On Fri, Jul 15, 2016 at 03:24:15PM +0200, Petr Cech wrote:
On 07/12/2016 10:31 AM, Pavel Březina wrote:
On 07/11/2016 05:12 PM, Petr Cech wrote:
On 07/05/2016 08:44 AM, Jakub Hrozek wrote:
On Mon, Jun 27, 2016 at 03:37:25PM +0200, Petr Cech wrote:
...
+static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx,
struct ad_id_ctx *ad_id_ctx,const char *ad_domain,const char***_ad_enabled_domains) +{
- int ret;
- const char *str;
- const char *option_name;
- char **domains = NULL;
- const char **list = NULL;
- int count;
- bool is_ad_in_domains;
- TALLOC_CTX *tmp_ctx = NULL;
- tmp_ctx = talloc_new(NULL);
- if (tmp_ctx == NULL) {
return ENOMEM;- }
- str = dp_opt_get_cstring(ad_id_ctx->ad_options->basic,
AD_ENABLED_DOMAINS);
- if (str == NULL) {
_ad_enabled_domains = NULL;ret = EOK;goto done;- }
- count = 0;
- ret = split_on_separator(tmp_ctx, str, ',', true, true,
&domains, &count);
- if (ret != EOK) {
option_name =ad_id_ctx->ad_options->basic[AD_ENABLED_DOMAINS].opt_name;
DEBUG(SSSDBG_CRIT_FAILURE, "Failed to parse option [%s],[%i] [%s]!\n",
option_name, ret,sss_strerror(ret));
ret = EINVAL;goto done;- }
- list = talloc_array_size(tmp_ctx, sizeof(char*), count);
- if (list == NULL) {
ret = ENOMEM;goto done;- }
- is_ad_in_domains = false;
- for (int i = 0; i < count; i++) {
list[i] = talloc_strdup(list, domains[i]);Do we need to duplicate the string here, wouldn't it be enough to steal it?
This is my attempt to satisfy the needs. I am trying to make: # const char** from char** I would like to return const char** because it is option. But the function split_on_separator() expects char**.
Does anybody know better solution?
You can use discard_const for this case.
Hi list,
I pulled master again and it started to work :-)
Regards...
I finally tested the patches and they work fine in my setup of two domains (root and child domain).
I'll also install and configure a third AD domain to do some more testing, but in the meantime, I tested that a user from disabled subdomain can't be lookup up and a user who is a member of a group from another domain reports correct group membership (the tokengroups code stores a range that corresponds to the trusted domain, but not the domain, subsequent lookup of that ID "fails" with idmap domain not found).
So functional ACK for now, I just need to do more testing with a third domain.
It would also be nice to add some debug messages, but that's a detail..