On Wed, Apr 29, 2015 at 11:25:04AM +0200, Sumit Bose wrote:
Hi,
while analyzing the test case described in
https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
the client and server code which are hopefully fixed by the attached
patch set.
bye,
Sumit
From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Tue, 28 Apr 2015 17:18:48 +0200
Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
Newer versions of the extdom plugin return the full list of
group-memberships during a user lookup request. With these version there
is no need to reject a initgroups request for sub/trusted-domain users
anymore. This is e.g. useful for callers which call getgrouplist()
directly without calling getpwnam() before. Additionally it helps if for
some reasons the lifetime of the user entry and the lifetime of the
initgroups data is different.
Related to
https://fedorahosted.org/sssd/ticket/2633
ACK
Makes sense, tested with id from command line and os.initgroups() from
Python.
From 627ebf1782fb5dafa2536f5d451e1d39f46f0012 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Tue, 28 Apr 2015 17:20:05 +0200
Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
Newer versions of the extdom plugin return the full list of
group-memberships during user lookups. As a result the lifetime of the
group-membership data is updates in those cases. But if the user is not
looked up directly but is resolved as a group member during a group
lookup SSSD does not resolve all group-membership of the user to avoid
deep recursion and eventually a complete enumeration of the user and
group base. In this case the lifetime of the group-memberships should
not be updated because it might be incomplete.
Related to
https://fedorahosted.org/sssd/ticket/2633
ACK, nice catch
From 0dcbb088866cbc459379f8c0e23a75585b2036a8 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Tue, 28 Apr 2015 20:58:15 +0200
Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
This patch makes ipa_initgr_get_overrides_send() public and add support
to search overrides by UUID or by SID.
Do you think this interface might be used more in the future? If yes,
then it would be cleaner to also restrict the synopsis of the function
with some enum or wrap around mini-request that would pass the ar
directly rather than allowing generic char* and then checking against
known values.
But for now I'm fine with letting the code go, if the programmer uses
the interface, he would get an error with an unsupported value..
From 94f9ab29cd40338e7fa7dee636065cf8d06ec330 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Tue, 28 Apr 2015 20:59:43 +0200
Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
After the group memberships of a user from a trusted domain are read it
must be checked if there are overrides for the discovered groups to be
able to return the right gid or name to the caller.
Related to
https://fedorahosted.org/sssd/ticket/2633
This patch causes a compilation warning:
src/providers/ipa/ipa_subdomains_id.c: In function
'ipa_id_get_groups_overrides_done':
src/providers/ipa/ipa_subdomains_id.c:1225:35: warning: unused variable 'state'
[-Wunused-variable]
struct ipa_get_ad_acct_state *state = tevent_req_data(req,
But functionally-wise seems OK.