From 046542d949ea08f1f221d4e7d780f8e102b2a1f9 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 12 Jan 2015 12:12:33 +0100 Subject: [PATCH 8/8] IPA: get_groups_dns() allow real search as well --- src/providers/ipa/ipa_s2n_exop.c | 43 ++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c index e7c2d9bb97908746eb5ab6cacc6fc58d353dea06..c457495b7e3a3d69e8f37228f68af7d470a9edfb 100644 --- a/src/providers/ipa/ipa_s2n_exop.c +++ b/src/providers/ipa/ipa_s2n_exop.c @@ -1646,13 +1646,15 @@ done: } static errno_t get_groups_dns(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, - char **name_list, char ***_dn_list) + char **name_list, bool do_search, + char ***_dn_list) { int ret; TALLOC_CTX *tmp_ctx; int c; struct sss_domain_info *root_domain; char **dn_list; + struct ldb_message *msg; if (name_list == NULL) { *_dn_list = NULL; @@ -1697,15 +1699,32 @@ static errno_t get_groups_dns(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, goto done; } - /* This might fail if some unexpected cases are used. But current - * sysdb code which handles group membership constructs DNs this way - * as well, IPA names are lowercased and AD names by default will be - * lowercased as well. If there are really use-cases which cause an - * issue here, sysdb_group_strdn() has to be replaced by a proper - * search. */ - dn_list[c] = sysdb_group_strdn(dn_list, dom->name, name_list[c]); + if (do_search) { + ret = sysdb_search_group_by_name(tmp_ctx, dom, name_list[c], NULL, + &msg); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_search_group_by_name failed.\n"); + goto done; + } + + dn_list[c] = ldb_dn_alloc_linearized(dn_list, msg->dn); + } else { + /* This might fail if some unexpected cases are used. But current + * sysdb code which handles group membership constructs DNs this way + * as well, IPA names are lowercased and AD names by default will be + * lowercased as well. One exceptions are upper-case characters in + * AD domain names (not realm name). In this case the unmodified + * version of the domain name is used in the sysdb DNs as part of + * the fully qualified name and the name of the domain container. + * If the fully-qualified name is completely lower-cased, e.g. in + * the response of the extdom plugin a proper search must be used + * and do_search should be set to True. */ + dn_list[c] = sysdb_group_strdn(dn_list, dom->name, name_list[c]); + } if (dn_list[c] == NULL) { - DEBUG(SSSDBG_OP_FAILURE, "sysdb_group_strdn failed.\n"); + DEBUG(SSSDBG_OP_FAILURE, "%s failed.\n", + do_search ? "ldb_dn_alloc_linearized" : "sysdb_group_strdn"); ret = ENOMEM; goto done; } @@ -1988,13 +2007,15 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom, goto done; } - ret = get_groups_dns(tmp_ctx, dom, add_groups, &add_groups_dns); + ret = get_groups_dns(tmp_ctx, dom, add_groups, true, + &add_groups_dns); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n"); goto done; } - ret = get_groups_dns(tmp_ctx, dom, del_groups, &del_groups_dns); + ret = get_groups_dns(tmp_ctx, dom, del_groups, false, + &del_groups_dns); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n"); goto done; -- 2.1.0