ldap/servers/plugins/posix-winsync/posix-group-func.c | 30 ++++++++++--------
ldap/servers/plugins/posix-winsync/posix-winsync.c | 6 +--
2 files changed, 20 insertions(+), 16 deletions(-)
New commits:
commit 9093f582b410c27e197fc122c479c33c0a76fb62
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Aug 14 16:09:48 2013 -0700
Ticket #47310 - Attribute "dsOnlyMemberUid" not allowed when syncing nested
posix groups from AD with posixWinsync
Bug description: When Posix Winsync API plug-in is configured
with posixWinsyncMapMemberUid and posixWinsyncMapNestedGrouping
enabled (true), Posix Group added to AD is synchronized to DS
with mapped dsOnlyMemberUid and memberUid. When adding a Posix
Group with the nested group member, addGroupMembership function
adds "dynamicGroup" to objectClass to allow the Posix Group entry
to have dsOnlyMemberUid. The add should be made against the entry
in the memory since the entry is not yet stored in the database,
but it was trying to modify against the backend.
Fix description: This patch directly adds "dynamicGroup" to the
objectclass valueset, by which the attribute "dsOnlyMemberUid"
is allowed to add to the entry.
In addition,
1) when reflecting the mapped memberUid on DS to AD, the logic
was corrected to "if dsOnlyMemberUid matches memberUid",
2) when the Posix Group is nested in the multiple levels, the
mapped memberUid was not retrieved. The code was added.
Reviewed by Rich (Thank you!!)
https://fedorahosted.org/389/ticket/47310
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c
b/ldap/servers/plugins/posix-winsync/posix-group-func.c
index aa76d6c..4e2dae5 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-func.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c
@@ -59,18 +59,8 @@ addDynamicGroupIfNecessary(Slapi_Entry *entry, Slapi_Mods *smods) {
if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
if (smods) {
slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass",
"dynamicGroup");
- }
- else {
- smods = slapi_mods_new();
- slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass",
"dynamicGroup");
-
- Slapi_PBlock *mod_pb = slapi_pblock_new();
- slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry),
slapi_mods_get_ldapmods_passout(smods), 0, 0,
- posix_winsync_get_plugin_identity(), 0);
- slapi_modify_internal_pb(mod_pb);
- slapi_pblock_destroy(mod_pb);
-
- slapi_mods_free(&smods);
+ } else {
+ slapi_entry_add_string(entry, "objectClass",
"dynamicGroup");
}
}
@@ -392,7 +382,7 @@ getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs,
Slapi_Val
}
else {
/* PosixGroups except for the top one are already fully mapped out */
- if ((!hasObjectClass(entry, "posixGroup") || depth == 0)
&&
+ if ((!hasObjectClass(entry, "posixGroup") || (depth == 0))
&&
(hasObjectClass(child, "ntGroup") || hasObjectClass(child,
"posixGroup"))) {
/* Recurse downward */
@@ -413,6 +403,20 @@ getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet
*muid_vs, Slapi_Val
slapi_valueset_add_value(muid_nested_vs, v);
}
}
+ } else if (hasObjectClass(child, "posixGroup")) {
+ Slapi_Attr *uid_attr = NULL;
+ Slapi_Value *v = NULL;
+ if (slapi_entry_attr_find(child, "memberuid", &uid_attr) ==
0) {
+ slapi_attr_first_value(uid_attr, &v);
+
+ if (v && !slapi_valueset_find(uid_attr, muid_vs, v)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: adding member:
%s\n",
+ slapi_value_get_string(v));
+ slapi_valueset_add_value(muid_vs, v);
+ slapi_valueset_add_value(muid_nested_vs, v);
+ }
+ }
}
slapi_entry_free(child);
}
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c
b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 5b3d6e7..a9a3b44 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -694,7 +694,8 @@ posix_winsync_pre_ad_mod_group_cb(void *cbdata, const Slapi_Entry
*rawentry, Sla
int j;
for (j = slapi_attr_first_value(attr, &v); j != -1;
j = slapi_attr_next_value(attr, i, &v)) {
- if (!slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
+ /* If dsOnlyMemberUid matches memberUid, add it to AD */
+ if (slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
slapi_valueset_add_value(vs, v);
}
}
@@ -726,8 +727,7 @@ posix_winsync_pre_ad_mod_group_cb(void *cbdata, const Slapi_Entry
*rawentry, Sla
valueset_get_valuearray(vs));
*do_modify = 1;
}
- } else {
-
+ } else if (!slapi_valueset_isempty(vs)) {
slapi_mods_add_mod_values(smods, LDAP_MOD_ADD, ad_type,
valueset_get_valuearray(vs));
if (0 == slapi_attr_type_cmp(type, "gidNumber",
SLAPI_TYPE_CMP_SUBTYPE)) {