>From 09b9f129cc87d9065702a8a49e894815ede6eb97 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 9 Mar 2015 17:25:48 +0100 Subject: [PATCH 4/4] NSS: Handle ENOENT when doing initgroups by UPN https://fedorahosted.org/sssd/ticket/2598 We need to return an empty result in cases an initgroups lookup by UPN doesn't return anything. Please note testing with "id user" is not sufficient as id calls a getpwnam first. --- src/responder/nss/nsssrv_cmd.c | 50 +++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 20 deletions(-) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index f9056590a369b8cea358d12192357bf51599e7b6..aaf393f1c2c5ddd026412aaed1635cbe0e871680 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -4062,29 +4062,39 @@ static int nss_cmd_initgroups_search(struct nss_dom_ctx *dctx) if (cmdctx->name_is_upn) { ret = sysdb_search_user_by_upn(cmdctx, dom, name, user_attrs, &msg); - if (ret != EOK && ret != ENOENT) { + if (ret == EOK) { + sysdb_name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); + if (sysdb_name == NULL) { + DEBUG(SSSDBG_OP_FAILURE, + "Sysdb entry does not have a name.\n"); + return EINVAL; + } + + ret = sysdb_initgroups(cmdctx, dom, sysdb_name, &dctx->res); + if (ret == EOK && DOM_HAS_VIEWS(dom)) { + for (c = 0; c < dctx->res->count; c++) { + ret = sysdb_add_overrides_to_object(dom, dctx->res->msgs[c], + NULL, NULL); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + "sysdb_add_overrides_to_object failed.\n"); + return ret; + } + } + } + } else if (ret != ENOENT) { DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_user_by_upn failed.\n"); return ret; - } - - sysdb_name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); - if (sysdb_name == NULL) { - DEBUG(SSSDBG_OP_FAILURE, - "Sysdb entry does not have a name.\n"); - return EINVAL; - } - - ret = sysdb_initgroups(cmdctx, dom, sysdb_name, &dctx->res); - if (ret == EOK && DOM_HAS_VIEWS(dom)) { - for (c = 0; c < dctx->res->count; c++) { - ret = sysdb_add_overrides_to_object(dom, dctx->res->msgs[c], - NULL, NULL); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, - "sysdb_add_overrides_to_object failed.\n"); - return ret; - } + } else { + dctx->res = talloc_zero(cmdctx, struct ldb_result); + if (dctx->res == NULL) { + DEBUG(SSSDBG_OP_FAILURE, "talloc_zero failed.\n"); + return ENOMEM; } + + dctx->res->count = 0; + dctx->res->msgs = NULL; + ret = EOK; } } else { ret = sysdb_initgroups_with_views(cmdctx, dom, name, &dctx->res); -- 2.1.0