From 45d98861d350808252aafb029e8e751a21753d57 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 27 Nov 2012 13:43:42 +0100 Subject: [PATCH 07/13] Remote groups do not have an original DN attribute Groups from subdomains will not have an attribute holding the original DN because in general it will not be available. This attribute is only used by IPA HABC to improve performance and remote groups cannot be used for access control. --- src/responder/pac/pacsrv_cmd.c | 74 ++++++++++++++++++--------------------- 1 files changed, 34 insertions(+), 40 deletions(-) diff --git a/src/responder/pac/pacsrv_cmd.c b/src/responder/pac/pacsrv_cmd.c index 16aad5d..49164ab 100644 --- a/src/responder/pac/pacsrv_cmd.c +++ b/src/responder/pac/pacsrv_cmd.c @@ -320,18 +320,14 @@ static errno_t pac_user_get_grp_info(TALLOC_CTX *mem_ctx, tmp_str = ldb_msg_find_attr_as_string(res->msgs[c + 1], SYSDB_ORIG_DN, NULL); - if (tmp_str == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("Missing original DN.\n")); - ret = EINVAL; - goto done; - } - - current_grp_list[c].orig_dn = talloc_strdup(current_grp_list, - tmp_str); - if (current_grp_list[c].orig_dn == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n")); - ret = ENOMEM; - goto done; + if (tmp_str != NULL) { + current_grp_list[c].orig_dn = talloc_strdup(current_grp_list, + tmp_str); + if (current_grp_list[c].orig_dn == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n")); + ret = ENOMEM; + goto done; + } } current_grp_list[c].dn = ldb_dn_copy(current_grp_list, @@ -523,11 +519,13 @@ pac_save_memberships_delete(struct pac_save_memberships_state *state) goto done; } - ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF, - pr_ctx->del_grp_list[c]->orig_dn); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); - goto done; + if (pr_ctx->del_grp_list[c]->orig_dn != NULL) { + ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF, + pr_ctx->del_grp_list[c]->orig_dn); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); + goto done; + } } } @@ -692,31 +690,27 @@ pac_store_membership(struct pac_req_ctx *pr_ctx, } orig_group_dn = ldb_msg_find_attr_as_string(group, SYSDB_ORIG_DN, NULL); - if (orig_group_dn == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("Original DN not found.\n")); - ret = EINVAL; - goto done; - } - - user_attrs = sysdb_new_attrs(tmp_ctx); - if (user_attrs == NULL) { - DEBUG(SSSDBG_OP_FAILURE, ("sysdb_new_attrs failed.\n")); - ret = ENOMEM; - goto done; - } + if (orig_group_dn != NULL) { + user_attrs = sysdb_new_attrs(tmp_ctx); + if (user_attrs == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_new_attrs failed.\n")); + ret = ENOMEM; + goto done; + } - ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF, - orig_group_dn); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); - goto done; - } + ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF, + orig_group_dn); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n")); + goto done; + } - ret = sysdb_set_entry_attr(pr_ctx->dom->sysdb, user_dn, user_attrs, - LDB_FLAG_MOD_ADD); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, ("sysdb_set_entry_attr failed.\n")); - goto done; + ret = sysdb_set_entry_attr(pr_ctx->dom->sysdb, user_dn, user_attrs, + LDB_FLAG_MOD_ADD); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_set_entry_attr failed.\n")); + goto done; + } } done: -- 1.7.7.6