From e1e724d728bdd312418d78896ae46a0fbea86fcb Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 12 Jan 2015 12:12:33 +0100 Subject: [PATCH 8/8] IPA: get_groups_dns() allow replacing the domain name If the input might contain the domain name with a wrong case get_groups_dns() can fix this. --- src/providers/ipa/ipa_s2n_exop.c | 60 +++++++++++++++++++++++++++++++++------- 1 file changed, 50 insertions(+), 10 deletions(-) diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c index e7c2d9bb97908746eb5ab6cacc6fc58d353dea06..2035a7eb1e3dbdf3dabe823c212f52c6b777bcc9 100644 --- a/src/providers/ipa/ipa_s2n_exop.c +++ b/src/providers/ipa/ipa_s2n_exop.c @@ -1646,13 +1646,18 @@ done: } static errno_t get_groups_dns(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, - char **name_list, char ***_dn_list) + char **name_list, bool fix_domain, + char ***_dn_list) { int ret; TALLOC_CTX *tmp_ctx; int c; struct sss_domain_info *root_domain; char **dn_list; + char *obj_name; + char *orig_name; + char *orig_domain; + struct sss_domain_info *orig_dom; if (name_list == NULL) { *_dn_list = NULL; @@ -1697,18 +1702,51 @@ static errno_t get_groups_dns(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom, goto done; } - /* This might fail if some unexpected cases are used. But current - * sysdb code which handles group membership constructs DNs this way - * as well, IPA names are lowercased and AD names by default will be - * lowercased as well. If there are really use-cases which cause an - * issue here, sysdb_group_strdn() has to be replaced by a proper - * search. */ - dn_list[c] = sysdb_group_strdn(dn_list, dom->name, name_list[c]); + obj_name = name_list[c]; + if (fix_domain) { + /* The domain name is handled case-sensitive in the cache but the + * given fully qualified name might have the domain name + * completely lower-cases (e.g. for case-insensitive domains). If + * fix_domain is true we replace the given domain name with the + * one SSSD uses internally. */ + ret = sss_parse_name(tmp_ctx, root_domain->names, name_list[c], + &orig_domain, &orig_name); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + "sss_parse_name failed to split original name [%s].\n", + name_list[c]); + goto done; + } + + if (orig_domain != NULL) { + orig_dom = find_domain_by_name(root_domain, orig_domain, true); + if (orig_dom == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, + "Cannot find domain with name [%s].\n", + orig_domain); + ret = EINVAL; + goto done; + } + + obj_name = sss_get_domain_name(tmp_ctx, orig_name, orig_dom); + if (obj_name == NULL) { + DEBUG(SSSDBG_OP_FAILURE, + "sss_get_domain_name failed.\n"); + ret = ENOMEM; + goto done; + } + } + } + + dn_list[c] = sysdb_group_strdn(dn_list, dom->name, obj_name); if (dn_list[c] == NULL) { DEBUG(SSSDBG_OP_FAILURE, "sysdb_group_strdn failed.\n"); ret = ENOMEM; goto done; } + + DEBUG(SSSDBG_TRACE_ALL, "Using DN [%s] for [%s].", dn_list[c], + name_list[c]); } *_dn_list = talloc_steal(mem_ctx, dn_list); @@ -1988,13 +2026,15 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom, goto done; } - ret = get_groups_dns(tmp_ctx, dom, add_groups, &add_groups_dns); + ret = get_groups_dns(tmp_ctx, dom, add_groups, true, + &add_groups_dns); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n"); goto done; } - ret = get_groups_dns(tmp_ctx, dom, del_groups, &del_groups_dns); + ret = get_groups_dns(tmp_ctx, dom, del_groups, false, + &del_groups_dns); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n"); goto done; -- 2.1.0