>From 0ad1ef13b2f02203021bb5fafd7c61ede37cac9d Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Mon, 13 May 2013 12:40:39 +0200 Subject: [PATCH] Adding option to disable retrieving large AD groups. This commit adds new option ldap_disable_large_groups with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823 --- src/config/SSSDConfig/__init__.py.in | 1 + src/config/etc/sssd.api.d/sssd-ldap.conf | 1 + src/man/sssd-ldap.5.xml | 19 +++++++++++++++++++ src/providers/ad/ad_opts.h | 1 + src/providers/ipa/ipa_opts.h | 1 + src/providers/ldap/ldap_opts.h | 1 + src/providers/ldap/sdap.c | 11 ++++++++--- src/providers/ldap/sdap.h | 4 +++- src/providers/ldap/sdap_async.c | 7 +++++-- 9 files changed, 40 insertions(+), 6 deletions(-) diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in index bc7bb0a781a64b264d350a7766cf45de869273cf..4f17e791b4d856bf7d386c06142f90f7273ad33c 100644 --- a/src/config/SSSDConfig/__init__.py.in +++ b/src/config/SSSDConfig/__init__.py.in @@ -221,6 +221,7 @@ option_strings = { 'ldap_connection_expiration_timeout' : _('How long to retain a connection to the LDAP server before disconnecting'), 'ldap_disable_paging' : _('Disable the LDAP paging control'), + 'ldap_disable_large_groups' : _('Disable large Active Directory groups'), # [provider/ldap/id] 'ldap_search_timeout' : _('Length of time to wait for a search request'), diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 40e2aa09d0b4e94976bc18f04f9ca2d0006d444e..fd19341c1aeb261d0f26d37cc24b3054690da359 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -35,6 +35,7 @@ ldap_sasl_canonicalize = bool, None, false ldap_sasl_minssf = int, None, false ldap_connection_expire_timeout = int, None, false ldap_disable_paging = bool, None, false +ldap_disable_large_groups = bool, None, false [provider/ldap/id] ldap_search_timeout = int, None, false diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 799213300857f182b092287741a40665a0ae62d5..bd49b2a98466446ed098e71b724ab453dca0c69a 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -1201,6 +1201,25 @@ + ldap_disable_large_groups (boolean) + + + Disable very large Active Directory groups. + + + This option has effect only, if LDAP server is + Active Directory. Active Directory 2008R2 allows + only 1500 group members to be retrieved in single + lookup. Therefore if this option is enabled, + members of group members will not be retrieved. + + + Default: False + + + + + ldap_sasl_minssf (integer) diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index 32bbe3db2f4048056c7e96619eaf53ce22bf52f8..87cad7d5a8dc45ba86cd0865bc17d27b93407aae 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -122,6 +122,7 @@ struct dp_option ad_def_ldap_opts[] = { { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h index de9592b85c50ced32b7ab1c19c5f59eef89d6354..36ad741a9f5036396cd4f5578e83959b7000ac62 100644 --- a/src/providers/ipa/ipa_opts.h +++ b/src/providers/ipa/ipa_opts.h @@ -146,6 +146,7 @@ struct dp_option ipa_def_ldap_opts[] = { { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h index 2ed89f977839e4a7e3ea2c51f04e8db76a883fd9..db7be5e5a8a76c006d9ae86ee10cf011db499314 100644 --- a/src/providers/ldap/ldap_opts.h +++ b/src/providers/ldap/ldap_opts.h @@ -113,6 +113,7 @@ struct dp_option default_basic_opts[] = { { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c index 288d2d594a1401e9dbcc40b92cb68e946322791e..e84d1d90aab18bb03b1cd58fc8628af8c53a5155 100644 --- a/src/providers/ldap/sdap.c +++ b/src/providers/ldap/sdap.c @@ -95,7 +95,8 @@ int sdap_get_map(TALLOC_CTX *memctx, int sdap_parse_entry(TALLOC_CTX *memctx, struct sdap_handle *sh, struct sdap_msg *sm, struct sdap_attr_map *map, int attrs_num, - struct sysdb_attrs **_attrs, char **_dn) + struct sysdb_attrs **_attrs, char **_dn, + bool disable_large_groups) { struct sysdb_attrs *attrs; BerElement *ber = NULL; @@ -230,6 +231,10 @@ int sdap_parse_entry(TALLOC_CTX *memctx, store = true; } + if (disable_large_groups && strstr(str, ";range=") != NULL) { + store = false; + } + if (store) { vals = ldap_get_values_len(sh->ldap, sm->msg, str); if (!vals) { @@ -311,7 +316,7 @@ int sdap_parse_user(TALLOC_CTX *memctx, struct sdap_options *opts, { return sdap_parse_entry(memctx, sh, sm, opts->user_map, - SDAP_OPTS_USER, _attrs, _dn); + SDAP_OPTS_USER, _attrs, _dn, false); } /* This function converts an ldap message into a sysdb_attrs structure. @@ -325,7 +330,7 @@ int sdap_parse_group(TALLOC_CTX *memctx, struct sdap_options *opts, { return sdap_parse_entry(memctx, sh, sm, opts->group_map, - SDAP_OPTS_GROUP, _attrs, _dn); + SDAP_OPTS_GROUP, _attrs, _dn, false); } /* Parses an LDAPDerefRes into sdap_deref_attrs structure */ diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 8dbf38496553f3df6a320c8f57950745c25c6041..c46f960bd50c6b05d5d6705750e85ee7efaab59b 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -217,6 +217,7 @@ enum sdap_basic_opt { SDAP_AD_MATCHING_RULE_GROUPS, SDAP_AD_MATCHING_RULE_INITGROUPS, SDAP_RFC2307_FALLBACK_TO_LOCAL_USERS, + SDAP_DISABLE_LARGE_GROUPS, SDAP_OPTS_BASIC /* opts counter */ }; @@ -433,7 +434,8 @@ int sdap_get_map(TALLOC_CTX *memctx, int sdap_parse_entry(TALLOC_CTX *memctx, struct sdap_handle *sh, struct sdap_msg *sm, struct sdap_attr_map *map, int attrs_num, - struct sysdb_attrs **_attrs, char **_dn); + struct sysdb_attrs **_attrs, char **_dn, + bool disable_large_groups); int sdap_parse_user(TALLOC_CTX *memctx, struct sdap_options *opts, struct sdap_handle *sh, struct sdap_msg *sm, diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c index afa2904f478757fc15b5a54a411656bc7caa0bf0..d868656e1db36b8c1febb05e420f766bd4d32cec 100644 --- a/src/providers/ldap/sdap_async.c +++ b/src/providers/ldap/sdap_async.c @@ -1469,6 +1469,7 @@ struct sdap_get_generic_state { int map_num_attrs; struct sdap_reply sreply; + bool disable_large_groups; }; static void sdap_get_generic_done(struct tevent_req *subreq); @@ -1498,6 +1499,8 @@ struct tevent_req *sdap_get_generic_send(TALLOC_CTX *memctx, state->map = map; state->map_num_attrs = map_num_attrs; + state->disable_large_groups = dp_opt_get_bool(opts->basic, + SDAP_DISABLE_LARGE_GROUPS); subreq = sdap_get_generic_ext_send(state, ev, opts, sh, search_base, scope, filter, attrs, false, NULL, @@ -1523,7 +1526,7 @@ static errno_t sdap_get_generic_parse_entry(struct sdap_handle *sh, ret = sdap_parse_entry(state, sh, msg, state->map, state->map_num_attrs, - &attrs, NULL); + &attrs, NULL, state->disable_large_groups); if (ret != EOK) { DEBUG(3, ("sdap_parse_entry failed [%d]: %s\n", ret, strerror(ret))); return ret; @@ -1986,7 +1989,7 @@ static errno_t sdap_asq_search_parse_entry(struct sdap_handle *sh, ret = sdap_parse_entry(res[mi], sh, msg, map, num_attrs, - &res[mi]->attrs, NULL); + &res[mi]->attrs, NULL, false); if (ret != EOK) { DEBUG(3, ("sdap_parse_entry failed [%d]: %s\n", ret, strerror(ret))); goto done; -- 1.8.1.4