>From 0e7412373b2e691b7c799e0000b84424e62af02f Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Wed, 10 Sep 2014 12:56:54 +0200
Subject: [PATCH 2/2] Use the alternative objectclass in group maps.

Use the alternative group objectclass in queries.
---
 src/providers/ldap/ldap_id.c                  |  6 ++++--
 src/providers/ldap/sdap.c                     | 13 +++++++++----
 src/providers/ldap/sdap_async_enum.c          |  3 ++-
 src/providers/ldap/sdap_async_initgroups.c    | 16 ++++++++++++----
 src/providers/ldap/sdap_async_initgroups_ad.c |  5 +++--
 src/providers/ldap/sdap_async_nested_groups.c |  5 ++++-
 6 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index eb349f3..45e3cca 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -651,15 +651,17 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
          */
 
         state->filter = talloc_asprintf(state,
-                                        "(&(%s=%s)(objectclass=%s)(%s=*))",
+                                        "(&(%s=%s)(|(objectclass=%s)(objectclass=%s))(%s=*))",
                                         attr_name, clean_name,
                                         ctx->opts->group_map[SDAP_OC_GROUP].name,
+                                        ctx->opts->group_map[SDAP_OC_GROUP_ALT].name,
                                         ctx->opts->group_map[SDAP_AT_GROUP_NAME].name);
     } else {
         state->filter = talloc_asprintf(state,
-                                        "(&(%s=%s)(objectclass=%s)(%s=*)(&(%s=*)(!(%s=0))))",
+                                        "(&(%s=%s)(|(objectclass=%s)(objectclass=%s))(%s=*)(&(%s=*)(!(%s=0))))",
                                         attr_name, clean_name,
                                         ctx->opts->group_map[SDAP_OC_GROUP].name,
+                                        ctx->opts->group_map[SDAP_OC_GROUP_ALT].name,
                                         ctx->opts->group_map[SDAP_AT_GROUP_NAME].name,
                                         ctx->opts->group_map[SDAP_AT_GROUP_GID].name,
                                         ctx->opts->group_map[SDAP_AT_GROUP_GID].name);
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index ff50f8b..cf60563 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -348,9 +348,12 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
         }
 
         for (i = 0; vals[i]; i++) {
-            /* the objectclass is always the first name in the map */
-            if (strncasecmp(map[0].name,
-                            vals[i]->bv_val, vals[i]->bv_len) == 0) {
+            /* The objectclass is always the first name in the map.
+             * Alternative objectclass for groups is second. */
+            if (strncasecmp(map[0].name, vals[i]->bv_val, vals[i]->bv_len) == 0
+                || (map[1].name != NULL
+                    && strncasecmp(map[1].name,
+                                   vals[i]->bv_val, vals[i]->bv_len) == 0)) {
                 /* ok it's an entry of the right type */
                 break;
             }
@@ -630,7 +633,9 @@ errno_t sdap_parse_deref(TALLOC_CTX *mem_ctx,
 
         for (i=0; ocs[i]; i++) {
             /* the objectclass is always the first name in the map */
-            if (strcasecmp(minfo[mi].map[0].name, ocs[i]) == 0) {
+            if (strcasecmp(minfo[mi].map[0].name, ocs[i]) == 0
+                || (minfo[mi].map[1].name != NULL
+                    && strcasecmp(minfo[mi].map[1].name, ocs[i]) == 0)) {
                 DEBUG(SSSDBG_TRACE_ALL,
                       "Found map for objectclass '%s'\n", ocs[i]);
                 map = minfo[mi].map;
diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c
index 1c69c07..b790d98 100644
--- a/src/providers/ldap/sdap_async_enum.c
+++ b/src/providers/ldap/sdap_async_enum.c
@@ -733,8 +733,9 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,
 
     /* We always want to filter on objectclass and an available name */
     state->filter = talloc_asprintf(state,
-                               "(&(objectclass=%s)(%s=*)",
+                               "(&(|(objectclass=%s)(objectclass=%s))(%s=*)",
                                ctx->opts->group_map[SDAP_OC_GROUP].name,
+                               ctx->opts->group_map[SDAP_OC_GROUP_ALT].name,
                                ctx->opts->group_map[SDAP_AT_GROUP_NAME].name);
     if (!state->filter) {
         DEBUG(SSSDBG_MINOR_FAILURE,
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 9f45fde..d619be1 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -420,10 +420,12 @@ struct tevent_req *sdap_initgr_rfc2307_send(TALLOC_CTX *memctx,
     }
 
     state->base_filter = talloc_asprintf(state,
-                             "(&(%s=%s)(objectclass=%s)(%s=*)(&(%s=*)(!(%s=0))))",
+                             "(&(%s=%s)(|(objectclass=%s)(objectclass=%s))"
+                             "(%s=*)(&(%s=*)(!(%s=0))))",
                              opts->group_map[SDAP_AT_GROUP_MEMBER].name,
                              clean_name,
                              opts->group_map[SDAP_OC_GROUP].name,
+                             opts->group_map[SDAP_OC_GROUP_ALT].name,
                              opts->group_map[SDAP_AT_GROUP_NAME].name,
                              opts->group_map[SDAP_AT_GROUP_GID].name,
                              opts->group_map[SDAP_AT_GROUP_GID].name);
@@ -823,8 +825,10 @@ static errno_t sdap_initgr_nested_noderef_search(struct tevent_req *req)
     state->group_dns[i] = NULL; /* terminate */
     state->cur = 0;
 
-    state->filter = talloc_asprintf(state, "(&(objectclass=%s)(%s=*))",
+    state->filter = talloc_asprintf(state,
+                            "(&(|(objectclass=%s)(objectclass=%s))(%s=*))",
                             state->opts->group_map[SDAP_OC_GROUP].name,
+                            state->opts->group_map[SDAP_OC_GROUP_ALT].name,
                             state->opts->group_map[SDAP_AT_GROUP_NAME].name);
     if (!state->filter) {
         return ENOMEM;
@@ -1566,10 +1570,13 @@ static struct tevent_req *sdap_initgr_rfc2307bis_send(
                                                         sdom->dom->domain_id);
 
     state->base_filter =
-            talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)(%s=*)",
+            talloc_asprintf(state,
+                            "(&(%s=%s)(|(objectclass=%s)(objectclass=%s))"
+                            "(%s=*)",
                             opts->group_map[SDAP_AT_GROUP_MEMBER].name,
                             clean_orig_dn,
                             opts->group_map[SDAP_OC_GROUP].name,
+                            opts->group_map[SDAP_OC_GROUP_ALT].name,
                             opts->group_map[SDAP_AT_GROUP_NAME].name);
     if (!state->base_filter) {
         ret = ENOMEM;
@@ -2340,10 +2347,11 @@ static errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
     }
 
     state->base_filter = talloc_asprintf(
-            state, "(&(%s=%s)(objectclass=%s)(%s=*))",
+            state, "(&(%s=%s)(|(objectclass=%s)(objectclass=%s))(%s=*))",
             state->opts->group_map[SDAP_AT_GROUP_MEMBER].name,
             clean_orig_dn,
             state->opts->group_map[SDAP_OC_GROUP].name,
+            state->opts->group_map[SDAP_OC_GROUP_ALT].name,
             state->opts->group_map[SDAP_AT_GROUP_NAME].name);
     if (!state->base_filter) {
         ret = ENOMEM;
diff --git a/src/providers/ldap/sdap_async_initgroups_ad.c b/src/providers/ldap/sdap_async_initgroups_ad.c
index 82d8c8a..5c4e1f1 100644
--- a/src/providers/ldap/sdap_async_initgroups_ad.c
+++ b/src/providers/ldap/sdap_async_initgroups_ad.c
@@ -124,11 +124,12 @@ sdap_get_ad_match_rule_initgroups_send(TALLOC_CTX *mem_ctx,
      */
     state->base_filter =
             talloc_asprintf(state,
-                            "(&(%s:%s:=%s)(objectClass=%s))",
+                            "(&(%s:%s:=%s)(|(objectClass=%s)(objectClass=%s)))",
                             state->opts->group_map[SDAP_AT_GROUP_MEMBER].name,
                             SDAP_MATCHING_RULE_IN_CHAIN,
                             sanitized_user_dn,
-                            state->opts->group_map[SDAP_OC_GROUP].name);
+                            state->opts->group_map[SDAP_OC_GROUP].name,
+                            state->opts->group_map[SDAP_OC_GROUP_ALT].name);
     talloc_zfree(sanitized_user_dn);
     if (!state->base_filter) {
         ret = ENOMEM;
diff --git a/src/providers/ldap/sdap_async_nested_groups.c b/src/providers/ldap/sdap_async_nested_groups.c
index b07616a..e9b96eb 100644
--- a/src/providers/ldap/sdap_async_nested_groups.c
+++ b/src/providers/ldap/sdap_async_nested_groups.c
@@ -1728,8 +1728,11 @@ sdap_nested_group_lookup_group_send(TALLOC_CTX *mem_ctx,
      }
 
      /* create filter */
-     base_filter = talloc_asprintf(attrs, "(&(objectclass=%s)(%s=*))",
+     base_filter = talloc_asprintf(attrs,
+                                   "(&(|(objectclass=%s)(objectclass=%s))"
+                                   "(%s=*))",
                                    map[SDAP_OC_GROUP].name,
+                                   map[SDAP_OC_GROUP_ALT].name,
                                    map[SDAP_AT_GROUP_NAME].name);
      if (base_filter == NULL) {
          ret = ENOMEM;
-- 
1.9.3

