Changes to 'refs/tags/winsync-1.1.5'
by Noriko Hosoi
Changes since the dawn of time:
David Boreham (17):
Merge over new code: fractional replication, wan replication and windows sync plus associated UI
Merge password sync code from Bozeman Pass
Change password sync copyright notices, merge fixes to password sync code
Fix instability in re-try and backoff mechanism
Add new NT4 LDAP Service, used by windows sync
Fix handling of group membership, fix installer GUID, fix handling of entry description
Change GUID for installer
Fix display names in pass sync to say Fedora
Fix display name to say Fedora...
Fix various bad memory free bugs
Merge fixes over
Fixes for memory leaks in ntds
Patches we apply to apache ds 0.9
Update packaging for ntds
Fix ntds installer to allow repair and removal
Memory Leak Fixes for Apache DS
Fix for #157895 : logon hours doesn't work
Nathan Kinder (22):
Copyright updates
155068 - Added license to source files
Fixed licensing typo
Fix search scope for AD password sync - 159037
170321 - Increase winsync version to 1.0.1
170328 - Fixed modify type installation so it actually updates the registry
170558 - Add certutil, pk12util and missing dlls to PassSync.msi
170558 - Add certutil, pk12util and missing dlls to PassSync.msi
170135 - Improved passsync logging facilities
170556 - Make passsync obey backoff for retries when DS is down
170816 - Don't consume password changes if modify fails
170071 - Automatically add grouptype for new groups being synchd to NT4
Initial drop of new stand-alone winsync build-system
Changed unix style line endings to DOS style for nmake makefiles
Remove carriage returns from nmake makefiles
Initial checkin of stand-alone winsync build-system
186765 - Fixed memory leaks in passsync service
186171 - Fixed memory leaks in passhook.dll
186657 - Implemented locking around passhook data file access
Related: 490048
Related: 490048
ticket 47352 - Abandon old password changes prior to syncing
Noriko Hosoi (6):
Ticket #47353 - PassSync fails to open changelog
Ticket #47357 - Update the PassSync build environment
Ticket #47357 - Update the PassSync build environment
Ticket #47351 - Passsync loops when updating password of locked user
Ticket #363 - Passsync/Winsync handles passwords with 8-th bit characters incorrectly
bump verison to 1.1.5
Rich Megginson (12):
Resolves: bug 471408
Resolves: bug 482892
Resolves: bug 426421 245630 476095
remove internal paths ; use new improved unzip.vbs
Resolves: Bug 482892
Resolves: bug 482892
Resolves: bug 490048
rename to 389
Add support for Windows 2008, VC 9, 64-bit and 32-bit
Allow install to continue if service fails
Fix install issues on 2008 - bump version to 1.1.3
use nspr 4.8.4 and nss 3.12.6 - bump version to 1.1.4
Thomas Lackey (3):
Add makefile and component information to build the Apache DS for User Sync
Add installer icons.
Modify NTDS and PassSync to build in the 'built' directory.
unknown (4):
handle 32-bit and 64-bit ldapcsdk with different dates
Add VC runtime merge module - Add migration
Remove files on uninstall - allow install to continue if service doesn't start
Allow BRAND with spaces - remove CANDLE.EXE tracing
10 years, 10 months
passwordsync/build.bat
by Noriko Hosoi
passwordsync/build.bat | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 57e12858ed15469673664b3742fa389c2cbe1514
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 28 10:07:10 2013 -0700
bump verison to 1.1.5
diff --git a/passwordsync/build.bat b/passwordsync/build.bat
index 5b676dc..daf95b4 100644
--- a/passwordsync/build.bat
+++ b/passwordsync/build.bat
@@ -170,7 +170,7 @@ if [%BRANDNOSPACE%] == [] (
set BRANDNOSPACE=389
)
if [%VERSION%] == [] (
- set VERSION=1.1.4
+ set VERSION=1.1.5
)
rem ======== Set Various Build Directories ========
10 years, 10 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-group-task.c | 2
ldap/servers/plugins/posix-winsync/posix-winsync.c | 239 +++++++++++++-----
2 files changed, 184 insertions(+), 57 deletions(-)
New commits:
commit 58234ad4754875bce8a538cc42f872bc7b139f14
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu May 23 11:39:36 2013 -0700
Ticket #428 - posix winsync should support ADD user/group entries from DS to AD
Description: User/group entries added to DS do not have their
posix attributes synced to AD. This is due to a limitation in
the winsync v1 api. The v2 and later api support a pre add
callback for DS to AD entries.
This patch was originally provided by
From: Carsten Grzemba <cgrzemba(a)opencsw.org>
Date: Fri, 25 Jan 2013 14:59:32 +0100
Subject: ticket 428: add initial sync from DS to AD
Thank you for your contribution, Carsten!
It was reviewed and couple of minor bugs were fixed by nhosoi.
1) Commented out posix_group_del_memberuid_callback in
posix-group-task.c to clean up a compiler warning.
2) In posix_winsync_pre_ad_add_user_cb and posix_winsync_
pre_ad_add_group_cb, nisdomainname is added to the
to-be-added-to-AD entry only if nisdomainname is given.
3) In +posix_winsync_pre_ad_add_group_cb, a local variable
to scan array attr_map was unexpectedly shared with the
outer for loop for getting attribute value.
https://fedorahosted.org/389/ticket/428
Reviewed by Rich (Thank you!!)
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c
index 2cb9a31..b0659af 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-task.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c
@@ -173,6 +173,7 @@ posix_group_task_destructor(Slapi_Task *task)
}
}
+#if 0 /* NOT USED */
static int
posix_group_del_memberuid_callback(Slapi_Entry *e, void *callback_data)
{
@@ -207,6 +208,7 @@ posix_group_del_memberuid_callback(Slapi_Entry *e, void *callback_data)
return rc;
}
+#endif
static int
posix_group_fix_memberuid(char *dn, char *filter_str, void *txn)
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 154e22a..38450f5 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -389,26 +389,25 @@ attr_compare_equal(Slapi_Attr *a, Slapi_Attr *b)
return 1;
}
-static int
-addNisDomainName(Slapi_Mod *smod, const Slapi_Entry *ds_entry)
+/* look in the parent nodes of ds_entry for nis domain entry */
+char *
+getNisDomainName(const Slapi_Entry *ds_entry)
{
- Slapi_Entry *entry = NULL;
- char *type_NisDomain = "nisDomain";
- Slapi_PBlock * pb;
- int rc = -1;
-
- char* nisdomainname = NULL;
Slapi_DN* entry_sdn = slapi_entry_get_sdn((Slapi_Entry *) ds_entry);
Slapi_DN* subtree_sdn = slapi_sdn_new();
+ char *type_NisDomain = "nisDomain";
+ Slapi_PBlock * pb;
Slapi_DN *childparent = slapi_sdn_new();
- struct berval **vals;
+ char* nisdomainname = NULL;
+ Slapi_Entry *entry = NULL;
+ int rc = -1;
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "addNisDomainName start DN:%s\n",
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "getNisDomainName start DN:%s\n",
slapi_sdn_get_dn(entry_sdn));
+ /* search NIS domain name */
slapi_sdn_get_parent(entry_sdn, subtree_sdn);
pb = slapi_pblock_new();
do {
- Slapi_Attr *attr = NULL;
char *nisDomainAttr[] = { type_NisDomain, NULL };
slapi_sdn_get_parent(subtree_sdn, childparent);
@@ -420,45 +419,61 @@ addNisDomainName(Slapi_Mod *smod, const Slapi_Entry *ds_entry)
posix_winsync_get_plugin_identity());
if (rc == 0) {
if (rc == 0 && entry) {
- rc = slapi_entry_attr_find(entry, type_NisDomain, &attr);
- if (attr) {
- rc = slapi_attr_get_bervals_copy(attr, &vals);
- break;
- } else {
- rc = LDAP_NO_SUCH_ATTRIBUTE;
+ nisdomainname = slapi_entry_attr_get_charptr(entry, type_NisDomain);
+ if (nisdomainname != NULL){
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "getNisDomainName NisDomain %s found in DN:%s\n",
+ nisdomainname, slapi_sdn_get_dn(childparent));
+ break;
}
}
}
slapi_sdn_copy(childparent, subtree_sdn);
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "addNisDomainName iterate DN:%s\n", slapi_sdn_get_dn(subtree_sdn));
+ "getNisDomainName iterate DN:%s\n", slapi_sdn_get_dn(subtree_sdn));
slapi_entry_free(entry);
entry = NULL;
} while (PR_TRUE);
slapi_pblock_destroy(pb);
- if (rc != 0) {
+
+ if (rc != 0 || nisdomainname == NULL ) {
slapi_log_error(SLAPI_LOG_REPL, posix_winsync_plugin_name,
- "addNisDomainName: no nisdomainname found in %s, LDAP Err%d\n",
+ "getNisDomainName: no nisdomainname found in %s, LDAP Err%d\n",
slapi_sdn_get_dn(subtree_sdn), rc);
+ }
+ slapi_sdn_free(&childparent);
+ slapi_entry_free(entry);
+ entry = NULL;
+ slapi_sdn_free(&subtree_sdn);
+ return nisdomainname;
+}
+
+static int
+addNisDomainName(Slapi_Mod *smod, const Slapi_Entry *ds_entry)
+{
+ int rc = LDAP_SUCCESS;
+ char* nisdomainname = getNisDomainName(ds_entry);
+
+ if ( nisdomainname == NULL ) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "addNisDomainName NisDomain not found\n");
+ rc = LDAP_NO_SUCH_ATTRIBUTE;
} else {
+ struct berval bval;
+
slapi_mod_init(smod, 1);
slapi_mod_set_type(smod, "msSFU30NisDomain");
slapi_mod_set_operation(smod, LDAP_MOD_REPLACE | LDAP_MOD_BVALUES);
- slapi_mod_add_value(smod, vals[0]);
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "addNisDomainName NisDomain %s found in DN:%s\n", vals[0]->bv_val,
- slapi_sdn_get_dn(childparent));
+ bval.bv_val = nisdomainname;
+ bval.bv_len = sizeof (nisdomainname);
+ slapi_mod_add_value(smod, &bval);
+
if (slapi_is_loglevel_set(SLAPI_LOG_PLUGIN))
slapi_mod_dump((LDAPMod*) slapi_mod_get_ldapmod_byref(smod), 0);
- ber_bvecfree(vals);
-
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "addNisDomainName NisDomain %s found\n", nisdomainname);
+ slapi_ch_free_string(&nisdomainname); /* allocated by slapi_entry_attr_getchrptr */
}
- slapi_sdn_free(&childparent);
- slapi_entry_free(entry);
- entry = NULL;
- slapi_sdn_free(&subtree_sdn);
-
- slapi_ch_free_string(&nisdomainname);
return rc;
}
@@ -1117,7 +1132,7 @@ posix_winsync_pre_ds_add_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "--> _pre_ds_add_group_cb -- "
"look for [%s] to new entry [%s]\n", type, slapi_entry_get_dn_const(ds_entry));
- for (; attr_map[i].windows_attribute_name != NULL; i++) {
+ for (i = 0; attr_map && attr_map[i].windows_attribute_name != NULL; i++) {
if (slapi_attr_type_cmp(attr_map[i].windows_attribute_name, type,
SLAPI_TYPE_CMP_SUBTYPE) == 0) {
Slapi_ValueSet *svs = NULL;
@@ -1288,8 +1303,7 @@ posix_winsync_pre_ad_mod_group_mods_cb(void *cbdata, const Slapi_Entry *rawentry
} else {
slapi_mod_init_byval(mysmod, mod);
slapi_mod_set_type(mysmod, attr_map[i].windows_attribute_name);
- if (0
- == slapi_attr_type_cmp(mod->mod_type, "gidNumber", SLAPI_TYPE_CMP_SUBTYPE)) {
+ if (0 == slapi_attr_type_cmp(mod->mod_type, "gidNumber", SLAPI_TYPE_CMP_SUBTYPE)) {
Slapi_Mod *ocsmod = slapi_mod_new();
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"_pre_ad_mod_group_mods_cb -- add NisDomain\n");
@@ -1542,40 +1556,151 @@ posix_winsync_post_ds_add_group_cb(void *cookie, const Slapi_Entry *rawentry, Sl
return;
}
+/* winsync_plugin_call_pre_ad_add_user_cb(prp->agmt, mapped_entry, e); */
static void
-posix_winsync_pre_ad_add_user_cb(void *cookie, Slapi_Entry *ds_entry, Slapi_Entry *ad_entry)
+posix_winsync_pre_ad_add_user_cb(void *cookie, Slapi_Entry *ad_entry, Slapi_Entry *ds_entry)
{
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "--> posix_winsync_pre_ad_add_user_cb -- begin\n");
-
-#ifdef THIS_IS_JUST_AN_EXAMPLE
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "Adding AD entry [%s] from add of DS entry [%s]\n",
- slapi_entry_get_dn(ad_entry), slapi_entry_get_dn(ds_entry));
- /* make modifications to ad_entry here */
-#endif
+ Slapi_Attr * obj_attr = NULL; /* Entry attributes */
+ windows_attribute_map *attr_map=user_attribute_map;
+ int rc = 0;
+ if(posix_winsync_config_get_msSFUSchema())
+ attr_map=user_mssfu_attribute_map;
+
+/* if ds_entry has oc posixAccount add uidnumber, gidnumber, homeDirectory, loginShell, gecos */
+/* syncing/mapping of nsaccountlock -> userAccountControl will already done by the normal Win Sync-Service */
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_user_cb -- begin DS account [%s] \n", slapi_entry_get_dn_const(ds_entry));
+
+ rc = slapi_entry_attr_find(ds_entry, "objectclass", &obj_attr);
+ if (rc == 0) { /* Found objectclasses, so... */
+ int i;
+ Slapi_Value * value = NULL; /* Attribute values */
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,"_pre_ad_add_user_cb -- test objectclass posixAccount\n");
+ for (
+ i = slapi_attr_first_value(obj_attr, &value);
+ i != -1;
+ i = slapi_attr_next_value(obj_attr, i, &value)
+ ) {
+ const char * oc = NULL;
+
+ oc = slapi_value_get_string(value);
+ slapi_log_error( SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,"_pre_ad_add_user_cb -- oc: %s \n", oc);
+ if (strncasecmp(oc,"posixAccount",13)==0){ /* entry has objectclass posixAccount */
+ Slapi_Attr *attr = NULL;
+ char *nisdomainname = getNisDomainName(ds_entry);
+
+ for (rc = slapi_entry_first_attr(ds_entry, &attr); attr && (rc == 0);
+ rc = slapi_entry_next_attr(ds_entry, attr, &attr))
+ {
+ char *type = NULL;
+ size_t i = 0;
+
+ slapi_attr_get_type( attr, &type );
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "_pre_ad_add_user_cb -- check add attr: %s\n", type);
+ for (; attr_map[i].windows_attribute_name != NULL; i++) {
+ if (0 == slapi_attr_type_cmp(type,attr_map[i].ldap_attribute_name, SLAPI_TYPE_CMP_SUBTYPE)){
+ Slapi_ValueSet *vs = NULL;
+
+ slapi_attr_get_valueset(attr,&vs);
+ slapi_entry_add_valueset(ad_entry, attr_map[i].windows_attribute_name, vs);
+ slapi_valueset_free(vs);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_user_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ad_entry));
+ }
+ }
+ }
+ if (nisdomainname) {
+ slapi_entry_add_value(ad_entry,
+ "msSFU30NisDomain", slapi_value_new_string(nisdomainname));
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_user_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ "msSFU30NisDomain", nisdomainname);
+ slapi_ch_free_string(&nisdomainname);
+ }
+ }
+ }
+ }
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "<-- posix_winsync_pre_ad_add_user_cb -- end\n");
+ "<-- _pre_ad_add_user_cb -- end\n");
return;
}
static void
-posix_winsync_pre_ad_add_group_cb(void *cookie, Slapi_Entry *ds_entry, Slapi_Entry *ad_entry)
+posix_winsync_pre_ad_add_group_cb(void *cookie, Slapi_Entry *ad_entry, Slapi_Entry *ds_entry)
{
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "--> posix_winsync_pre_ad_add_group_cb -- begin\n");
-
-#ifdef THIS_IS_JUST_AN_EXAMPLE
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "Adding AD entry [%s] from add of DS entry [%s]\n",
- slapi_entry_get_dn(ad_entry), slapi_entry_get_dn(ds_entry));
- /* make modifications to ad_entry here */
-#endif
+ Slapi_Attr * obj_attr = NULL; /* Entry attributes */
+ windows_attribute_map *attr_map = group_attribute_map;
+ int rc = 0;
+ if (posix_winsync_config_get_msSFUSchema()) {
+ attr_map=group_mssfu_attribute_map;
+ }
+
+/* if ds_entry has oc posixGroup add gidnumber, ... */
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_group_cb -- begin DS account [%s] \n", slapi_entry_get_dn_const(ds_entry));
+
+ rc = slapi_entry_attr_find(ds_entry, "objectclass", &obj_attr);
+ if (rc == 0) { /* Found objectclasses, so... */
+ int i;
+ Slapi_Value * value = NULL; /* Attribute values */
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,"_pre_ad_add_group_cb -- test objectclass posixGroup\n");
+ for (i = slapi_attr_first_value(obj_attr, &value);
+ i != -1;
+ i = slapi_attr_next_value(obj_attr, i, &value)) {
+ const char * oc = NULL;
+
+ oc = slapi_value_get_string(value);
+ if (strncasecmp(oc,"posixGroup",11)==0){ /* entry has objectclass posixGroup */
+ Slapi_Attr *attr = NULL;
+ char *nisdomainname = getNisDomainName(ds_entry);
+
+ for (rc = slapi_entry_first_attr(ds_entry, &attr); rc == 0;
+ rc = slapi_entry_next_attr(ds_entry, attr, &attr))
+ {
+ char *type = NULL;
+ int j = 0;
+
+ slapi_attr_get_type( attr, &type );
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "_pre_ad_add_group_cb -- check add attr: %s\n", type);
+ for (j = 0; attr_map && attr_map[j].windows_attribute_name != NULL; j++) {
+ if (0 == slapi_attr_type_cmp(type,attr_map[j].ldap_attribute_name, SLAPI_TYPE_CMP_SUBTYPE)){
+ Slapi_ValueSet *vs = NULL;
+
+ slapi_attr_get_valueset(attr,&vs);
+ slapi_entry_add_valueset(ad_entry, attr_map[j].windows_attribute_name, vs);
+ slapi_valueset_free(vs);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_group_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ad_entry));
+ }
+ }
+ }
+ if (nisdomainname) {
+ slapi_entry_add_value(ad_entry, "msSFU30NisDomain", slapi_value_new_string(nisdomainname));
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ad_add_group_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ "msSFU30NisDomain", nisdomainname);
+ slapi_ch_free_string(&nisdomainname);
+ }
+ }
+ }
+ }
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "<-- posix_winsync_pre_ad_add_group_cb -- end\n");
+ "<-- _pre_ad_add_group_cb -- end\n");
return;
}
10 years, 11 months
2 commits - ldap/servers
by Mark Reynolds
ldap/servers/slapd/back-ldbm/back-ldbm.h | 15 ++++++++-------
ldap/servers/slapd/back-ldbm/dblayer.c | 22 +++++++++++++++++-----
ldap/servers/slapd/back-ldbm/id2entry.c | 4 ++--
ldap/servers/slapd/back-ldbm/ldbm_attr.c | 2 +-
ldap/servers/slapd/back-ldbm/ldbm_config.c | 21 +++++++++++++++++++++
ldap/servers/slapd/back-ldbm/ldbm_config.h | 1 +
ldap/servers/slapd/back-ldbm/upgrade.c | 13 ++++++++-----
7 files changed, 58 insertions(+), 20 deletions(-)
New commits:
commit 930ca392045d3ddb1a93bb38c0b9e17bb5b0b35a
Merge: a541936 0c3ca8a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu May 23 15:55:54 2013 -0400
Merge branch 'ticket47326'
commit 0c3ca8a49ae89aba1a9848215b1d2191918311c2
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu May 23 15:16:35 2013 -0400
Ticket 47326 - idl switch does not work
Bug Description: Setting nsslapd-idl-switch to "old" always gets converted
to "new", as the server tries to update the idl type.
This makes it impossible to test the "old" idl processes.
Fix Description: Added a new ldbm config setting to control if we do the upgrade
check or not: "nsslapd-idl-update". The default is "on". This
still allows the server to update the type by default, but if
you must use "old", then you must turn the "update" off.
Also did some minor code cleanup, and fixed some small memory leaks.
https://fedorahosted.org/389/ticket/47326
Reviewed by: Noriko(Thanks!)
diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h
index 871d489..e565360 100644
--- a/ldap/servers/slapd/back-ldbm/back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h
@@ -645,13 +645,14 @@ struct ldbminfo {
int li_fat_lock; /* 608146 -- make this configurable, first */
int li_legacy_errcode; /* 615428 -- in case legacy err code is expected */
Slapi_Counter *li_global_usn_counter; /* global USN counter */
- int li_reslimit_allids_handle; /* allids aka idlistscan */
- int li_pagedlookthroughlimit;
- int li_pagedallidsthreshold;
- int li_reslimit_pagedlookthrough_handle;
- int li_reslimit_pagedallids_handle; /* allids aka idlistscan */
- int li_rangelookthroughlimit;
- int li_reslimit_rangelookthrough_handle;
+ int li_reslimit_allids_handle; /* allids aka idlistscan */
+ int li_pagedlookthroughlimit;
+ int li_pagedallidsthreshold;
+ int li_reslimit_pagedlookthrough_handle;
+ int li_reslimit_pagedallids_handle; /* allids aka idlistscan */
+ int li_rangelookthroughlimit;
+ int li_reslimit_rangelookthrough_handle;
+ int li_idl_update;
};
/* li_flags could store these bits defined in ../slapi-plugin.h
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 99902d9..2b0699c 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -2091,6 +2091,7 @@ int dblayer_instance_start(backend *be, int mode)
LDAPDebug(LDAP_DEBUG_ANY, "Instance %s does not have the "
"expected version\n", inst->inst_name, 0, 0);
PR_ASSERT(0);
+ slapi_ch_free_string(&dataversion);
return_value = -1;
goto errout;
}
@@ -2100,6 +2101,7 @@ int dblayer_instance_start(backend *be, int mode)
"%s is on, while the instance %s is in the DN format. "
"Please run dn2rdn to convert the database format.\n",
CONFIG_ENTRYRDN_SWITCH, inst->inst_name);
+ slapi_ch_free_string(&dataversion);
return_value = -1;
goto errout;
}
@@ -2109,6 +2111,7 @@ int dblayer_instance_start(backend *be, int mode)
"%s is off, while the instance %s is in the RDN "
"format. Please change the value to on in dse.ldif.\n",
CONFIG_ENTRYRDN_SWITCH, inst->inst_name);
+ slapi_ch_free_string(&dataversion);
return_value = -1;
goto errout;
}
@@ -2976,6 +2979,7 @@ dblayer_remove_env(struct ldbminfo *li)
static int
_dblayer_set_db_callbacks(dblayer_private *priv, DB *dbp, struct attrinfo *ai)
{
+ int idl_use_new = 0;
int rc = 0;
/* With the new idl design, the large 8Kbyte pages we use are not
@@ -3005,16 +3009,24 @@ _dblayer_set_db_callbacks(dblayer_private *priv, DB *dbp, struct attrinfo *ai)
if (rc)
return rc;
#endif
-
- if (idl_get_idl_new() && !(ai->ai_indexmask & INDEX_VLV)) {
+ /*
+ * If using the "new" idl, set the flags and the compare function.
+ * If using the "old" idl, we still need to set the index DB flags
+ * for the attribute "entryRDN".
+ */
+ if ( ((idl_use_new = idl_get_idl_new()) ||
+ 0 == strcasecmp(ai->ai_type, LDBM_ENTRYRDN_STR)) &&
+ !(ai->ai_indexmask & INDEX_VLV))
+ {
+ /* set the flags */
rc = dbp->set_flags(dbp, DB_DUP | DB_DUPSORT);
if (rc)
return rc;
-
+ /* set the compare function */
if (ai->ai_dup_cmp_fn) {
/* If set, use the special dup compare callback */
rc = dbp->set_dup_compare(dbp, ai->ai_dup_cmp_fn);
- } else {
+ } else if(idl_use_new) {
rc = dbp->set_dup_compare(dbp, idl_new_compare_dups);
}
if (rc)
@@ -6950,7 +6962,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
{
adjust_idl_switch(ldbmversion, li);
slapi_ch_free_string(&ldbmversion);
- slapi_ch_free_string(&ldbmversion);
+ slapi_ch_free_string(&dataversion);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/id2entry.c b/ldap/servers/slapd/back-ldbm/id2entry.c
index dae558c..281bb1b 100644
--- a/ldap/servers/slapd/back-ldbm/id2entry.c
+++ b/ldap/servers/slapd/back-ldbm/id2entry.c
@@ -367,7 +367,7 @@ id2entry( backend *be, ID id, back_txn *txn, int *err )
ee = slapi_str2entry( data.dptr, SLAPI_STR2ENTRY_NO_ENTRYDN );
} else {
char *normdn = NULL;
- Slapi_RDN * srdn = NULL;
+ Slapi_RDN * srdn = NULL;
struct backdn *bdn = dncache_find_id(&inst->inst_dncache, id);
if (bdn) {
normdn = slapi_ch_strdup(slapi_sdn_get_dn(bdn->dn_sdn));
@@ -407,7 +407,7 @@ id2entry( backend *be, ID id, back_txn *txn, int *err )
SLAPI_STR2ENTRY_NO_ENTRYDN );
slapi_ch_free_string(&rdn);
slapi_ch_free_string(&normdn);
- slapi_rdn_free(&srdn);
+ slapi_rdn_free(&srdn);
}
} else {
ee = slapi_str2entry( data.dptr, 0 );
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attr.c b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
index 7433ec7..09f1a48 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attr.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attr.c
@@ -202,7 +202,7 @@ attr_index_config(
slapi_attr_init(&a->ai_sattr, attrValue->bv_val);
/*
* we can't just set a->ai_type to the type from a->ai_sattr
- * if the type has attroptions or subtypes, ai_sattr.a_type will
+ * if the type has attr options or subtypes, ai_sattr.a_type will
* contain them - but for the purposes of indexing, we don't want them
*/
a->ai_type = slapi_attr_basetype( attrValue->bv_val, NULL, 0 );
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index b72984b..08fc536 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -872,6 +872,26 @@ static void *ldbm_config_db_private_import_mem_get(void *arg)
return (void *) ((uintptr_t)li->li_dblayer_private->dblayer_private_import_mem);
}
+static void *ldbm_config_idl_get_update(void *arg)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+
+ return (void *) ((uintptr_t)li->li_idl_update);
+}
+
+static int ldbm_config_idl_set_update(void *arg, void *value, char *errorbuf, int phase, int apply)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+ int retval = LDAP_SUCCESS;
+ int val = (int) ((uintptr_t)value);
+
+ if (apply) {
+ li->li_idl_update = val;
+ }
+
+ return retval;
+}
+
static int ldbm_config_db_private_import_mem_set(void *arg, void *value, char *errorbuf, int phase, int apply)
{
struct ldbminfo *li = (struct ldbminfo *) arg;
@@ -1350,6 +1370,7 @@ static config_info ldbm_config[] = {
{CONFIG_CACHE_AUTOSIZE_SPLIT, CONFIG_TYPE_INT, "50", &ldbm_config_cache_autosize_split_get, &ldbm_config_cache_autosize_split_set, 0},
{CONFIG_IMPORT_CACHESIZE, CONFIG_TYPE_SIZE_T, "20000000", &ldbm_config_import_cachesize_get, &ldbm_config_import_cachesize_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONFIG_IDL_SWITCH, CONFIG_TYPE_STRING, "new", &ldbm_config_idl_get_idl_new, &ldbm_config_idl_set_tune, CONFIG_FLAG_ALWAYS_SHOW},
+ {CONFIG_IDL_UPDATE, CONFIG_TYPE_ONOFF, "on", &ldbm_config_idl_get_update, &ldbm_config_idl_set_update, 0},
{CONFIG_BYPASS_FILTER_TEST, CONFIG_TYPE_STRING, "on", &ldbm_config_get_bypass_filter_test, &ldbm_config_set_bypass_filter_test, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONFIG_USE_VLV_INDEX, CONFIG_TYPE_ONOFF, "on", &ldbm_config_get_use_vlv_index, &ldbm_config_set_use_vlv_index, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONFIG_DB_LOCKDOWN, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_lockdown_get, &ldbm_config_db_lockdown_set, 0},
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.h b/ldap/servers/slapd/back-ldbm/ldbm_config.h
index 204f64d..17883cb 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.h
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.h
@@ -140,6 +140,7 @@ struct config_info {
#define CONFIG_DB_TX_MAX "nsslapd-db-tx-max"
#define CONFIG_IDL_SWITCH "nsslapd-idl-switch"
+#define CONFIG_IDL_UPDATE "nsslapd-idl-update"
#define CONFIG_BYPASS_FILTER_TEST "nsslapd-search-bypass-filter-test"
#define CONFIG_USE_VLV_INDEX "nsslapd-search-use-vlv-index"
#define CONFIG_SERIAL_LOCK "nsslapd-serial-lock"
diff --git a/ldap/servers/slapd/back-ldbm/upgrade.c b/ldap/servers/slapd/back-ldbm/upgrade.c
index a10ee9b..4f322fa 100644
--- a/ldap/servers/slapd/back-ldbm/upgrade.c
+++ b/ldap/servers/slapd/back-ldbm/upgrade.c
@@ -321,6 +321,11 @@ adjust_idl_switch(char *ldbmversion, struct ldbminfo *li)
{
int rval = 0;
+ if( !li->li_idl_update ){
+ /* we are not overriding the idl type */
+ return rval;
+ }
+
li->li_flags |= LI_FORCE_MOD_CONFIG;
if ((0 == PL_strncasecmp(ldbmversion, BDB_IMPL, strlen(BDB_IMPL))) ||
(0 == PL_strcmp(ldbmversion, LDBM_VERSION))) /* db: new idl */
@@ -328,11 +333,9 @@ adjust_idl_switch(char *ldbmversion, struct ldbminfo *li)
if (!idl_get_idl_new()) /* config: old idl */
{
replace_ldbm_config_value(CONFIG_IDL_SWITCH, "new", li);
- LDAPDebug(LDAP_DEBUG_ANY,
+ LDAPDebug(LDAP_DEBUG_ANY,
"Warning: Dbversion %s does not meet nsslapd-idl-switch: \"old\"; "
- "nsslapd-idl-switch is updated to \"new\"\n",
-
- ldbmversion, 0, 0);
+ "nsslapd-idl-switch is updated to \"new\"\n", ldbmversion, 0, 0);
}
}
else if ((0 == strcmp(ldbmversion, LDBM_VERSION_OLD)) ||
@@ -354,7 +357,7 @@ adjust_idl_switch(char *ldbmversion, struct ldbminfo *li)
LDAPDebug(LDAP_DEBUG_ANY,
"Warning: Dbversion %s is not supported\n",
ldbmversion, 0, 0);
- rval = 1;
+ rval = -1;
}
/* ldbminfo is a common resource; should clean up when the job is done */
10 years, 11 months
ldap/servers
by Richard Allen Megginson
ldap/servers/slapd/daemon.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
New commits:
commit a5419366ada4b10b245306e809f5805ba9adacd7
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Tue May 21 17:30:50 2013 -0600
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
https://fedorahosted.org/389/ticket/47359
Reviewed by: nhosoi (Thanks!)
Branch: master
Fix Description: Fix more build breakage in previous commit
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 56069d0..7791f81 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -140,7 +140,7 @@ void disk_monitoring_stop();
typedef struct listener_info {
int idx; /* index of this listener in the ct->fd array */
- PRFileDesc *listenpr; /* the listener fd */
+ PRFileDesc *listenfd; /* the listener fd */
int secure;
int local;
} listener_info;
@@ -966,7 +966,6 @@ void slapd_daemon( daemon_ports_t *ports )
int s_tcps_native = 0;
PRFileDesc *s_tcps = NULL;
#else
- PRFileDesc *tcps = 0;
PRFileDesc **n_tcps = NULL;
PRFileDesc **s_tcps = NULL;
PRFileDesc **i_unix = NULL;
@@ -1169,9 +1168,6 @@ void slapd_daemon( daemon_ports_t *ports )
int oserr;
#endif
int select_return = 0;
- int secure = 0; /* is a new connection an SSL one ? */
- int local = 0; /* is new connection an ldapi one? */
- int i;
#ifndef _WIN32
PRErrorCode prerr;
10 years, 11 months
ldap/servers
by Richard Allen Megginson
ldap/servers/slapd/daemon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 56f661cf0b076a76e6016386635d544fca992dda
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Tue May 21 17:21:10 2013 -0600
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
https://fedorahosted.org/389/ticket/47359
Reviewed by: nhosoi (Thanks!)
Branch: master
Fix Description: Fix build breakage in previous commit
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index b4bbc7f..56069d0 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -941,7 +941,7 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste
int rc = handle_new_connection(ct, SLAPD_INVALID_SOCKET, listenfd, secure, local);
if (rc) {
LDAPDebug1Arg(LDAP_DEBUG_CONNS, "Error accepting new connection listenfd=%d\n",
- PR_FileDesc2NativeHandle(listenc->c_prfd));
+ PR_FileDesc2NativeHandle(listenfd));
continue;
}
}
10 years, 11 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/windows_protocol_util.c | 35 +++++++++++++--
1 file changed, 31 insertions(+), 4 deletions(-)
New commits:
commit ec592bb9b320a74c1525671770b63294a8e7f64a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 21 12:16:52 2013 -0700
Ticket #47327 - error syncing group if group member user is not synced
Bug description: Windows Sync synchronizes member attributes
in a group entry if the member entry itself is synchronized.
The entries in the sync scope are basically to be synchronized.
But there is an exception such as a container in the scope is
not synchronized due to the objecttype constraints. Such an
unsync'ed entry could have users in it. Users are the target
of Windows Sync. But since the parent container is not synch-
ronized, the users in the container are not, neither. If a
group contains such special user as a member, synchronization
failed there and the other normal members are failed to get
synchronized.
Fix description: Windows Sync has a helper function
is_subject_of_agreement_remote, which checks if the entry is
in the scope to be synchronized. This patch adds the check
if the checking entry's parent locally exists in the DS. If
it does not exist, it considers the entry is out of scope.
AD strictly checks if the entry exists prior to adding it
to a group entry as a member. That is, a member to be added
is supposed to be in the server, as well as its parent is.
With this change, the AD user which is not synchronized to
the DS is just skipped to add to the group in the DS in the
same manner as an user out of scope is.
https://fedorahosted.org/389/ticket/47327
Reviewed by Rich (Thanks!!)
(cherry picked from commit 9b0834c07888aa1ee88b52141460a3b4e80d1962)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index d831fa0..1bafa9a 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -3799,8 +3799,11 @@ map_entry_dn_inbound_ext(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra, int
windows_private_get_windows_subtree(ra));
}
}
- new_dn = slapi_sdn_new_dn_byval(new_dn_string);
- PR_smprintf_free(new_dn_string);
+ /*
+ * new_dn_string is created by slapi_create_dn_string,
+ * which is normalized. Thus, we can use _normdn_.
+ */
+ new_dn = slapi_sdn_new_normdn_passin(new_dn_string);
slapi_ch_free_string(&container_str);
/* Clear any earlier error */
retval = 0;
@@ -3895,6 +3898,7 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
int retval = 0;
int is_in_subtree = 0;
const Slapi_DN *agreement_subtree = NULL;
+ const Slapi_DN *sdn;
/* First test for the sync'ed subtree */
agreement_subtree = windows_private_get_windows_subtree(ra);
@@ -3902,10 +3906,33 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
{
goto error;
}
- is_in_subtree = slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), agreement_subtree, LDAP_SCOPE_SUBTREE);
+ sdn = slapi_entry_get_sdn_const(e);
+ is_in_subtree = slapi_sdn_scope_test(sdn, agreement_subtree, LDAP_SCOPE_SUBTREE);
if (is_in_subtree)
{
- retval = 1;
+ Slapi_DN psdn = {0};
+ Slapi_Entry *pentry = NULL;
+ /*
+ * Check whether the parent of the entry exists or not.
+ * If it does not, treat the entry e is out of scope.
+ * For instance, agreement_subtree is cn=USER,<SUFFIX>
+ * cn=container,cn=USER,<SUFFIX> is not synchronized.
+ * If 'e' is uid=test,cn=container,cn=USER,<SUFFIX>,
+ * the entry is not synchronized, either. We treat
+ * 'e' as out of scope.
+ */
+ slapi_sdn_get_parent(sdn, &psdn);
+ if (0 == slapi_sdn_compare(&psdn, agreement_subtree)) {
+ retval = 1;
+ } else {
+ /* If parent entry is not local, the entry is out of scope */
+ int rc = windows_get_local_entry(&psdn, &pentry);
+ if ((0 == rc) && pentry) {
+ retval = 1;
+ slapi_entry_free(pentry);
+ }
+ }
+ slapi_sdn_done(&psdn);
}
error:
return retval;
10 years, 11 months
Branch '389-ds-base-1.3.0' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/windows_protocol_util.c | 35 +++++++++++++--
1 file changed, 31 insertions(+), 4 deletions(-)
New commits:
commit d89bc2297397508c27caf6074f094bfba6b2b012
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 21 12:16:52 2013 -0700
Ticket #47327 - error syncing group if group member user is not synced
Bug description: Windows Sync synchronizes member attributes
in a group entry if the member entry itself is synchronized.
The entries in the sync scope are basically to be synchronized.
But there is an exception such as a container in the scope is
not synchronized due to the objecttype constraints. Such an
unsync'ed entry could have users in it. Users are the target
of Windows Sync. But since the parent container is not synch-
ronized, the users in the container are not, neither. If a
group contains such special user as a member, synchronization
failed there and the other normal members are failed to get
synchronized.
Fix description: Windows Sync has a helper function
is_subject_of_agreement_remote, which checks if the entry is
in the scope to be synchronized. This patch adds the check
if the checking entry's parent locally exists in the DS. If
it does not exist, it considers the entry is out of scope.
AD strictly checks if the entry exists prior to adding it
to a group entry as a member. That is, a member to be added
is supposed to be in the server, as well as its parent is.
With this change, the AD user which is not synchronized to
the DS is just skipped to add to the group in the DS in the
same manner as an user out of scope is.
https://fedorahosted.org/389/ticket/47327
Reviewed by Rich (Thanks!!)
(cherry picked from commit 9b0834c07888aa1ee88b52141460a3b4e80d1962)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 84382e5..03d6ff3 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -3858,8 +3858,11 @@ map_entry_dn_inbound_ext(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra, int
windows_private_get_windows_subtree(ra));
}
}
- new_dn = slapi_sdn_new_dn_byval(new_dn_string);
- PR_smprintf_free(new_dn_string);
+ /*
+ * new_dn_string is created by slapi_create_dn_string,
+ * which is normalized. Thus, we can use _normdn_.
+ */
+ new_dn = slapi_sdn_new_normdn_passin(new_dn_string);
slapi_ch_free_string(&container_str);
/* Clear any earlier error */
retval = 0;
@@ -3954,6 +3957,7 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
int retval = 0;
int is_in_subtree = 0;
const Slapi_DN *agreement_subtree = NULL;
+ const Slapi_DN *sdn;
/* First test for the sync'ed subtree */
agreement_subtree = windows_private_get_windows_subtree(ra);
@@ -3961,10 +3965,33 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
{
goto error;
}
- is_in_subtree = slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), agreement_subtree, LDAP_SCOPE_SUBTREE);
+ sdn = slapi_entry_get_sdn_const(e);
+ is_in_subtree = slapi_sdn_scope_test(sdn, agreement_subtree, LDAP_SCOPE_SUBTREE);
if (is_in_subtree)
{
- retval = 1;
+ Slapi_DN psdn = {0};
+ Slapi_Entry *pentry = NULL;
+ /*
+ * Check whether the parent of the entry exists or not.
+ * If it does not, treat the entry e is out of scope.
+ * For instance, agreement_subtree is cn=USER,<SUFFIX>
+ * cn=container,cn=USER,<SUFFIX> is not synchronized.
+ * If 'e' is uid=test,cn=container,cn=USER,<SUFFIX>,
+ * the entry is not synchronized, either. We treat
+ * 'e' as out of scope.
+ */
+ slapi_sdn_get_parent(sdn, &psdn);
+ if (0 == slapi_sdn_compare(&psdn, agreement_subtree)) {
+ retval = 1;
+ } else {
+ /* If parent entry is not local, the entry is out of scope */
+ int rc = windows_get_local_entry(&psdn, &pentry);
+ if ((0 == rc) && pentry) {
+ retval = 1;
+ slapi_entry_free(pentry);
+ }
+ }
+ slapi_sdn_done(&psdn);
}
error:
return retval;
10 years, 11 months
Branch '389-ds-base-1.3.1' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/windows_protocol_util.c | 35 +++++++++++++--
1 file changed, 31 insertions(+), 4 deletions(-)
New commits:
commit c7e0b79caf345535b36fdeed35bfbb71b3dec193
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 21 12:16:52 2013 -0700
Ticket #47327 - error syncing group if group member user is not synced
Bug description: Windows Sync synchronizes member attributes
in a group entry if the member entry itself is synchronized.
The entries in the sync scope are basically to be synchronized.
But there is an exception such as a container in the scope is
not synchronized due to the objecttype constraints. Such an
unsync'ed entry could have users in it. Users are the target
of Windows Sync. But since the parent container is not synch-
ronized, the users in the container are not, neither. If a
group contains such special user as a member, synchronization
failed there and the other normal members are failed to get
synchronized.
Fix description: Windows Sync has a helper function
is_subject_of_agreement_remote, which checks if the entry is
in the scope to be synchronized. This patch adds the check
if the checking entry's parent locally exists in the DS. If
it does not exist, it considers the entry is out of scope.
AD strictly checks if the entry exists prior to adding it
to a group entry as a member. That is, a member to be added
is supposed to be in the server, as well as its parent is.
With this change, the AD user which is not synchronized to
the DS is just skipped to add to the group in the DS in the
same manner as an user out of scope is.
https://fedorahosted.org/389/ticket/47327
Reviewed by Rich (Thanks!!)
(cherry picked from commit 9b0834c07888aa1ee88b52141460a3b4e80d1962)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 84382e5..03d6ff3 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -3858,8 +3858,11 @@ map_entry_dn_inbound_ext(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra, int
windows_private_get_windows_subtree(ra));
}
}
- new_dn = slapi_sdn_new_dn_byval(new_dn_string);
- PR_smprintf_free(new_dn_string);
+ /*
+ * new_dn_string is created by slapi_create_dn_string,
+ * which is normalized. Thus, we can use _normdn_.
+ */
+ new_dn = slapi_sdn_new_normdn_passin(new_dn_string);
slapi_ch_free_string(&container_str);
/* Clear any earlier error */
retval = 0;
@@ -3954,6 +3957,7 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
int retval = 0;
int is_in_subtree = 0;
const Slapi_DN *agreement_subtree = NULL;
+ const Slapi_DN *sdn;
/* First test for the sync'ed subtree */
agreement_subtree = windows_private_get_windows_subtree(ra);
@@ -3961,10 +3965,33 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
{
goto error;
}
- is_in_subtree = slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), agreement_subtree, LDAP_SCOPE_SUBTREE);
+ sdn = slapi_entry_get_sdn_const(e);
+ is_in_subtree = slapi_sdn_scope_test(sdn, agreement_subtree, LDAP_SCOPE_SUBTREE);
if (is_in_subtree)
{
- retval = 1;
+ Slapi_DN psdn = {0};
+ Slapi_Entry *pentry = NULL;
+ /*
+ * Check whether the parent of the entry exists or not.
+ * If it does not, treat the entry e is out of scope.
+ * For instance, agreement_subtree is cn=USER,<SUFFIX>
+ * cn=container,cn=USER,<SUFFIX> is not synchronized.
+ * If 'e' is uid=test,cn=container,cn=USER,<SUFFIX>,
+ * the entry is not synchronized, either. We treat
+ * 'e' as out of scope.
+ */
+ slapi_sdn_get_parent(sdn, &psdn);
+ if (0 == slapi_sdn_compare(&psdn, agreement_subtree)) {
+ retval = 1;
+ } else {
+ /* If parent entry is not local, the entry is out of scope */
+ int rc = windows_get_local_entry(&psdn, &pentry);
+ if ((0 == rc) && pentry) {
+ retval = 1;
+ slapi_entry_free(pentry);
+ }
+ }
+ slapi_sdn_done(&psdn);
}
error:
return retval;
10 years, 11 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/windows_protocol_util.c | 35 +++++++++++++--
1 file changed, 31 insertions(+), 4 deletions(-)
New commits:
commit 9b0834c07888aa1ee88b52141460a3b4e80d1962
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 21 12:16:52 2013 -0700
Ticket #47327 - error syncing group if group member user is not synced
Bug description: Windows Sync synchronizes member attributes
in a group entry if the member entry itself is synchronized.
The entries in the sync scope are basically to be synchronized.
But there is an exception such as a container in the scope is
not synchronized due to the objecttype constraints. Such an
unsync'ed entry could have users in it. Users are the target
of Windows Sync. But since the parent container is not synch-
ronized, the users in the container are not, neither. If a
group contains such special user as a member, synchronization
failed there and the other normal members are failed to get
synchronized.
Fix description: Windows Sync has a helper function
is_subject_of_agreement_remote, which checks if the entry is
in the scope to be synchronized. This patch adds the check
if the checking entry's parent locally exists in the DS. If
it does not exist, it considers the entry is out of scope.
AD strictly checks if the entry exists prior to adding it
to a group entry as a member. That is, a member to be added
is supposed to be in the server, as well as its parent is.
With this change, the AD user which is not synchronized to
the DS is just skipped to add to the group in the DS in the
same manner as an user out of scope is.
https://fedorahosted.org/389/ticket/47327
Reviewed by Rich (Thanks!!)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 84382e5..03d6ff3 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -3858,8 +3858,11 @@ map_entry_dn_inbound_ext(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra, int
windows_private_get_windows_subtree(ra));
}
}
- new_dn = slapi_sdn_new_dn_byval(new_dn_string);
- PR_smprintf_free(new_dn_string);
+ /*
+ * new_dn_string is created by slapi_create_dn_string,
+ * which is normalized. Thus, we can use _normdn_.
+ */
+ new_dn = slapi_sdn_new_normdn_passin(new_dn_string);
slapi_ch_free_string(&container_str);
/* Clear any earlier error */
retval = 0;
@@ -3954,6 +3957,7 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
int retval = 0;
int is_in_subtree = 0;
const Slapi_DN *agreement_subtree = NULL;
+ const Slapi_DN *sdn;
/* First test for the sync'ed subtree */
agreement_subtree = windows_private_get_windows_subtree(ra);
@@ -3961,10 +3965,33 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
{
goto error;
}
- is_in_subtree = slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), agreement_subtree, LDAP_SCOPE_SUBTREE);
+ sdn = slapi_entry_get_sdn_const(e);
+ is_in_subtree = slapi_sdn_scope_test(sdn, agreement_subtree, LDAP_SCOPE_SUBTREE);
if (is_in_subtree)
{
- retval = 1;
+ Slapi_DN psdn = {0};
+ Slapi_Entry *pentry = NULL;
+ /*
+ * Check whether the parent of the entry exists or not.
+ * If it does not, treat the entry e is out of scope.
+ * For instance, agreement_subtree is cn=USER,<SUFFIX>
+ * cn=container,cn=USER,<SUFFIX> is not synchronized.
+ * If 'e' is uid=test,cn=container,cn=USER,<SUFFIX>,
+ * the entry is not synchronized, either. We treat
+ * 'e' as out of scope.
+ */
+ slapi_sdn_get_parent(sdn, &psdn);
+ if (0 == slapi_sdn_compare(&psdn, agreement_subtree)) {
+ retval = 1;
+ } else {
+ /* If parent entry is not local, the entry is out of scope */
+ int rc = windows_get_local_entry(&psdn, &pentry);
+ if ((0 == rc) && pentry) {
+ retval = 1;
+ slapi_entry_free(pentry);
+ }
+ }
+ slapi_sdn_done(&psdn);
}
error:
return retval;
10 years, 11 months