>From aee4ba40fbcb7a67288278a4d6c0ba06684ee4f8 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 4 May 2015 15:16:44 +0200 Subject: [PATCH 06/11] LDAP: Fetch users and groups using wildcards Related: https://fedorahosted.org/sssd/ticket/2553 Adds handler for the BE_FILTER_WILDCARD in the LDAP provider. So far it's the same code as if enumeration was used, so there are no limits. --- src/providers/ldap/ldap_common.h | 3 +++ src/providers/ldap/ldap_id.c | 54 ++++++++++++++++++++++++++++++++++++++-- 2 files changed, 55 insertions(+), 2 deletions(-) diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index 424eacb1da0a6934b132ccb2a5bb175233fa1a80..8294d1db23bdca8d94a098533d93405c4d55226b 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -39,6 +39,9 @@ #define LDAP_SSL_URI "ldaps://" #define LDAP_LDAPI_URI "ldapi://" +/* Only the asterisk is allowed in wildcard requests */ +#define LDAP_ALLOWED_WILDCARDS "*" + /* a fd the child process would log into */ extern int ldap_child_debug_fd; diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index d4f46f1dcd69898e5883d21be07f895fd198cf50..f3e829a1dab450bdaf1afc5d83cbff5e0aaeef1d 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -48,6 +48,7 @@ struct users_get_state { const char *name; int filter_type; + time_t req_start; char *filter; const char **attrs; @@ -112,6 +113,14 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx, sdom->dom->name, sdom->dom->domain_id); switch (filter_type) { + case BE_FILTER_WILDCARD: + attr_name = ctx->opts->user_map[SDAP_AT_USER_NAME].name; + ret = sss_filter_sanitize_ex(state, name, &clean_name, + LDAP_ALLOWED_WILDCARDS); + if (ret != EOK) { + goto done; + } + break; case BE_FILTER_NAME: if (extra_value && strcmp(extra_value, EXTRA_NAME_IS_UPN) == 0) { attr_name = ctx->opts->user_map[SDAP_AT_USER_PRINC].name; @@ -359,6 +368,14 @@ static void users_get_search(struct tevent_req *req) struct users_get_state *state = tevent_req_data(req, struct users_get_state); struct tevent_req *subreq; + bool multiple_results; + + if (state->filter_type == BE_FILTER_WILDCARD) { + multiple_results = true; + state->req_start = time(NULL); + } else { + multiple_results = false; + } subreq = sdap_get_users_send(state, state->ev, state->domain, state->sysdb, @@ -368,7 +385,7 @@ static void users_get_search(struct tevent_req *req) state->attrs, state->filter, dp_opt_get_int(state->ctx->opts->basic, SDAP_SEARCH_TIMEOUT), - false); + multiple_results); if (!subreq) { tevent_req_error(req, ENOMEM); return; @@ -479,6 +496,13 @@ static void users_get_done(struct tevent_req *subreq) * group we have nothing to do here. */ break; + case BE_FILTER_WILDCARD: + /* We can't know if all users are up-to-date, especially in a large + * environment. Do not delete any records, let the responder fetch + * the entries they are requested in + */ + break; + default: tevent_req_error(req, EINVAL); return; @@ -521,6 +545,7 @@ struct groups_get_state { const char *name; int filter_type; + time_t req_start; char *filter; const char **attrs; @@ -590,6 +615,14 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx, sdom->dom->domain_id); switch(filter_type) { + case BE_FILTER_WILDCARD: + attr_name = ctx->opts->group_map[SDAP_AT_GROUP_NAME].name; + ret = sss_filter_sanitize_ex(state, name, &clean_name, + LDAP_ALLOWED_WILDCARDS); + if (ret != EOK) { + goto done; + } + break; case BE_FILTER_NAME: attr_name = ctx->opts->group_map[SDAP_AT_GROUP_NAME].name; @@ -842,6 +875,14 @@ static void groups_get_search(struct tevent_req *req) struct groups_get_state *state = tevent_req_data(req, struct groups_get_state); struct tevent_req *subreq; + bool multiple_results; + + if (state->filter_type == BE_FILTER_WILDCARD) { + multiple_results = true; + state->req_start = time(NULL); + } else { + multiple_results = false; + } subreq = sdap_get_groups_send(state, state->ev, state->sdom, @@ -850,7 +891,8 @@ static void groups_get_search(struct tevent_req *req) state->attrs, state->filter, dp_opt_get_int(state->ctx->opts->basic, SDAP_SEARCH_TIMEOUT), - false, state->no_members); + multiple_results, + state->no_members); if (!subreq) { tevent_req_error(req, ENOMEM); return; @@ -924,6 +966,14 @@ static void groups_get_done(struct tevent_req *subreq) * group we have nothing to do here. */ break; + case BE_FILTER_WILDCARD: + /* We can't know if all users are up-to-date, especially in a large + * environment. Do not delete any records, let the responder fetch + * the entries they are requested in + */ + break; + + default: tevent_req_error(req, EINVAL); return; -- 2.4.3