From e53b6be06b78e0bf7fd56795da548bb8bc20b532 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Apr 28 2020 09:44:34 +0000
Subject: import accountsservice-0.6.50-8.el8


---

diff --git a/SOURCES/0001-daemon-if-no-local-users-check-if-machine-is-enrolle.patch b/SOURCES/0001-daemon-if-no-local-users-check-if-machine-is-enrolle.patch
new file mode 100644
index 0000000..85f0faa
--- /dev/null
+++ b/SOURCES/0001-daemon-if-no-local-users-check-if-machine-is-enrolle.patch
@@ -0,0 +1,1907 @@
+From 967603c6823180b055c6f1b5e76b05c377076eda Mon Sep 17 00:00:00 2001
+From: Ray Strode <rstrode@redhat.com>
+Date: Fri, 13 Dec 2019 15:16:06 -0500
+Subject: [PATCH] daemon: if no local users, check if machine is enrolled in
+ network
+
+GDM will show gnome initial-setup if a machine has no local users.
+But it's totally possible that a machine has only remote users,
+and shouldn't have a local user.
+
+This commit detects that case, and avoids setting the HasNoUsers
+property.
+---
+ data/Makefile.am                |   1 +
+ data/org.freedesktop.realmd.xml | 730 ++++++++++++++++++++++++++++++++
+ src/Makefile.am                 |   5 +
+ src/daemon.c                    |  61 ++-
+ src/org.freedesktop.realmd.xml  | 730 ++++++++++++++++++++++++++++++++
+ 5 files changed, 1523 insertions(+), 4 deletions(-)
+ create mode 100644 data/org.freedesktop.realmd.xml
+ create mode 100644 src/org.freedesktop.realmd.xml
+
+diff --git a/data/Makefile.am b/data/Makefile.am
+index 521c6c2..6cf5e30 100644
+--- a/data/Makefile.am
++++ b/data/Makefile.am
+@@ -7,38 +7,39 @@ dbusif_DATA = \
+ dbusconfdir   = $(sysconfdir)/dbus-1/system.d
+ dbusconf_DATA = org.freedesktop.Accounts.conf
+ 
+ servicedir       = $(datadir)/dbus-1/system-services
+ service_in_files = org.freedesktop.Accounts.service.in
+ service_DATA     = $(service_in_files:.service.in=.service)
+ 
+ $(service_DATA): $(service_in_files) Makefile
+ 	@sed -e "s|\@libexecdir\@|$(libexecdir)|" $< >$@
+ 
+ policydir       = $(datadir)/polkit-1/actions
+ policy_in_files = org.freedesktop.accounts.policy.in
+ policy_DATA     = $(policy_in_files:.policy.in=.policy)
+ 
+ @INTLTOOL_POLICY_RULE@
+ 
+ if HAVE_SYSTEMD
+ systemdsystemunit_DATA = \
+ 	accounts-daemon.service
+ 
+ accounts-daemon.service: accounts-daemon.service.in
+ 	@sed -e "s|\@libexecdir\@|$(libexecdir)|" $< >$@
+ 
+ endif
+ 
+ EXTRA_DIST = 			\
+ 	$(dbusif_DATA)		\
+ 	$(dbusconf_DATA)	\
+ 	$(service_in_files)	\
+ 	$(policy_in_files)      \
++	org.freedesktop.realmd.xml	\
+ 	accounts-daemon.service.in
+ 
+ DISTCLEANFILES = 		\
+ 	$(service_DATA)		\
+ 	$(policy_DATA)
+ 
+ CLEANFILES = \
+ 	accounts-daemon.service
+diff --git a/data/org.freedesktop.realmd.xml b/data/org.freedesktop.realmd.xml
+new file mode 100644
+index 0000000..c34a47a
+--- /dev/null
++++ b/data/org.freedesktop.realmd.xml
+@@ -0,0 +1,730 @@
++<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
++ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
++<node name="/">
++
++	<!--
++	  org.freedesktop.realmd.Provider:
++	  @short_description: a realm provider
++
++	  Various realm providers represent different software implementations
++	  that provide access to realms or domains.
++
++	  This interface is implemented by individual providers, but is
++	  aggregated globally at the system bus name
++	  <literal>org.freedesktop.realmd</literal>
++	  with the object path <literal>/org/freedesktop/realmd</literal>
++	-->
++	<interface name="org.freedesktop.realmd.Provider">
++
++		<!--
++		  Name: the name of the provider
++
++		  The name of the provider. This is not normally displayed
++		  to the user, but may be useful for diagnostics or debugging.
++		-->
++		<property name="Name" type="s" access="read"/>
++
++		<!--
++		  Version: the version of the provider
++
++		  The version of the provider. This is not normally used in
++		  logic, but may be useful for diagnostics or debugging.
++		-->
++		<property name="Version" type="s" access="read"/>
++
++		<!--
++		  Realms: a list of realms
++
++		  A list of known, enrolled or discovered realms. All realms
++		  that this provider knows about are listed here. As realms
++		  are discovered they are added to this list.
++
++		  Each realm is represented by the DBus object path of the
++		  realm object.
++		-->
++		<property name="Realms" type="ao" access="read"/>
++
++		<!--
++		  Discover:
++		  @string: an input string to discover realms for
++		  @options: options for the discovery operation
++		  @relevance: the relevance of the returned results
++		  @realm: a list of realms discovered
++
++		  Discover realms for the given string. The input @string is
++		  usually a domain or realm name, perhaps typed by a user. If
++		  an empty string is provided, the realm provider should try to
++		  discover a default realm, if possible (e.g. from DHCP).
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>client-software</literal>: a string
++		      containing the client software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>server-software</literal>: a string
++		      containing the client software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>membership-software</literal>: a string
++		      containing the membership software identifier that the returned
++		      realms should match.</para></listitem>
++		  </itemizedlist>
++
++		  The @relevance returned can be used to rank results from
++		  different discover calls to different providers. Implementors
++		  should return a positive number if the provider highly
++		  recommends that the realms be handled by this provider,
++		  or a zero if it can possibly handle the realms. Negative numbers
++		  should be returned if no realms are found.
++
++		  This method does not return an error when no realms are
++		  discovered. It simply returns an empty @realm list.
++
++		  To see diagnostic information about the discovery process,
++		  connect to the org.freedesktop.realmd.Service::Diagnostics
++		  signal.
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.discover-realm</literal>.
++
++		  In addition to common DBus error results, this method may
++		  return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the discovery could not be run for some reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform a discovery
++		      operation.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Discover">
++			<arg name="string" type="s" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++			<arg name="relevance" type="i" direction="out"/>
++			<arg name="realm" type="ao" direction="out"/>
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Service:
++	  @short_description: the realmd service
++
++	  Global calls for managing the realmd service. Usually you'll want
++	  to use #org.freedesktop.realmd.Provider instead.
++
++	  This interface is implemented by the realmd service, and is always
++	  available at the object path <literal>/org/freedesktop/realmd</literal>
++
++	  The service also implements the
++	  <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
++	  makes it easy to retrieve all realmd objects and properties in one go.
++	-->
++	<interface name="org.freedesktop.realmd.Service">
++
++		<!--
++		  Cancel:
++		  @operation: the operation to cancel
++
++		  Cancel a realmd operation. To be able to cancel an operation,
++		  pass a uniquely chosen <literal>operation</literal> string
++		  identifier as an option in the method's <literal>options</literal>
++		  argument.
++
++		  These operation string identifiers should be unique per client
++		  calling the realmd service.
++
++		  It is not guaranteed that the service can or will cancel the
++		  operation. For example, the operation may have already completed
++		  by the time this method is handled. The caller of the operation
++		  method will receive a
++		  <literal>org.freedesktop.realmd.Error.Cancelled</literal>
++		  if the operation was cancelled.
++		-->
++		<method name="Cancel">
++			<arg name="operation" type="s" direction="in"/>
++		</method>
++
++		<!--
++		  SetLocale:
++		  @locale: the locale for the client
++
++		  Set the language @locale for the client. This locale is used
++		  for error messages. The locale is used until the next time
++		  this method is called, the client disconnects, or the client
++		  calls #org.freedesktop.realmd.Service.Release().
++		-->
++		<method name="SetLocale">
++			<arg name="locale" type="s" direction="in"/>
++		</method>
++
++		<!--
++		  Diagnostics:
++		  @data: diagnostic data
++		  @operation: the operation this data resulted from
++
++		  This signal is fired when diagnostics result from an operation
++		  in the provider or one of its realms.
++
++		  It is not guaranteed that this signal is emitted once per line.
++		  More than one line may be contained in @data, or a partial
++		  line. New line characters are embedded in @data.
++
++		  This signal is sent explicitly to the client which invoked an
++		  operation method. In order to tell which operation this
++		  diagnostic data results from, pass a unique
++		  <literal>operation</literal> string identifier in the
++		  <literal>options</literal> argument of the operation method.
++		  That same identifier will be passed back via the @operation
++		  argument of this signal.
++		-->
++		<signal name="Diagnostics">
++			<arg name="data" type="s"/>
++			<arg name="operation" type="s"/>
++		</signal>
++
++		<!--
++		  Release:
++
++		  Normally, realmd waits until all clients have disconnected
++		  before exiting itself sometime later. Long lived clients
++		  can call this method to allow the realmd service to quit.
++		  This is an optimization. The daemon will not exit immediately.
++		  It is safe to call this multiple times.
++		-->
++		<method name="Release">
++			<!-- no arguments -->
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Realm:
++	  @short_description: a realm
++
++	  Represents one realm.
++
++	  Contains generic information about a realm, and useful properties for
++	  introspecting what kind of realm this is and how to work with
++	  the realm.
++
++	  Use #org.freedesktop.realmd.Provider:Realms or
++	  #org.freedesktop.realmd.Provider.Discover() to get access to some
++	  kerberos realm objects.
++
++	  Realms will always implement additional interfaces, such as
++	  #org.freedesktop.realmd.Kerberos.  Do not assume that all realms
++	  implement that kerberos interface. Use the
++	  #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
++	  which interfaces are supported.
++
++	  Different realms support various ways to configure them on the
++	  system. Use the #org.freedesktop.realmd.Realm:Configured property
++	  to determine if a realm is configured. If it is configured, the
++	  property will be set to the interface of the mechanism that was
++	  used to configure it.
++
++	  To configure a realm, look in the
++	  #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
++	  recognized purpose-specific interface that can be used for
++	  configuration, such as the
++	  #org.freedesktop.realmd.KerberosMembership interface and its
++	  #org.freedesktop.realmd.KerberosMembership.Join() method.
++
++	  To deconfigure a realm from the current system, you can use the
++	  #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
++	  of the configuration specific interfaces provide methods to
++	  deconfigure a realm in a specific way, such as the
++	  #org.freedesktop.realmd.KerberosMembership.Leave() method.
++
++	  The various properties are guaranteed to have been updated before
++	  the operation methods return, if they change state.
++	-->
++	<interface name="org.freedesktop.realmd.Realm">
++
++		<!--
++		  Name: the realm name
++
++		  This is the name of the realm, appropriate for display to
++		  end users where necessary.
++		-->
++		<property name="Name" type="s" access="read"/>
++
++		<!--
++		  Configured: whether this domain is configured and how
++
++		  If this property is an empty string, then the realm is not
++		  configured. Otherwise the realm is configured, and contains
++		  a string which is the interface that represents how it was
++		  configured, for example #org.freedesktop.realmd.KerberosMembership.
++		-->
++		<property name="Configured" type="s" access="read"/>
++
++		<!--
++		  Deconfigure: deconfigure this realm
++
++		  Deconfigure this realm from the local machine with standard
++		  default behavior.
++
++		  The behavior of this method depends on the which configuration
++		  interface is present in the
++		  #org.freedesktop.realmd.Realm.Configured property. It does not
++		  always delete membership accounts in the realm, but just
++		  reconfigures the local machine so it no longer is configured
++		  for the given realm. In some cases the implementation may try
++		  to update membership accounts, but this is not guaranteed.
++
++		  Various configuration interfaces may support more specific ways
++		  to deconfigure a realm in a specific way, such as the
++		  #org.freedesktop.realmd.KerberosMembership.Leave() method.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the deconfigure failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to deconfigure a
++		      realm.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
++		      returned if this realm is not configured on the machine.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Deconfigure">
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++		<!--
++		  SupportedInterfaces:
++
++		  Additional supported interfaces of this realm. This includes
++		  interfaces that contain more information about the realm,
++		  such as #org.freedesktop.realmd.Kerberos and interfaces
++		  which contain methods for configuring a realm, such as
++		  #org.freedesktop.realmd.KerberosMembership.
++		-->
++		<property name="SupportedInterfaces" type="as" access="read"/>
++
++		<!--
++		  Details: informational details about the realm
++
++		  Informational details about the realm. The following values
++		  should be present:
++		  <itemizedlist>
++		    <listitem><para><literal>server-software</literal>:
++		      identifier of the software running on the server (e.g.
++		      <literal>active-directory</literal>).</para></listitem>
++		    <listitem><para><literal>client-software</literal>:
++		      identifier of the software running on the client (e.g.
++		      <literal>sssd</literal>).</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="Details" type="a(ss)" access="read"/>
++
++		<!--
++		  RequiredPackages: prerequisite software
++
++		  Software packages that are required in order for a join to
++		  succeed. These are either simple strings like <literal>sssd</literal>,
++		  or strings with an operator and version number like
++		  <literal>sssd >= 1.9.0</literal>
++
++		  These values are specific to the packaging system that is
++		  being run.
++		-->
++		<property name="RequiredPackages" type="as" access="read"/>
++
++		<!--
++		  LoginFormats: supported formats for login names
++
++		  Supported formats for login to this realm. This is only
++		  relevant once the realm has been enrolled. The formats
++		  will contain a <literal>%U</literal> in the string, which
++		  indicate where the user name should be placed. The formats
++		  may contain a <literal>%D</literal> in the string which
++		  indicate where a domain name should be placed.
++
++		  The first format in the list is the preferred format for
++		  login names.
++		-->
++		<property name="LoginFormats" type="as" access="read"/>
++
++		<!--
++		  LoginPolicy: the policy for logins using this realm
++
++		  The policy for logging into this computer using this realm.
++
++		  The policy can be changed using the
++		  #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
++
++		  The following policies are predefined. Not all providers
++		  support all these policies and there may be provider specific
++		  policies or multiple policies represented in the string:
++		  <itemizedlist>
++		    <listitem><para><literal>allow-any-login</literal>: allow
++		      login by any authenticated user present in this
++		      realm.</para></listitem>
++		    <listitem><para><literal>allow-realm-logins</literal>: allow
++		      logins according to the realm or domain policy for logins
++		      on this machine. This usually defaults to allowing any realm
++		      user to log in.</para></listitem>
++		    <listitem><para><literal>allow-permitted-logins</literal>:
++		      only allow the logins permitted in the
++		      #org.freedesktop.realmd.Realm:PermittedLogins
++		      property.</para></listitem>
++		    <listitem><para><literal>deny-any-login</literal>:
++		      don't allow any logins via authenticated users of this
++		      realm.</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="LoginPolicy" type="s" access="read"/>
++
++		<!--
++		  PermittedLogins: the permitted login names
++
++		  The list of permitted authenticated users allowed to login
++		  into this computer. This is only relevant if the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property
++		  contains the <literal>allow-permitted-logins</literal>
++		  string.
++		-->
++		<property name="PermittedLogins" type="as" access="read"/>
++
++		<!--
++		  PermittedGroups: the permitted group names
++
++		  The list of groups which users need to be in to be allowed
++		  to log into this computer. This is only relevant if the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property
++		  contains the <literal>allow-permitted-logins</literal>
++		  string.
++		-->
++		<property name="PermittedGroups" type="as" access="read"/>
++
++		<!--
++		  ChangeLoginPolicy:
++		  @login_policy: the new login policy, or an empty string
++		  @permitted_add: a list of logins to permit
++		  @permitted_remove: a list of logins to not permit
++		  @options: options for this operation
++
++		  Change the login policy and/or permitted logins for this realm.
++
++		  Not all realms support all the various login policies. An
++		  error will be returned if the new login policy is not supported.
++		  You may specify an empty string for the @login_policy argument
++		  which will cause no change in the policy itself. If the policy
++		  is changed, it will be reflected in the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property.
++
++		  The @permitted_add and @permitted_remove arguments represent
++		  lists of login names that should be added and removed from
++		  the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>groups</literal>: boolean which if
++		    set to <literal>TRUE</literal> means that the names in
++		    @permitted_add and @permitted_remove are group names instead
++		    of login names.</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.login-policy</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the policy change failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to change login policy
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
++		      returned if the realm is not configured.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="ChangeLoginPolicy">
++			<arg name="login_policy" type="s" direction="in"/>
++			<arg name="permitted_add" type="as" direction="in"/>
++			<arg name="permitted_remove" type="as" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Kerberos:
++	  @short_description: a kerberos realm
++
++	  An interface that describes a kerberos realm in more detail. This
++	  is always implemented on an DBus object path that also implements
++	  the #org.freedesktop.realmd.Realm interface.
++	-->
++	<interface name="org.freedesktop.realmd.Kerberos">
++
++		<!--
++		  RealmName: the kerberos realm name
++
++		  The kerberos name for this realm. This is usually in upper
++		  case.
++		-->
++		<property name="RealmName" type="s" access="read"/>
++
++		<!--
++		  DomainName: the DNS domain name
++
++		  The DNS domain name for this realm.
++		-->
++		<property name="DomainName" type="s" access="read"/>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.KerberosMembership:
++
++	  An interface used to configure this machine by joining a realm.
++
++	  It sets up a computer/host account in the realm for this machine
++	  and a keytab to track the credentials for that account.
++
++	  The various properties are guaranteed to have been updated before
++	  the operation methods return, if they change state.
++	-->
++	<interface name="org.freedesktop.realmd.KerberosMembership">
++
++		<!--
++		  SuggestedAdministrator: common administrator name
++
++		  The common administrator name for this type of realm. This
++		  can be used by clients as a hint when prompting the user for
++		  administrative authentication.
++		-->
++		<property name="SuggestedAdministrator" type="s" access="read"/>
++
++		<!--
++		  SupportedJoinCredentials: credentials supported for joining
++
++		  Various kinds of credentials that are supported when calling the
++		  #org.freedesktop.realmd.Kerberos.Join() method.
++
++		  Each credential is represented by a type and an owner. The type
++		  denotes which kind of credential is passed to the method. The
++		  owner indicates to the client how to prompt the user or obtain
++		  the credential, and to the service how to use the credential.
++
++		  The various types are:
++		  <itemizedlist>
++		    <listitem><para><literal>ccache</literal>:
++		      the credentials should contain an array of bytes as a
++		      <literal>ay</literal> containing the data from a kerberos
++		      credential cache file.</para></listitem>
++		    <listitem><para><literal>password</literal>:
++		      the credentials should contain a pair of strings as a
++		      <literal>(ss)</literal> representing a name and
++		      password. The name may contain a realm in the standard
++		      kerberos format. If a realm is missing, it will default
++		      to this realm. </para></listitem>
++		    <listitem><para><literal>secret</literal>:
++		      the credentials should contain a string secret as an
++		      <literal>ay</literal> array of bytes. This is usually used
++		      for one time passwords. To pass a string here, encode it
++		      in UTF-8, and place the resulting bytes in the
++		      value.</para></listitem>
++		    <listitem><para><literal>automatic</literal>:
++		      the credentials should contain an empty string as a
++		      <literal>s</literal>. Using <literal>automatic</literal>
++		      indicates that default or system credentials are to be
++		      used.</para></listitem>
++		  </itemizedlist>
++
++		  The various owners are:
++		  <itemizedlist>
++		    <listitem><para><literal>administrator</literal>:
++		      the credentials belong to a kerberos administrator principal.
++		      The caller may use this as a hint to prompt the user
++		      for administrative credentials.</para></listitem>
++		    <listitem><para><literal>user</literal>:
++		      the credentials belong to a kerberos user principal.
++		      The caller may use this as a hint to prompt the user
++		      for his (possibly non-administrative)
++		      credentials.</para></listitem>
++		    <listitem><para><literal>computer</literal>:
++		      the credentials belong to a computer account.</para></listitem>
++		    <listitem><para><literal>none</literal>:
++		      the credentials have an unspecified owner, such as a one
++		      time password.</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
++
++		<!--
++		  SupportedLeaveCredentials: credentials supported for leaving
++
++		  Various kinds of credentials that are supported when calling the
++		  #org.freedesktop.realmd.Kerberos.Leave() method.
++
++		  See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
++		  a discussion of what the values represent.
++		-->
++		<property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
++
++		<!--
++		  Join:
++
++		  Join this machine to the realm and enroll the machine.
++
++		  If this method returns successfully, then the machine will be
++		  joined to the realm. It is not necessary to restart services or the
++		  machine afterward. Relevant properties on the realm will be updated
++		  before the method returns.
++
++		  The @credentials should be set according to one of the
++		  supported credentials returned by
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
++		  The first string in the tuple is the type, the second string
++		  is the owner, and the variant contains the credential contents
++		  See the discussion at
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
++		  for more information.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++                    <listitem><para><literal>automatic-id-mapping</literal>: a boolean
++                      value whether to turn on automatic UID/GID mapping. If not
++		      specified the default will come from realmd.conf
++                      configuration.</para></listitem>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>computer-ou</literal>: a string
++		      containing an LDAP DN for an organizational unit where the
++		      computer account should be created</para></listitem>
++		    <listitem><para><literal>user-principal</literal>: a string
++		      containing an kerberos user principal name to be set on the
++		      computer account</para></listitem>
++		    <listitem><para><literal>membership-software</literal>: a string
++		      containing the membership software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>manage-system</literal>: a boolean
++		      which controls whether this machine should be managed by
++		      the realm or domain or not. Defaults to true.</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.configure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the join failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform a join
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
++		      returned if the credentials passed did not authenticate against the realm
++		      correctly. It is appropriate to prompt the user again.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
++		      returned if already enrolled in this realm, or if already enrolled in another realm
++		      (if enrolling in multiple realms is not supported).</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
++		      returned if the machine has a hostname that is not usable for a join
++		      or is in conflict with those in the domain.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Join">
++			<arg name="credentials" type="(ssv)" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++		<!--
++		  Leave:
++
++		  Leave the realm and unenroll the machine.
++
++		  If this method returns successfully, then the machine will have
++		  left the domain and been unenrolled. It is not necessary to restart
++		  services or the machine afterward. Relevant properties on the realm
++		  will be updated before the method returns.
++
++		  The @credentials should be set according to one of the
++		  supported credentials returned by
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
++		  The first string in the tuple is the type, the second string
++		  is the owner, and the variant contains the credential contents
++		  See the discussion at
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
++		  for more information.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the unenroll failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform an unenroll
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
++		      returned if the credentials passed did not authenticate against the realm
++		      correctly. It is appropriate to prompt the user again.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
++		      returned if not enrolled in this realm.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Leave">
++			<arg name="credentials" type="(ssv)" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++	</interface>
++
++</node>
+diff --git a/src/Makefile.am b/src/Makefile.am
+index f53e3e1..7a5b382 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -1,59 +1,64 @@
+ NULL =
+ BUILT_SOURCES =
+ SUBDIRS = . libaccountsservice
+ INCLUDES = 			\
+ 	-DLOCALSTATEDIR=\""$(localstatedir)"\" \
+ 	-DDATADIR=\""$(datadir)"\" \
+ 	-DICONDIR=\"$(localstatedir)/lib/AccountsService/icons\" \
+ 	-DUSERDIR=\"$(localstatedir)/lib/AccountsService/users\" \
+ 	-I$(srcdir)		\
+ 	-I$(builddir)		\
+ 	$(ACCOUNTS_DAEMON_CFLAGS)	\
+ 	$(WARN_CFLAGS)
+ 
+ noinst_LTLIBRARIES = libaccounts-generated.la
+ 
+ libaccounts_generated_la_SOURCES = \
+ 	accounts-generated.c		\
+ 	accounts-generated.h		\
+ 	accounts-user-generated.c	\
+ 	accounts-user-generated.h	\
++	realmd-generated.c		\
++	realmd-generated.h		\
+ 	$(NULL)
+ BUILT_SOURCES += $(libaccounts_generated_la_SOURCES)
+ 
+ accounts-generated.c accounts-generated.h: $(top_srcdir)/data/org.freedesktop.Accounts.xml Makefile
+ 	gdbus-codegen --generate-c-code accounts-generated --c-namespace Accounts --interface-prefix=org.freedesktop. $(top_srcdir)/data/org.freedesktop.Accounts.xml
+ 
+ accounts-user-generated.c accounts-user-generated.h: $(top_srcdir)/data/org.freedesktop.Accounts.User.xml Makefile
+ 	gdbus-codegen --generate-c-code accounts-user-generated --c-namespace Accounts --interface-prefix=org.freedesktop.Accounts. $(top_srcdir)/data/org.freedesktop.Accounts.User.xml
+ 
++realmd-generated.c realmd-generated.h: $(top_srcdir)/data/org.freedesktop.realmd.xml Makefile
++	gdbus-codegen --c-generate-autocleanup all --c-generate-object-manager --generate-c-code realmd-generated --c-namespace Accounts --interface-prefix=org.freedesktop. $(top_srcdir)/data/org.freedesktop.realmd.xml
++
+ libexec_PROGRAMS = accounts-daemon
+ 
+ accounts_daemon_SOURCES = 	\
+ 	$(enums_h_sources)	\
+ 	types.h			\
+ 	daemon.h		\
+ 	daemon.c		\
+ 	extensions.c		\
+ 	user-classify.h		\
+ 	user-classify.c		\
+ 	user.h			\
+ 	user.c			\
+ 	util.h			\
+ 	util.c			\
+ 	wtmp-helper.h		\
+ 	wtmp-helper.c		\
+ 	main.c
+ 
+ accounts_daemon_LDADD = 	\
+ 	libaccounts-generated.la	\
+ 	$(ACCOUNTS_DAEMON_LIBS)
+ 
+ EXTRA_DIST = \
+ 	fgetpwent.c	\
+ 	$(NULL)
+ 
+ CLEANFILES = \
+ 	$(BUILT_SOURCES) \
+ 	*.gcda \
+ 	*.gcno \
+diff --git a/src/daemon.c b/src/daemon.c
+index 00dff51..23e60ce 100644
+--- a/src/daemon.c
++++ b/src/daemon.c
+@@ -20,60 +20,61 @@
+  * Written by: Matthias Clasen <mclasen@redhat.com>
+  */
+ 
+ #include "config.h"
+ 
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <sys/wait.h>
+ #include <pwd.h>
+ #ifdef HAVE_SHADOW_H
+ #include <shadow.h>
+ #endif
+ #include <unistd.h>
+ #include <errno.h>
+ #include <sys/types.h>
+ 
+ #include <glib.h>
+ #include <glib/gi18n.h>
+ #include <glib-object.h>
+ #include <glib/gstdio.h>
+ #include <gio/gio.h>
+ #include <polkit/polkit.h>
+ 
+ #include "user-classify.h"
+ #include "wtmp-helper.h"
+ #include "daemon.h"
+ #include "util.h"
++#include "realmd-generated.h"
+ 
+ #define PATH_PASSWD "/etc/passwd"
+ #define PATH_SHADOW "/etc/shadow"
+ #define PATH_GROUP "/etc/group"
+ 
+ enum {
+         PROP_0,
+         PROP_DAEMON_VERSION
+ };
+ 
+ struct DaemonPrivate {
+         GDBusConnection *bus_connection;
+ 
+         GHashTable *users;
+         gsize number_of_normal_users;
+         GList *explicitly_requested_users;
+ 
+         User *autologin;
+ 
+         GFileMonitor *passwd_monitor;
+         GFileMonitor *shadow_monitor;
+         GFileMonitor *group_monitor;
+         GFileMonitor *gdm_monitor;
+         GFileMonitor *wtmp_monitor;
+ 
+         guint reload_id;
+         guint autologin_id;
+ 
+         PolkitAuthority *authority;
+         GHashTable *extension_ifaces;
+@@ -414,109 +415,164 @@ load_entries (Daemon             *daemon,
+                         } else {
+                                 g_object_ref (user);
+                         }
+ 
+                         /* freeze & update users not already in the new list */
+                         g_object_freeze_notify (G_OBJECT (user));
+                         user_update_from_pwent (user, pwent, spent);
+ 
+                         g_hash_table_insert (users, g_strdup (user_get_user_name (user)), user);
+                         g_debug ("loaded user: %s", user_get_user_name (user));
+                 }
+ 
+                 if (!explicitly_requested) {
+                         user_set_cached (user, TRUE);
+                 }
+         }
+ 
+         /* Generator should have cleaned up */
+         g_assert (generator_state == NULL);
+ }
+ 
+ static GHashTable *
+ create_users_hash_table (void)
+ {
+         return g_hash_table_new_full (g_str_hash,
+                                       g_str_equal,
+                                       g_free,
+                                       g_object_unref);
+ }
+ 
++static gboolean
++ensure_bus_connection (Daemon *daemon)
++{
++        g_autoptr (GError) error = NULL;
++
++        if (daemon->priv->bus_connection != NULL)
++                return TRUE;
++
++        daemon->priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
++        if (daemon->priv->bus_connection == NULL) {
++                if (error != NULL)
++                        g_critical ("error getting system bus: %s", error->message);
++                return FALSE;
++        }
++
++        return TRUE;
++}
++
++static gboolean
++has_network_realms (Daemon *daemon)
++{
++        g_autoptr (AccountsRealmdProvider) realmd_provider = NULL;
++        g_autoptr (GError) error = NULL;
++        const char *const *realms = NULL;
++
++        if (!ensure_bus_connection (daemon)) {
++                return FALSE;
++        }
++
++        realmd_provider = accounts_realmd_provider_proxy_new_sync (daemon->priv->bus_connection,
++                                                                   G_DBUS_PROXY_FLAGS_NONE,
++                                                                   "org.freedesktop.realmd",
++                                                                   "/org/freedesktop/realmd",
++                                                                   NULL,
++                                                                   &error);
++        if (realmd_provider == NULL) {
++                g_debug ("failed to contact realmd: %s", error->message);
++                return FALSE;
++        }
++
++        realms = accounts_realmd_provider_get_realms (realmd_provider);
++
++        if (!realms) {
++                g_debug("realmd provider 'Realms' property is unset");
++                return FALSE;
++        }
++
++        return realms[0] != NULL;
++}
++
+ static void
+ reload_users (Daemon *daemon)
+ {
+         AccountsAccounts *accounts = ACCOUNTS_ACCOUNTS (daemon);
+         gboolean had_no_users, has_no_users, had_multiple_users, has_multiple_users;
+         GHashTable *users;
+         GHashTable *old_users;
+         GHashTable *local;
+         GHashTableIter iter;
+         gsize number_of_normal_users = 0;
+         gpointer name, value;
+ 
+         /* Track the users that we saw during our (re)load */
+         users = create_users_hash_table ();
+ 
+         /*
+          * NOTE: As we load data from all the sources, notifies are
+          * frozen in load_entries() and then thawed as we process
+          * them below.
+          */
+ 
+         /* Load the local users into our hash table */
+         load_entries (daemon, users, FALSE, entry_generator_fgetpwent);
+         local = g_hash_table_new (g_str_hash, g_str_equal);
+         g_hash_table_iter_init (&iter, users);
+         while (g_hash_table_iter_next (&iter, &name, NULL))
+                 g_hash_table_add (local, name);
+ 
+         /* and add users to hash table that were explicitly requested  */
+         load_entries (daemon, users, TRUE, entry_generator_requested_users);
+ 
+         /* Now add/update users from other sources, possibly non-local */
+         load_entries (daemon, users, FALSE, entry_generator_cachedir);
+ 
+         wtmp_helper_update_login_frequencies (users);
+ 
+         /* Count the non-system users. Mark which users are local, which are not. */
+         g_hash_table_iter_init (&iter, users);
+         while (g_hash_table_iter_next (&iter, &name, &value)) {
+                 User *user = value;
+                 if (!user_get_system_account (user))
+                         number_of_normal_users++;
+                 user_update_local_account_property (user, g_hash_table_lookup (local, name) != NULL);
+         }
+         g_hash_table_destroy (local);
+ 
+         had_no_users = accounts_accounts_get_has_no_users (accounts);
+         has_no_users = number_of_normal_users == 0;
+ 
++        if (has_no_users && has_network_realms (daemon)) {
++                g_debug ("No local users, but network realms detected, presuming there are remote users");
++                has_no_users = FALSE;
++        }
++
+         if (had_no_users != has_no_users)
+                 accounts_accounts_set_has_no_users (accounts, has_no_users);
+ 
+         had_multiple_users = accounts_accounts_get_has_multiple_users (accounts);
+         has_multiple_users = number_of_normal_users > 1;
+ 
+         if (had_multiple_users != has_multiple_users)
+                 accounts_accounts_set_has_multiple_users (accounts, has_multiple_users);
+ 
+         /* Swap out the users */
+         old_users = daemon->priv->users;
+         daemon->priv->users = users;
+ 
+         /* Remove all the old users */
+         g_hash_table_iter_init (&iter, old_users);
+         while (g_hash_table_iter_next (&iter, &name, &value)) {
+                 User *user = value;
+                 User *refreshed_user;
+ 
+                 refreshed_user = g_hash_table_lookup (users, name);
+ 
+                 if (!refreshed_user || (user_get_cached (user) && !user_get_cached (refreshed_user))) {
+                         accounts_accounts_emit_user_deleted (ACCOUNTS_ACCOUNTS (daemon),
+                                                              user_get_object_path (user));
+                         user_unregister (user);
+                 }
+         }
+ 
+         /* Register all the new users */
+         g_hash_table_iter_init (&iter, users);
+@@ -733,64 +789,61 @@ daemon_finalize (GObject *object)
+         Daemon *daemon;
+ 
+         g_return_if_fail (IS_DAEMON (object));
+ 
+         daemon = DAEMON (object);
+ 
+         if (daemon->priv->bus_connection != NULL)
+                 g_object_unref (daemon->priv->bus_connection);
+ 
+         g_list_free_full (daemon->priv->explicitly_requested_users, g_free);
+ 
+         g_hash_table_destroy (daemon->priv->users);
+ 
+         g_hash_table_unref (daemon->priv->extension_ifaces);
+ 
+         G_OBJECT_CLASS (daemon_parent_class)->finalize (object);
+ }
+ 
+ static gboolean
+ register_accounts_daemon (Daemon *daemon)
+ {
+         g_autoptr(GError) error = NULL;
+ 
+         daemon->priv->authority = polkit_authority_get_sync (NULL, &error);
+         if (daemon->priv->authority == NULL) {
+                 if (error != NULL)
+                         g_critical ("error getting polkit authority: %s", error->message);
+                 return FALSE;
+         }
+ 
+-        daemon->priv->bus_connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &error);
+-        if (daemon->priv->bus_connection == NULL) {
+-                if (error != NULL)
+-                        g_critical ("error getting system bus: %s", error->message);
++        if (!ensure_bus_connection (daemon)) {
+                 return FALSE;
+         }
+ 
+         if (!g_dbus_interface_skeleton_export (G_DBUS_INTERFACE_SKELETON (daemon),
+                                                daemon->priv->bus_connection,
+                                                "/org/freedesktop/Accounts",
+                                                &error)) {
+                 if (error != NULL)
+                         g_critical ("error exporting interface: %s", error->message);
+                 return FALSE;
+         }
+ 
+         return TRUE;
+ }
+ 
+ Daemon *
+ daemon_new (void)
+ {
+         g_autoptr(Daemon) daemon = NULL;
+ 
+         daemon = DAEMON (g_object_new (TYPE_DAEMON, NULL));
+ 
+         if (!register_accounts_daemon (DAEMON (daemon))) {
+                 return NULL;
+         }
+ 
+         return g_steal_pointer (&daemon);
+ }
+ 
+ static void
+diff --git a/src/org.freedesktop.realmd.xml b/src/org.freedesktop.realmd.xml
+new file mode 100644
+index 0000000..c34a47a
+--- /dev/null
++++ b/src/org.freedesktop.realmd.xml
+@@ -0,0 +1,730 @@
++<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
++ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
++<node name="/">
++
++	<!--
++	  org.freedesktop.realmd.Provider:
++	  @short_description: a realm provider
++
++	  Various realm providers represent different software implementations
++	  that provide access to realms or domains.
++
++	  This interface is implemented by individual providers, but is
++	  aggregated globally at the system bus name
++	  <literal>org.freedesktop.realmd</literal>
++	  with the object path <literal>/org/freedesktop/realmd</literal>
++	-->
++	<interface name="org.freedesktop.realmd.Provider">
++
++		<!--
++		  Name: the name of the provider
++
++		  The name of the provider. This is not normally displayed
++		  to the user, but may be useful for diagnostics or debugging.
++		-->
++		<property name="Name" type="s" access="read"/>
++
++		<!--
++		  Version: the version of the provider
++
++		  The version of the provider. This is not normally used in
++		  logic, but may be useful for diagnostics or debugging.
++		-->
++		<property name="Version" type="s" access="read"/>
++
++		<!--
++		  Realms: a list of realms
++
++		  A list of known, enrolled or discovered realms. All realms
++		  that this provider knows about are listed here. As realms
++		  are discovered they are added to this list.
++
++		  Each realm is represented by the DBus object path of the
++		  realm object.
++		-->
++		<property name="Realms" type="ao" access="read"/>
++
++		<!--
++		  Discover:
++		  @string: an input string to discover realms for
++		  @options: options for the discovery operation
++		  @relevance: the relevance of the returned results
++		  @realm: a list of realms discovered
++
++		  Discover realms for the given string. The input @string is
++		  usually a domain or realm name, perhaps typed by a user. If
++		  an empty string is provided, the realm provider should try to
++		  discover a default realm, if possible (e.g. from DHCP).
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>client-software</literal>: a string
++		      containing the client software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>server-software</literal>: a string
++		      containing the client software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>membership-software</literal>: a string
++		      containing the membership software identifier that the returned
++		      realms should match.</para></listitem>
++		  </itemizedlist>
++
++		  The @relevance returned can be used to rank results from
++		  different discover calls to different providers. Implementors
++		  should return a positive number if the provider highly
++		  recommends that the realms be handled by this provider,
++		  or a zero if it can possibly handle the realms. Negative numbers
++		  should be returned if no realms are found.
++
++		  This method does not return an error when no realms are
++		  discovered. It simply returns an empty @realm list.
++
++		  To see diagnostic information about the discovery process,
++		  connect to the org.freedesktop.realmd.Service::Diagnostics
++		  signal.
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.discover-realm</literal>.
++
++		  In addition to common DBus error results, this method may
++		  return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the discovery could not be run for some reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform a discovery
++		      operation.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Discover">
++			<arg name="string" type="s" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++			<arg name="relevance" type="i" direction="out"/>
++			<arg name="realm" type="ao" direction="out"/>
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Service:
++	  @short_description: the realmd service
++
++	  Global calls for managing the realmd service. Usually you'll want
++	  to use #org.freedesktop.realmd.Provider instead.
++
++	  This interface is implemented by the realmd service, and is always
++	  available at the object path <literal>/org/freedesktop/realmd</literal>
++
++	  The service also implements the
++	  <literal>org.freedesktop.DBus.ObjectManager</literal> interface which
++	  makes it easy to retrieve all realmd objects and properties in one go.
++	-->
++	<interface name="org.freedesktop.realmd.Service">
++
++		<!--
++		  Cancel:
++		  @operation: the operation to cancel
++
++		  Cancel a realmd operation. To be able to cancel an operation,
++		  pass a uniquely chosen <literal>operation</literal> string
++		  identifier as an option in the method's <literal>options</literal>
++		  argument.
++
++		  These operation string identifiers should be unique per client
++		  calling the realmd service.
++
++		  It is not guaranteed that the service can or will cancel the
++		  operation. For example, the operation may have already completed
++		  by the time this method is handled. The caller of the operation
++		  method will receive a
++		  <literal>org.freedesktop.realmd.Error.Cancelled</literal>
++		  if the operation was cancelled.
++		-->
++		<method name="Cancel">
++			<arg name="operation" type="s" direction="in"/>
++		</method>
++
++		<!--
++		  SetLocale:
++		  @locale: the locale for the client
++
++		  Set the language @locale for the client. This locale is used
++		  for error messages. The locale is used until the next time
++		  this method is called, the client disconnects, or the client
++		  calls #org.freedesktop.realmd.Service.Release().
++		-->
++		<method name="SetLocale">
++			<arg name="locale" type="s" direction="in"/>
++		</method>
++
++		<!--
++		  Diagnostics:
++		  @data: diagnostic data
++		  @operation: the operation this data resulted from
++
++		  This signal is fired when diagnostics result from an operation
++		  in the provider or one of its realms.
++
++		  It is not guaranteed that this signal is emitted once per line.
++		  More than one line may be contained in @data, or a partial
++		  line. New line characters are embedded in @data.
++
++		  This signal is sent explicitly to the client which invoked an
++		  operation method. In order to tell which operation this
++		  diagnostic data results from, pass a unique
++		  <literal>operation</literal> string identifier in the
++		  <literal>options</literal> argument of the operation method.
++		  That same identifier will be passed back via the @operation
++		  argument of this signal.
++		-->
++		<signal name="Diagnostics">
++			<arg name="data" type="s"/>
++			<arg name="operation" type="s"/>
++		</signal>
++
++		<!--
++		  Release:
++
++		  Normally, realmd waits until all clients have disconnected
++		  before exiting itself sometime later. Long lived clients
++		  can call this method to allow the realmd service to quit.
++		  This is an optimization. The daemon will not exit immediately.
++		  It is safe to call this multiple times.
++		-->
++		<method name="Release">
++			<!-- no arguments -->
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Realm:
++	  @short_description: a realm
++
++	  Represents one realm.
++
++	  Contains generic information about a realm, and useful properties for
++	  introspecting what kind of realm this is and how to work with
++	  the realm.
++
++	  Use #org.freedesktop.realmd.Provider:Realms or
++	  #org.freedesktop.realmd.Provider.Discover() to get access to some
++	  kerberos realm objects.
++
++	  Realms will always implement additional interfaces, such as
++	  #org.freedesktop.realmd.Kerberos.  Do not assume that all realms
++	  implement that kerberos interface. Use the
++	  #org.freedesktop.realmd.Realm:SupportedInterfaces property to see
++	  which interfaces are supported.
++
++	  Different realms support various ways to configure them on the
++	  system. Use the #org.freedesktop.realmd.Realm:Configured property
++	  to determine if a realm is configured. If it is configured, the
++	  property will be set to the interface of the mechanism that was
++	  used to configure it.
++
++	  To configure a realm, look in the
++	  #org.freedesktop.realmd.Realm:SupportedInterfaces property for a
++	  recognized purpose-specific interface that can be used for
++	  configuration, such as the
++	  #org.freedesktop.realmd.KerberosMembership interface and its
++	  #org.freedesktop.realmd.KerberosMembership.Join() method.
++
++	  To deconfigure a realm from the current system, you can use the
++	  #org.freedesktop.realmd.Realm.Deconfigure() method. In addition, some
++	  of the configuration specific interfaces provide methods to
++	  deconfigure a realm in a specific way, such as the
++	  #org.freedesktop.realmd.KerberosMembership.Leave() method.
++
++	  The various properties are guaranteed to have been updated before
++	  the operation methods return, if they change state.
++	-->
++	<interface name="org.freedesktop.realmd.Realm">
++
++		<!--
++		  Name: the realm name
++
++		  This is the name of the realm, appropriate for display to
++		  end users where necessary.
++		-->
++		<property name="Name" type="s" access="read"/>
++
++		<!--
++		  Configured: whether this domain is configured and how
++
++		  If this property is an empty string, then the realm is not
++		  configured. Otherwise the realm is configured, and contains
++		  a string which is the interface that represents how it was
++		  configured, for example #org.freedesktop.realmd.KerberosMembership.
++		-->
++		<property name="Configured" type="s" access="read"/>
++
++		<!--
++		  Deconfigure: deconfigure this realm
++
++		  Deconfigure this realm from the local machine with standard
++		  default behavior.
++
++		  The behavior of this method depends on the which configuration
++		  interface is present in the
++		  #org.freedesktop.realmd.Realm.Configured property. It does not
++		  always delete membership accounts in the realm, but just
++		  reconfigures the local machine so it no longer is configured
++		  for the given realm. In some cases the implementation may try
++		  to update membership accounts, but this is not guaranteed.
++
++		  Various configuration interfaces may support more specific ways
++		  to deconfigure a realm in a specific way, such as the
++		  #org.freedesktop.realmd.KerberosMembership.Leave() method.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the deconfigure failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to deconfigure a
++		      realm.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
++		      returned if this realm is not configured on the machine.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Deconfigure">
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++		<!--
++		  SupportedInterfaces:
++
++		  Additional supported interfaces of this realm. This includes
++		  interfaces that contain more information about the realm,
++		  such as #org.freedesktop.realmd.Kerberos and interfaces
++		  which contain methods for configuring a realm, such as
++		  #org.freedesktop.realmd.KerberosMembership.
++		-->
++		<property name="SupportedInterfaces" type="as" access="read"/>
++
++		<!--
++		  Details: informational details about the realm
++
++		  Informational details about the realm. The following values
++		  should be present:
++		  <itemizedlist>
++		    <listitem><para><literal>server-software</literal>:
++		      identifier of the software running on the server (e.g.
++		      <literal>active-directory</literal>).</para></listitem>
++		    <listitem><para><literal>client-software</literal>:
++		      identifier of the software running on the client (e.g.
++		      <literal>sssd</literal>).</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="Details" type="a(ss)" access="read"/>
++
++		<!--
++		  RequiredPackages: prerequisite software
++
++		  Software packages that are required in order for a join to
++		  succeed. These are either simple strings like <literal>sssd</literal>,
++		  or strings with an operator and version number like
++		  <literal>sssd >= 1.9.0</literal>
++
++		  These values are specific to the packaging system that is
++		  being run.
++		-->
++		<property name="RequiredPackages" type="as" access="read"/>
++
++		<!--
++		  LoginFormats: supported formats for login names
++
++		  Supported formats for login to this realm. This is only
++		  relevant once the realm has been enrolled. The formats
++		  will contain a <literal>%U</literal> in the string, which
++		  indicate where the user name should be placed. The formats
++		  may contain a <literal>%D</literal> in the string which
++		  indicate where a domain name should be placed.
++
++		  The first format in the list is the preferred format for
++		  login names.
++		-->
++		<property name="LoginFormats" type="as" access="read"/>
++
++		<!--
++		  LoginPolicy: the policy for logins using this realm
++
++		  The policy for logging into this computer using this realm.
++
++		  The policy can be changed using the
++		  #org.freedesktop.realmd.Realm.ChangeLoginPolicy() method.
++
++		  The following policies are predefined. Not all providers
++		  support all these policies and there may be provider specific
++		  policies or multiple policies represented in the string:
++		  <itemizedlist>
++		    <listitem><para><literal>allow-any-login</literal>: allow
++		      login by any authenticated user present in this
++		      realm.</para></listitem>
++		    <listitem><para><literal>allow-realm-logins</literal>: allow
++		      logins according to the realm or domain policy for logins
++		      on this machine. This usually defaults to allowing any realm
++		      user to log in.</para></listitem>
++		    <listitem><para><literal>allow-permitted-logins</literal>:
++		      only allow the logins permitted in the
++		      #org.freedesktop.realmd.Realm:PermittedLogins
++		      property.</para></listitem>
++		    <listitem><para><literal>deny-any-login</literal>:
++		      don't allow any logins via authenticated users of this
++		      realm.</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="LoginPolicy" type="s" access="read"/>
++
++		<!--
++		  PermittedLogins: the permitted login names
++
++		  The list of permitted authenticated users allowed to login
++		  into this computer. This is only relevant if the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property
++		  contains the <literal>allow-permitted-logins</literal>
++		  string.
++		-->
++		<property name="PermittedLogins" type="as" access="read"/>
++
++		<!--
++		  PermittedGroups: the permitted group names
++
++		  The list of groups which users need to be in to be allowed
++		  to log into this computer. This is only relevant if the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property
++		  contains the <literal>allow-permitted-logins</literal>
++		  string.
++		-->
++		<property name="PermittedGroups" type="as" access="read"/>
++
++		<!--
++		  ChangeLoginPolicy:
++		  @login_policy: the new login policy, or an empty string
++		  @permitted_add: a list of logins to permit
++		  @permitted_remove: a list of logins to not permit
++		  @options: options for this operation
++
++		  Change the login policy and/or permitted logins for this realm.
++
++		  Not all realms support all the various login policies. An
++		  error will be returned if the new login policy is not supported.
++		  You may specify an empty string for the @login_policy argument
++		  which will cause no change in the policy itself. If the policy
++		  is changed, it will be reflected in the
++		  #org.freedesktop.realmd.Realm:LoginPolicy property.
++
++		  The @permitted_add and @permitted_remove arguments represent
++		  lists of login names that should be added and removed from
++		  the #org.freedesktop.realmd.Kerberos:PermittedLogins property.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>groups</literal>: boolean which if
++		    set to <literal>TRUE</literal> means that the names in
++		    @permitted_add and @permitted_remove are group names instead
++		    of login names.</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.login-policy</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the policy change failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to change login policy
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotConfigured</literal>:
++		      returned if the realm is not configured.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="ChangeLoginPolicy">
++			<arg name="login_policy" type="s" direction="in"/>
++			<arg name="permitted_add" type="as" direction="in"/>
++			<arg name="permitted_remove" type="as" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.Kerberos:
++	  @short_description: a kerberos realm
++
++	  An interface that describes a kerberos realm in more detail. This
++	  is always implemented on an DBus object path that also implements
++	  the #org.freedesktop.realmd.Realm interface.
++	-->
++	<interface name="org.freedesktop.realmd.Kerberos">
++
++		<!--
++		  RealmName: the kerberos realm name
++
++		  The kerberos name for this realm. This is usually in upper
++		  case.
++		-->
++		<property name="RealmName" type="s" access="read"/>
++
++		<!--
++		  DomainName: the DNS domain name
++
++		  The DNS domain name for this realm.
++		-->
++		<property name="DomainName" type="s" access="read"/>
++
++	</interface>
++
++	<!--
++	  org.freedesktop.realmd.KerberosMembership:
++
++	  An interface used to configure this machine by joining a realm.
++
++	  It sets up a computer/host account in the realm for this machine
++	  and a keytab to track the credentials for that account.
++
++	  The various properties are guaranteed to have been updated before
++	  the operation methods return, if they change state.
++	-->
++	<interface name="org.freedesktop.realmd.KerberosMembership">
++
++		<!--
++		  SuggestedAdministrator: common administrator name
++
++		  The common administrator name for this type of realm. This
++		  can be used by clients as a hint when prompting the user for
++		  administrative authentication.
++		-->
++		<property name="SuggestedAdministrator" type="s" access="read"/>
++
++		<!--
++		  SupportedJoinCredentials: credentials supported for joining
++
++		  Various kinds of credentials that are supported when calling the
++		  #org.freedesktop.realmd.Kerberos.Join() method.
++
++		  Each credential is represented by a type and an owner. The type
++		  denotes which kind of credential is passed to the method. The
++		  owner indicates to the client how to prompt the user or obtain
++		  the credential, and to the service how to use the credential.
++
++		  The various types are:
++		  <itemizedlist>
++		    <listitem><para><literal>ccache</literal>:
++		      the credentials should contain an array of bytes as a
++		      <literal>ay</literal> containing the data from a kerberos
++		      credential cache file.</para></listitem>
++		    <listitem><para><literal>password</literal>:
++		      the credentials should contain a pair of strings as a
++		      <literal>(ss)</literal> representing a name and
++		      password. The name may contain a realm in the standard
++		      kerberos format. If a realm is missing, it will default
++		      to this realm. </para></listitem>
++		    <listitem><para><literal>secret</literal>:
++		      the credentials should contain a string secret as an
++		      <literal>ay</literal> array of bytes. This is usually used
++		      for one time passwords. To pass a string here, encode it
++		      in UTF-8, and place the resulting bytes in the
++		      value.</para></listitem>
++		    <listitem><para><literal>automatic</literal>:
++		      the credentials should contain an empty string as a
++		      <literal>s</literal>. Using <literal>automatic</literal>
++		      indicates that default or system credentials are to be
++		      used.</para></listitem>
++		  </itemizedlist>
++
++		  The various owners are:
++		  <itemizedlist>
++		    <listitem><para><literal>administrator</literal>:
++		      the credentials belong to a kerberos administrator principal.
++		      The caller may use this as a hint to prompt the user
++		      for administrative credentials.</para></listitem>
++		    <listitem><para><literal>user</literal>:
++		      the credentials belong to a kerberos user principal.
++		      The caller may use this as a hint to prompt the user
++		      for his (possibly non-administrative)
++		      credentials.</para></listitem>
++		    <listitem><para><literal>computer</literal>:
++		      the credentials belong to a computer account.</para></listitem>
++		    <listitem><para><literal>none</literal>:
++		      the credentials have an unspecified owner, such as a one
++		      time password.</para></listitem>
++		  </itemizedlist>
++		-->
++		<property name="SupportedJoinCredentials" type="a(ss)" access="read"/>
++
++		<!--
++		  SupportedLeaveCredentials: credentials supported for leaving
++
++		  Various kinds of credentials that are supported when calling the
++		  #org.freedesktop.realmd.Kerberos.Leave() method.
++
++		  See #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials for
++		  a discussion of what the values represent.
++		-->
++		<property name="SupportedLeaveCredentials" type="a(ss)" access="read"/>
++
++		<!--
++		  Join:
++
++		  Join this machine to the realm and enroll the machine.
++
++		  If this method returns successfully, then the machine will be
++		  joined to the realm. It is not necessary to restart services or the
++		  machine afterward. Relevant properties on the realm will be updated
++		  before the method returns.
++
++		  The @credentials should be set according to one of the
++		  supported credentials returned by
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
++		  The first string in the tuple is the type, the second string
++		  is the owner, and the variant contains the credential contents
++		  See the discussion at
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
++		  for more information.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++                    <listitem><para><literal>automatic-id-mapping</literal>: a boolean
++                      value whether to turn on automatic UID/GID mapping. If not
++		      specified the default will come from realmd.conf
++                      configuration.</para></listitem>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		    <listitem><para><literal>computer-ou</literal>: a string
++		      containing an LDAP DN for an organizational unit where the
++		      computer account should be created</para></listitem>
++		    <listitem><para><literal>user-principal</literal>: a string
++		      containing an kerberos user principal name to be set on the
++		      computer account</para></listitem>
++		    <listitem><para><literal>membership-software</literal>: a string
++		      containing the membership software identifier that the returned
++		      realms should match.</para></listitem>
++		    <listitem><para><literal>manage-system</literal>: a boolean
++		      which controls whether this machine should be managed by
++		      the realm or domain or not. Defaults to true.</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.configure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the join failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform a join
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
++		      returned if the credentials passed did not authenticate against the realm
++		      correctly. It is appropriate to prompt the user again.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AlreadyEnrolled</literal>:
++		      returned if already enrolled in this realm, or if already enrolled in another realm
++		      (if enrolling in multiple realms is not supported).</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.BadHostname</literal>:
++		      returned if the machine has a hostname that is not usable for a join
++		      or is in conflict with those in the domain.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Join">
++			<arg name="credentials" type="(ssv)" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++		<!--
++		  Leave:
++
++		  Leave the realm and unenroll the machine.
++
++		  If this method returns successfully, then the machine will have
++		  left the domain and been unenrolled. It is not necessary to restart
++		  services or the machine afterward. Relevant properties on the realm
++		  will be updated before the method returns.
++
++		  The @credentials should be set according to one of the
++		  supported credentials returned by
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials.
++		  The first string in the tuple is the type, the second string
++		  is the owner, and the variant contains the credential contents
++		  See the discussion at
++		  #org.freedesktop.realmd.Kerberos:SupportedJoinCredentials
++		  for more information.
++
++		  @options can contain, but is not limited to, the following values:
++		  <itemizedlist>
++		    <listitem><para><literal>operation</literal>: a string
++		      identifier chosen by the client, which can then later be
++		      passed to org.freedesktop.realmd.Service.Cancel() in order
++		      to cancel the operation</para></listitem>
++		  </itemizedlist>
++
++		  This method requires authorization for the PolicyKit action
++		  called <literal>org.freedesktop.realmd.deconfigure-realm</literal>.
++
++		  In addition to common DBus error results, this method may return:
++		  <itemizedlist>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Failed</literal>:
++		      may be returned if the unenroll failed for a generic reason.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Cancelled</literal>:
++		      returned if the operation was cancelled.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotAuthorized</literal>:
++		      returned if the calling client is not permitted to perform an unenroll
++		      operation.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.AuthenticationFailed</literal>:
++		      returned if the credentials passed did not authenticate against the realm
++		      correctly. It is appropriate to prompt the user again.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.NotEnrolled</literal>:
++		      returned if not enrolled in this realm.</para></listitem>
++		    <listitem><para><literal>org.freedesktop.realmd.Error.Busy</literal>:
++		      returned if the service is currently performing another operation like
++		      join or leave.</para></listitem>
++		  </itemizedlist>
++		-->
++		<method name="Leave">
++			<arg name="credentials" type="(ssv)" direction="in"/>
++			<arg name="options" type="a{sv}" direction="in"/>
++		</method>
++
++	</interface>
++
++</node>
+-- 
+2.21.0
+
diff --git a/SOURCES/0001-lib-save-os-when-creating-user.patch b/SOURCES/0001-lib-save-os-when-creating-user.patch
index 6d11163..6439f3e 100644
--- a/SOURCES/0001-lib-save-os-when-creating-user.patch
+++ b/SOURCES/0001-lib-save-os-when-creating-user.patch
@@ -1,4 +1,4 @@
-From 4ff9bc526fec4be51f42739b4258529d7e4695a1 Mon Sep 17 00:00:00 2001
+From 51d5c9e9baec33aa74a60a4ac11f1de8f71acb2a Mon Sep 17 00:00:00 2001
 From: Ray Strode <rstrode@redhat.com>
 Date: Fri, 12 Oct 2018 15:53:52 -0400
 Subject: [PATCH] lib: save os when creating user
@@ -17,10 +17,10 @@ extension to accountsservice.
  create mode 100644 data/com.redhat.AccountsServiceUser.System.xml
 
 diff --git a/data/Makefile.am b/data/Makefile.am
-index 521c6c2..a441452 100644
+index 6cf5e30..648774c 100644
 --- a/data/Makefile.am
 +++ b/data/Makefile.am
-@@ -1,44 +1,56 @@
+@@ -1,45 +1,57 @@
  
  dbusifdir   = $(datadir)/dbus-1/interfaces
  dbusif_DATA = \
@@ -61,6 +61,7 @@ index 521c6c2..a441452 100644
  	$(dbusconf_DATA)	\
  	$(service_in_files)	\
  	$(policy_in_files)      \
+ 	org.freedesktop.realmd.xml	\
  	accounts-daemon.service.in
  
  DISTCLEANFILES = 		\
@@ -180,7 +181,7 @@ index 408d91f..d711d65 100644
  
  libaccountsservice_la_sources =                                               \
 diff --git a/src/libaccountsservice/act-user-manager.c b/src/libaccountsservice/act-user-manager.c
-index 325421b..091b46a 100644
+index e7e26b1..9f3d6e5 100644
 --- a/src/libaccountsservice/act-user-manager.c
 +++ b/src/libaccountsservice/act-user-manager.c
 @@ -27,60 +27,61 @@
@@ -840,5 +841,5 @@ index 325421b..091b46a 100644
  {
          GError *local_error = NULL;
 -- 
-2.17.1
+2.21.0
 
diff --git a/SPECS/accountsservice.spec b/SPECS/accountsservice.spec
index fcbb382..380e9f6 100644
--- a/SPECS/accountsservice.spec
+++ b/SPECS/accountsservice.spec
@@ -2,7 +2,7 @@
 
 Name:           accountsservice
 Version:        0.6.50
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        D-Bus interfaces for querying and manipulating user account information
 License:        GPLv3+
 URL:            https://www.freedesktop.org/wiki/Software/AccountsService/
@@ -28,6 +28,8 @@ Patch20:        0001-lib-don-t-set-loaded-state-until-seat-is-fetched.patch
 
 Patch30:        0001-data-don-t-send-change-updates-for-login-history.patch
 
+Patch40:        0001-daemon-if-no-local-users-check-if-machine-is-enrolle.patch
+
 Patch90:        0001-lib-save-os-when-creating-user.patch
 
 Requires:       polkit
@@ -113,6 +115,10 @@ rm $RPM_BUILD_ROOT%{_libdir}/*.a
 %{_datadir}/gtk-doc/html/libaccountsservice/*
 
 %changelog
+* Sun Dec 15 2019 Ray Strode <rstrode@redhat.com> - 0.6.50-8
+- Don't set HasNoUsers=true if realmd has providers
+  Related: #1750516
+
 * Mon Jun 17 2019 Ray Strode <rstrode@redhat.com> - 0.6.50-7
 - Don't send change updates for login history changes
   Resolves: #1713080