On Fri, Jul 15, 2016 at 03:24:15PM +0200, Petr Cech wrote:
On 07/12/2016 10:31 AM, Pavel Březina wrote:
> On 07/11/2016 05:12 PM, Petr Cech wrote:
> >
> > On 07/05/2016 08:44 AM, Jakub Hrozek wrote:
> > > On Mon, Jun 27, 2016 at 03:37:25PM +0200, Petr Cech wrote:
> >
> > ...
> >
> > > > +static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx,
> > > > + struct ad_id_ctx *ad_id_ctx,
> > > > + const char *ad_domain,
> > > > + const char
> > > > ***_ad_enabled_domains)
> > > > +{
> > > > + int ret;
> > > > + const char *str;
> > > > + const char *option_name;
> > > > + char **domains = NULL;
> > > > + const char **list = NULL;
> > > > + int count;
> > > > + bool is_ad_in_domains;
> > > > + TALLOC_CTX *tmp_ctx = NULL;
> > > > +
> > > > + tmp_ctx = talloc_new(NULL);
> > > > + if (tmp_ctx == NULL) {
> > > > + return ENOMEM;
> > > > + }
> > > > +
> > > > + str = dp_opt_get_cstring(ad_id_ctx->ad_options->basic,
> > > > AD_ENABLED_DOMAINS);
> > > > + if (str == NULL) {
> > > > + _ad_enabled_domains = NULL;
> > > > + ret = EOK;
> > > > + goto done;
> > > > + }
> > > > +
> > > > + count = 0;
> > > > + ret = split_on_separator(tmp_ctx, str, ',', true, true,
> > > > &domains, &count);
> > > > + if (ret != EOK) {
> > > > + option_name =
> > > > ad_id_ctx->ad_options->basic[AD_ENABLED_DOMAINS].opt_name;
> > > > + DEBUG(SSSDBG_CRIT_FAILURE, "Failed to parse option
[%s],
> > > > [%i] [%s]!\n",
> > > > + option_name, ret,
> > > > sss_strerror(ret));
> > > > + ret = EINVAL;
> > > > + goto done;
> > > > + }
> > > > +
> > > > + list = talloc_array_size(tmp_ctx, sizeof(char*), count);
> > > > + if (list == NULL) {
> > > > + ret = ENOMEM;
> > > > + goto done;
> > > > + }
> > > > +
> > > > + is_ad_in_domains = false;
> > > > + for (int i = 0; i < count; i++) {
> > > > + list[i] = talloc_strdup(list, domains[i]);
> > >
> > > Do we need to duplicate the string here, wouldn't it be enough to
steal
> > > it?
> >
> > This is my attempt to satisfy the needs. I am trying to make:
> > # const char** from char**
> > I would like to return const char** because it is option. But the
> > function split_on_separator() expects char**.
> >
> > Does anybody know better solution?
>
> You can use discard_const for this case.
>
Hi list,
I pulled master again and it started to work :-)
Regards...
I finally tested the patches and they work fine in my setup of two
domains (root and child domain).
I'll also install and configure a third AD domain to do some more
testing, but in the meantime, I tested that a user from disabled
subdomain can't be lookup up and a user who is a member of a group from
another domain reports correct group membership (the tokengroups code
stores a range that corresponds to the trusted domain, but not the
domain, subsequent lookup of that ID "fails" with idmap domain not
found).
So functional ACK for now, I just need to do more testing with a third
domain.
It would also be nice to add some debug messages, but that's a detail..