae
+		  calls #org.freedesktop.realmd.Service.Release().
8734ae
+		-->
8734ae
+		<method name="SetLocale">
8734ae
+			<arg name="locale" type="s" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  Diagnostics:
8734ae
+		  @data: diagnostic data
8734ae
+		  @operation: the operation this data resulted from
8734ae
+
8734ae
+		  This signal is fired when diagnostics result from an operation
8734ae
+		  in the provider or one of its realms.
8734ae
+
8734ae
+		  It is not guaranteed that this signal is emitted once per line.
8734ae
+		  More than one line may be contained in @data, or a partial
8734ae
+		  line. New line characters are embedded in @data.
8734ae
+
8734ae
+		  This signal is sent explicitly to the client which invoked an
8734ae
+		  operation method. In order to tell which operation this
8734ae
+		  diagnostic data results from, pass a unique
8734ae
+		  <literal>operation</literal> string identifier in the
8734ae
+		  <literal>options</literal> argument of the operation method.
8734ae
+		  That same identifier will be passed back via the @operation
8734ae
+		  argument of this signal.
8734ae
+		-->
8734ae
+		<signal name="Diagnostics">
8734ae
+			<arg name="data" type="s"/>
8734ae
+			<arg name="operation" type="s"/>
8734ae
+		</signal>
8734ae
+
8734ae
+		
8734ae
+		  Release:
8734ae
+
8734ae
+		  Normally, realmd waits until all clients have disconnected
8734ae
+		  before exiting itself sometime later. Long lived clients
8734ae
+		  can call this method to allow the realmd service to quit.
8734ae
+		  This is an optimization. The daemon will not exit immediately.
8734ae
+		  It is safe to call this multiple times.
8734ae
+		-->
8734ae
+		<method name="Release">
8734ae
+			
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Realm:
8734ae
+	  @short_description: a realm
8734ae
+
8734ae
+	  Represents one realm.
8734ae
+
8734ae
+	  Contains generic information about a realm, and useful properties for
8734ae
+	  introspecting what kind of realm this is and how to work with
8734ae
+	  the realm.
8734ae
+
8734ae
+	  Use #org.freedesktop.realmd.Provider:Realms or
8734ae
+	  #org.freedesktop.realmd.Provider.Discover() to get access to some
8734ae
+	  kerberos realm objects.
8734ae
+
8734ae
+	  Realms will always implement additional interfaces, such as
8734ae
+	  #org.freedesktop.realmd.Kerberos.  Do not assume that all realms
8734ae
+	  implement that kerberos interface. Use the
8734ae
+	  #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
8734ae
+	  which interfaces are supported.
8734ae
+
8734ae
+	  Different realms support various ways to configure them on the
8734ae
+	  system. Use the #org.freedesktop.realmd.Realm:Configured property
8734ae
+	  to determine if a realm is configured. If it is configured, the
8734ae
+	  property will be set to the interface of the mechanism that was
8734ae
+	  used to configure it.
8734ae
+
8734ae
+	  To configure a realm, look in the
8734ae
+	  #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
8734ae
+	  recognized purpose-specific interface that can be used for
8734ae
+	  configuration, such as the
8734ae
+	  #org.freedesktop.realmd.KerberosMembership interface and its
8734ae
+	  #org.freedesktop.realmd.KerberosMembership.Join() method.
8734ae
+
8734ae
+	  To deconfigure a realm from the current system, you can use the
8734ae
+	  #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
8734ae
+	  of the configuration specific interfaces provide methods to
8734ae
+	  deconfigure a realm in a specific way, such as the
8734ae
+	  #org.freedesktop.realmd.KerberosMembership.Leave() method.
8734ae
+
8734ae
+	  The various properties are guaranteed to have been updated before
8734ae
+	  the operation methods return, if they change state.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Realm">
8734ae
+
8734ae
+		
8734ae
+		  Name: the realm name
8734ae
+
8734ae
+		  This is the name of the realm, appropriate for display to
8734ae
+		  end users where necessary.
8734ae
+		-->
8734ae
+		<property name="Name" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Configured: whether this domain is configured and how
8734ae
+
8734ae
+		  If this property is an empty string, then the realm is not
8734ae
+		  configured. Otherwise the realm is configured, and contains
8734ae
+		  a string which is the interface that represents how it was
8734ae
+		  configured, for example #org.freedesktop.realmd.KerberosMembership.
8734ae
+		-->
8734ae
+		<property name="Configured" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Deconfigure: deconfigure this realm
8734ae
+
8734ae
+		  Deconfigure this realm from the local machine with standard
8734ae
+		  default behavior.
8734ae
+
8734ae
+		  The behavior of this method depends on the which configuration
8734ae
+		  interface is present in the
8734ae
+		  #org.freedesktop.realmd.Realm.Configured property. It does not
8734ae
+		  always delete membership accounts in the realm, but just
8734ae
+		  reconfigures the local machine so it no longer is configured
8734ae
+		  for the given realm. In some cases the implementation may try
8734ae
+		  to update membership accounts, but this is not guaranteed.
8734ae
+
8734ae
+		  Various configuration interfaces may support more specific ways
8734ae
+		  to deconfigure a realm in a specific way, such as the
8734ae
+		  #org.freedesktop.realmd.KerberosMembership.Leave() method.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the deconfigure failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to deconfigure a
8734ae
+		      realm.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
8734ae
+		      returned if this realm is not configured on the machine.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Deconfigure">
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  SupportedInterfaces:
8734ae
+
8734ae
+		  Additional supported interfaces of this realm. This includes
8734ae
+		  interfaces that contain more information about the realm,
8734ae
+		  such as #org.freedesktop.realmd.Kerberos and interfaces
8734ae
+		  which contain methods for configuring a realm, such as
8734ae
+		  #org.freedesktop.realmd.KerberosMembership.
8734ae
+		-->
8734ae
+		<property name="SupportedInterfaces" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Details: informational details about the realm
8734ae
+
8734ae
+		  Informational details about the realm. The following values
8734ae
+		  should be present:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>server-software</literal>:
8734ae
+		      identifier of the software running on the server (e.g.
8734ae
+		      <literal>active-directory</literal>).</para></listitem>
8734ae
+		    <listitem><para><literal>client-software</literal>:
8734ae
+		      identifier of the software running on the client (e.g.
8734ae
+		      <literal>sssd</literal>).</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="Details" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  RequiredPackages: prerequisite software
8734ae
+
8734ae
+		  Software packages that are required in order for a join to
8734ae
+		  succeed. These are either simple strings like <literal>sssd</literal>,
8734ae
+		  or strings with an operator and version number like
8734ae
+		  <literal>sssd >= 1.9.0</literal>
8734ae
+
8734ae
+		  These values are specific to the packaging system that is
8734ae
+		  being run.
8734ae
+		-->
8734ae
+		<property name="RequiredPackages" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  LoginFormats: supported formats for login names
8734ae
+
8734ae
+		  Supported formats for login to this realm. This is only
8734ae
+		  relevant once the realm has been enrolled. The formats
8734ae
+		  will contain a <literal>%U</literal> in the string, which
8734ae
+		  indicate where the user name should be placed. The formats
8734ae
+		  may contain a <literal>%D</literal> in the string which
8734ae
+		  indicate where a domain name should be placed.
8734ae
+
8734ae
+		  The first format in the list is the preferred format for
8734ae
+		  login names.
8734ae
+		-->
8734ae
+		<property name="LoginFormats" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  LoginPolicy: the policy for logins using this realm
8734ae
+
8734ae
+		  The policy for logging into this computer using this realm.
8734ae
+
8734ae
+		  The policy can be changed using the
8734ae
+		  #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
8734ae
+
8734ae
+		  The following policies are predefined. Not all providers
8734ae
+		  support all these policies and there may be provider specific
8734ae
+		  policies or multiple policies represented in the string:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>allow-any-login</literal>: allow
8734ae
+		      login by any authenticated user present in this
8734ae
+		      realm.</para></listitem>
8734ae
+		    <listitem><para><literal>allow-realm-logins</literal>: allow
8734ae
+		      logins according to the realm or domain policy for logins
8734ae
+		      on this machine. This usually defaults to allowing any realm
8734ae
+		      user to log in.</para></listitem>
8734ae
+		    <listitem><para><literal>allow-permitted-logins</literal>:
8734ae
+		      only allow the logins permitted in the
8734ae
+		      #org.freedesktop.realmd.Realm:PermittedLogins
8734ae
+		      property.</para></listitem>
8734ae
+		    <listitem><para><literal>deny-any-login</literal>:
8734ae
+		      don't allow any logins via authenticated users of this
8734ae
+		      realm.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="LoginPolicy" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  PermittedLogins: the permitted login names
8734ae
+
8734ae
+		  The list of permitted authenticated users allowed to login
8734ae
+		  into this computer. This is only relevant if the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property
8734ae
+		  contains the <literal>allow-permitted-logins</literal>
8734ae
+		  string.
8734ae
+		-->
8734ae
+		<property name="PermittedLogins" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  PermittedGroups: the permitted group names
8734ae
+
8734ae
+		  The list of groups which users need to be in to be allowed
8734ae
+		  to log into this computer. This is only relevant if the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property
8734ae
+		  contains the <literal>allow-permitted-logins</literal>
8734ae
+		  string.
8734ae
+		-->
8734ae
+		<property name="PermittedGroups" type="as" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  ChangeLoginPolicy:
8734ae
+		  @login_policy: the new login policy, or an empty string
8734ae
+		  @permitted_add: a list of logins to permit
8734ae
+		  @permitted_remove: a list of logins to not permit
8734ae
+		  @options: options for this operation
8734ae
+
8734ae
+		  Change the login policy and/or permitted logins for this realm.
8734ae
+
8734ae
+		  Not all realms support all the various login policies. An
8734ae
+		  error will be returned if the new login policy is not supported.
8734ae
+		  You may specify an empty string for the @login_policy argument
8734ae
+		  which will cause no change in the policy itself. If the policy
8734ae
+		  is changed, it will be reflected in the
8734ae
+		  #org.freedesktop.realmd.Realm:LoginPolicy property.
8734ae
+
8734ae
+		  The @permitted_add and @permitted_remove arguments represent
8734ae
+		  lists of login names that should be added and removed from
8734ae
+		  the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>groups</literal>: boolean which if
8734ae
+		    set to <literal>TRUE</literal> means that the names in
8734ae
+		    @permitted_add and @permitted_remove are group names instead
8734ae
+		    of login names.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.login-policy</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the policy change failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to change login policy
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
8734ae
+		      returned if the realm is not configured.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="ChangeLoginPolicy">
8734ae
+			<arg name="login_policy" type="s" direction="in"/>
8734ae
+			<arg name="permitted_add" type="as" direction="in"/>
8734ae
+			<arg name="permitted_remove" type="as" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.Kerberos:
8734ae
+	  @short_description: a kerberos realm
8734ae
+
8734ae
+	  An interface that describes a kerberos realm in more detail. This
8734ae
+	  is always implemented on an DBus object path that also implements
8734ae
+	  the #org.freedesktop.realmd.Realm interface.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.Kerberos">
8734ae
+
8734ae
+		
8734ae
+		  RealmName: the kerberos realm name
8734ae
+
8734ae
+		  The kerberos name for this realm. This is usually in upper
8734ae
+		  case.
8734ae
+		-->
8734ae
+		<property name="RealmName" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  DomainName: the DNS domain name
8734ae
+
8734ae
+		  The DNS domain name for this realm.
8734ae
+		-->
8734ae
+		<property name="DomainName" type="s" access="read"/>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+	
8734ae
+	  org.freedesktop.realmd.KerberosMembership:
8734ae
+
8734ae
+	  An interface used to configure this machine by joining a realm.
8734ae
+
8734ae
+	  It sets up a computer/host account in the realm for this machine
8734ae
+	  and a keytab to track the credentials for that account.
8734ae
+
8734ae
+	  The various properties are guaranteed to have been updated before
8734ae
+	  the operation methods return, if they change state.
8734ae
+	-->
8734ae
+	<interface name="org.freedesktop.realmd.KerberosMembership">
8734ae
+
8734ae
+		
8734ae
+		  SuggestedAdministrator: common administrator name
8734ae
+
8734ae
+		  The common administrator name for this type of realm. This
8734ae
+		  can be used by clients as a hint when prompting the user for
8734ae
+		  administrative authentication.
8734ae
+		-->
8734ae
+		<property name="SuggestedAdministrator" type="s" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  SupportedJoinCredentials: credentials supported for joining
8734ae
+
8734ae
+		  Various kinds of credentials that are supported when calling the
8734ae
+		  #org.freedesktop.realmd.Kerberos.Join() method.
8734ae
+
8734ae
+		  Each credential is represented by a type and an owner. The type
8734ae
+		  denotes which kind of credential is passed to the method. The
8734ae
+		  owner indicates to the client how to prompt the user or obtain
8734ae
+		  the credential, and to the service how to use the credential.
8734ae
+
8734ae
+		  The various types are:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>ccache</literal>:
8734ae
+		      the credentials should contain an array of bytes as a
8734ae
+		      <literal>ay</literal> containing the data from a kerberos
8734ae
+		      credential cache file.</para></listitem>
8734ae
+		    <listitem><para><literal>password</literal>:
8734ae
+		      the credentials should contain a pair of strings as a
8734ae
+		      <literal>(ss)</literal> representing a name and
8734ae
+		      password. The name may contain a realm in the standard
8734ae
+		      kerberos format. If a realm is missing, it will default
8734ae
+		      to this realm. </para></listitem>
8734ae
+		    <listitem><para><literal>secret</literal>:
8734ae
+		      the credentials should contain a string secret as an
8734ae
+		      <literal>ay</literal> array of bytes. This is usually used
8734ae
+		      for one time passwords. To pass a string here, encode it
8734ae
+		      in UTF-8, and place the resulting bytes in the
8734ae
+		      value.</para></listitem>
8734ae
+		    <listitem><para><literal>automatic</literal>:
8734ae
+		      the credentials should contain an empty string as a
8734ae
+		      <literal>s</literal>. Using <literal>automatic</literal>
8734ae
+		      indicates that default or system credentials are to be
8734ae
+		      used.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  The various owners are:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>administrator</literal>:
8734ae
+		      the credentials belong to a kerberos administrator principal.
8734ae
+		      The caller may use this as a hint to prompt the user
8734ae
+		      for administrative credentials.</para></listitem>
8734ae
+		    <listitem><para><literal>user</literal>:
8734ae
+		      the credentials belong to a kerberos user principal.
8734ae
+		      The caller may use this as a hint to prompt the user
8734ae
+		      for his (possibly non-administrative)
8734ae
+		      credentials.</para></listitem>
8734ae
+		    <listitem><para><literal>computer</literal>:
8734ae
+		      the credentials belong to a computer account.</para></listitem>
8734ae
+		    <listitem><para><literal>none</literal>:
8734ae
+		      the credentials have an unspecified owner, such as a one
8734ae
+		      time password.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  SupportedLeaveCredentials: credentials supported for leaving
8734ae
+
8734ae
+		  Various kinds of credentials that are supported when calling the
8734ae
+		  #org.freedesktop.realmd.Kerberos.Leave() method.
8734ae
+
8734ae
+		  See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
8734ae
+		  a discussion of what the values represent.
8734ae
+		-->
8734ae
+		<property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
8734ae
+
8734ae
+		
8734ae
+		  Join:
8734ae
+
8734ae
+		  Join this machine to the realm and enroll the machine.
8734ae
+
8734ae
+		  If this method returns successfully, then the machine will be
8734ae
+		  joined to the realm. It is not necessary to restart services or the
8734ae
+		  machine afterward. Relevant properties on the realm will be updated
8734ae
+		  before the method returns.
8734ae
+
8734ae
+		  The @credentials should be set according to one of the
8734ae
+		  supported credentials returned by
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
8734ae
+		  The first string in the tuple is the type, the second string
8734ae
+		  is the owner, and the variant contains the credential contents
8734ae
+		  See the discussion at
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
8734ae
+		  for more information.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+                    <listitem><para><literal>automatic-id-mapping</literal>: a boolean
8734ae
+                      value whether to turn on automatic UID/GID mapping. If not
8734ae
+		      specified the default will come from realmd.conf
8734ae
+                      configuration.</para></listitem>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		    <listitem><para><literal>computer-ou</literal>: a string
8734ae
+		      containing an LDAP DN for an organizational unit where the
8734ae
+		      computer account should be created</para></listitem>
8734ae
+		    <listitem><para><literal>user-principal</literal>: a string
8734ae
+		      containing an kerberos user principal name to be set on the
8734ae
+		      computer account</para></listitem>
8734ae
+		    <listitem><para><literal>membership-software</literal>: a string
8734ae
+		      containing the membership software identifier that the returned
8734ae
+		      realms should match.</para></listitem>
8734ae
+		    <listitem><para><literal>manage-system</literal>: a boolean
8734ae
+		      which controls whether this machine should be managed by
8734ae
+		      the realm or domain or not. Defaults to true.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.configure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the join failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform a join
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
8734ae
+		      returned if the credentials passed did not authenticate against the realm
8734ae
+		      correctly. It is appropriate to prompt the user again.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
8734ae
+		      returned if already enrolled in this realm, or if already enrolled in another realm
8734ae
+		      (if enrolling in multiple realms is not supported).</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
8734ae
+		      returned if the machine has a hostname that is not usable for a join
8734ae
+		      or is in conflict with those in the domain.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Join">
8734ae
+			<arg name="credentials" type="(ssv)" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+		
8734ae
+		  Leave:
8734ae
+
8734ae
+		  Leave the realm and unenroll the machine.
8734ae
+
8734ae
+		  If this method returns successfully, then the machine will have
8734ae
+		  left the domain and been unenrolled. It is not necessary to restart
8734ae
+		  services or the machine afterward. Relevant properties on the realm
8734ae
+		  will be updated before the method returns.
8734ae
+
8734ae
+		  The @credentials should be set according to one of the
8734ae
+		  supported credentials returned by
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
8734ae
+		  The first string in the tuple is the type, the second string
8734ae
+		  is the owner, and the variant contains the credential contents
8734ae
+		  See the discussion at
8734ae
+		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
8734ae
+		  for more information.
8734ae
+
8734ae
+		  @options can contain, but is not limited to, the following values:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>operation</literal>: a string
8734ae
+		      identifier chosen by the client, which can then later be
8734ae
+		      passed to org.freedesktop.realmd.Service.Cancel() in order
8734ae
+		      to cancel the operation</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+
8734ae
+		  This method requires authorization for the PolicyKit action
8734ae
+		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
8734ae
+
8734ae
+		  In addition to common DBus error results, this method may return:
8734ae
+		  <itemizedlist>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
8734ae
+		      may be returned if the unenroll failed for a generic reason.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
8734ae
+		      returned if the operation was cancelled.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
8734ae
+		      returned if the calling client is not permitted to perform an unenroll
8734ae
+		      operation.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
8734ae
+		      returned if the credentials passed did not authenticate against the realm
8734ae
+		      correctly. It is appropriate to prompt the user again.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
8734ae
+		      returned if not enrolled in this realm.</para></listitem>
8734ae
+		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
8734ae
+		      returned if the service is currently performing another operation like
8734ae
+		      join or leave.</para></listitem>
8734ae
+		  </itemizedlist>
8734ae
+		-->
8734ae
+		<method name="Leave">
8734ae
+			<arg name="credentials" type="(ssv)" direction="in"/>
8734ae
+			<arg name="options" type="a{sv}" direction="in"/>
8734ae
+		</method>
8734ae
+
8734ae
+	</interface>
8734ae
+
8734ae
+</node>
8734ae
-- 
0c7e6b
2.27.0
8734ae