From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 28 Apr 2015 17:18:48 +0200 Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it Newer versions of the extdom plugin return the full list of group-memberships during a user lookup request. With these version there is no need to reject a initgroups request for sub/trusted-domain users anymore. This is e.g. useful for callers which call getgrouplist() directly without calling getpwnam() before. Additionally it helps if for some reasons the lifetime of the user entry and the lifetime of the initgroups data is different. Related to https://fedorahosted.org/sssd/ticket/2633 --- src/providers/ipa/ipa_s2n_exop.c | 3 --- src/providers/ipa/ipa_subdomains.h | 4 ++++ src/providers/ipa/ipa_subdomains_id.c | 24 +++++++++++++++++------- 3 files changed, 21 insertions(+), 10 deletions(-) diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c index 688fdefe8eefe29a0cd13010bb3998527f3111f4..7ee2e0f16803a34b0a657ea12b102a8ae4364af8 100644 --- a/src/providers/ipa/ipa_s2n_exop.c +++ b/src/providers/ipa/ipa_s2n_exop.c @@ -50,9 +50,6 @@ enum response_types { }; /* ==Sid2Name Extended Operation============================================= */ -#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4" -#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1" - struct ipa_s2n_exop_state { struct sdap_handle *sh; diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h index 5266943f8e34f6e918022ee470f9c8fcc2199a8e..0cece2cc70a81f81ff143259e620be7e3d143244 100644 --- a/src/providers/ipa/ipa_subdomains.h +++ b/src/providers/ipa/ipa_subdomains.h @@ -28,6 +28,10 @@ #include "providers/dp_backend.h" #include "providers/ipa/ipa_common.h" +/* ==Sid2Name Extended Operation============================================= */ +#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4" +#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1" + struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx); int ipa_subdom_init(struct be_ctx *be_ctx, diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c index 15776d2e13af158058a874f761671a5801cf3d6a..1253510dcb8523c19d879d4351ffa07995f161f7 100644 --- a/src/providers/ipa/ipa_subdomains_id.c +++ b/src/providers/ipa/ipa_subdomains_id.c @@ -386,15 +386,9 @@ struct tevent_req *ipa_get_subdom_acct_send(TALLOC_CTX *memctx, case BE_REQ_GROUP: case BE_REQ_BY_SECID: case BE_REQ_USER_AND_GROUP: + case BE_REQ_INITGROUPS: ret = EOK; break; - case BE_REQ_INITGROUPS: - ret = ENOTSUP; - DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \ - "by the IPA provider but are resolved " \ - "by the responder directly from the " \ - "cache.\n"); - break; default: ret = EINVAL; DEBUG(SSSDBG_OP_FAILURE, "Invalid sub-domain request type.\n"); @@ -434,6 +428,22 @@ static void ipa_get_subdom_acct_connected(struct tevent_req *subreq) return; } + if (state->entry_type == BE_REQ_INITGROUPS) { + /* With V1 of the extdom plugin a user lookup will resolve the full + * group membership of the user. */ + if (sdap_is_extension_supported(sdap_id_op_handle(state->op), + EXOP_SID2NAME_V1_OID)) { + state->entry_type = BE_REQ_USER; + } else { + DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \ + "by the IPA provider but are resolved " \ + "by the responder directly from the " \ + "cache.\n"); + tevent_req_error(req, ENOTSUP); + return; + } + } + req_input = talloc(state, struct req_input); if (req_input == NULL) { DEBUG(SSSDBG_OP_FAILURE, "talloc failed.\n"); -- 2.1.0