>From 00884ca81e26e3f515bbade9cf4d6be29a847b41 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Fri, 15 May 2015 15:05:28 +0200 Subject: [PATCH 3/4] SDAP: Set initgroups expire attribute at the end Initgrups consisted of two main steps: 1. store user to cache 2. store all user groups to cache. Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step. So in case of epmty cache and parallel initgroups request in responders there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were not cached. Therefore sometime responder could return zero supplementary groups. In case of parallel initgroups requests in responder there are two other ways how we could get correct results even thought there was a bug. a) Time between two request was too small. User was not stored in cache yet and 2nd request waited for response from DP. b) Time between two request was big enough. All users groups were successfully stored in cache and 2nd request returned correct results. Resolves: https://fedorahosted.org/sssd/ticket/2634 --- src/providers/ldap/ldap_id.c | 42 +++++++++++++++++++++++++++++++++++ src/providers/ldap/sdap_async_users.c | 4 +--- 2 files changed, 43 insertions(+), 3 deletions(-) diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index 997313bec051c3ccb04f50eb094b0d0cda0af173..29642ecb27e5170058e34fe9ae3c21b731955268 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -978,6 +978,40 @@ static int groups_by_user_retry(struct tevent_req *req); static void groups_by_user_connect_done(struct tevent_req *subreq); static void groups_by_user_done(struct tevent_req *subreq); +static errno_t set_initgroups_expire_attribute(struct sss_domain_info *domain, + const char *name) +{ + errno_t ret; + time_t cache_timeout; + struct sysdb_attrs *attrs; + + attrs = sysdb_new_attrs(NULL); + if (attrs == NULL) { + return ENOMEM; + } + + cache_timeout = domain->user_timeout; + + ret = sysdb_attrs_add_time_t(attrs, SYSDB_INITGR_EXPIRE, + (cache_timeout ? + (time(NULL) + cache_timeout) : 0)); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, "Could not set up attrs\n"); + goto done; + } + + ret = sysdb_set_user_attr(domain, name, attrs, SYSDB_MOD_REP); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + "Failed to set initgroups expire attribute\n"); + goto done; + } + +done: + talloc_zfree(attrs); + return ret; +} + static struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx, struct tevent_context *ev, struct sdap_id_ctx *ctx, @@ -1122,6 +1156,14 @@ static void groups_by_user_done(struct tevent_req *subreq) } } + ret = set_initgroups_expire_attribute(state->ctx->be->domain, + state->name); + if (ret != EOK) { + state->dp_error = DP_ERR_FATAL; + tevent_req_error(req, ret); + return; + } + state->dp_error = DP_ERR_OK; tevent_req_done(req); } diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c index 82b4df4793f5f0679046f259c251f5897af831cf..da803d0ca3769f179b49e7a0505bed9636ee283b 100644 --- a/src/providers/ldap/sdap_async_users.c +++ b/src/providers/ldap/sdap_async_users.c @@ -468,9 +468,7 @@ int sdap_save_user(TALLOC_CTX *memctx, cache_timeout = dom->user_timeout; if (is_initgr) { - ret = sysdb_attrs_add_time_t(user_attrs, SYSDB_INITGR_EXPIRE, - (cache_timeout ? - (time(NULL) + cache_timeout) : 0)); + ret = sysdb_attrs_add_time_t(user_attrs, SYSDB_INITGR_EXPIRE, 0); if (ret) { goto done; } -- 2.4.0