On Fri, Dec 04, 2015 at 04:33:51PM +0100, Petr Cech wrote:
So, I have choose the 2) option and the patch is attached.
I think this patch goes in the right direction, but still needs more
work. See inline.
And something more:
a.bak ... log before patch
b.bak ... log after patch
Regards
Petr
From 12f03f5510cdfc56efd6d24bf06db0ad0e6d6368 Mon Sep 17 00:00:00
2001
From: Petr Cech <pcech(a)redhat.com>
Date: Mon, 9 Nov 2015 09:51:05 -0500
Subject: [PATCH] IPA_PROVIDER: Explicit no handle of services
Services for IPA subdomains aren't handled by SSSD. This patch
adds quick shortcut to avoid sending an LDAP query to cache.
Resolves:
https://fedorahosted.org/sssd/ticket/2747
---
src/providers/ipa/ipa_id.c | 28 +++++++++++++++++++++++++++-
src/providers/ipa/ipa_subdomains_id.c | 7 +++++++
2 files changed, 34 insertions(+), 1 deletion(-)
diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
index e81ccb34dd6eb44618538593f5473fbe5e89d896..efc00d2ae0b2086a0a94137f998d303c69a85d83
100644
--- a/src/providers/ipa/ipa_id.c
+++ b/src/providers/ipa/ipa_id.c
@@ -30,6 +30,25 @@
#include "providers/ldap/sdap_async.h"
#include "providers/ipa/ipa_id.h"
+
+static bool is_object_overridable(struct be_acct_req *ar)
+{
+ bool ret = false;
+
+ switch (ar->entry_type & BE_REQ_TYPE_MASK) {
+ case BE_REQ_USER:
+ ret = true;
+ break;
+ case BE_REQ_GROUP:
+ ret = true;
+ break;
I know what you tried to do here, but please keep in mind that other types
of request can also yield user. At least BE_REQ_INITGROUPS, BE_REQ_BY_SECID,
BE_REQ_USER_AND_GROUP, BE_REQ_BY_UUID, BE_REQ_BY_CERT.
We can also collapse the case: statements so that the switch is more
compact.
+ default:
+ break;
+ }
+
+ return ret;
+}
+
static const char *ipa_account_info_error_text(int ret, int *dp_error,
const char *default_text)
{
@@ -638,7 +657,8 @@ ipa_id_get_account_info_send(TALLOC_CTX *memctx, struct
tevent_context *ev,
|| state->ar->filter_type == BE_FILTER_SECID
|| state->ar->extra_value == NULL
|| strcmp(state->ar->extra_value,
- EXTRA_INPUT_MAYBE_WITH_VIEW) != 0 ) {
+ EXTRA_INPUT_MAYBE_WITH_VIEW) != 0
+ || ! is_object_overridable(state->ar)) {
ret = ipa_id_get_account_info_get_original_step(req, ar);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE,
@@ -820,6 +840,12 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req
*subreq)
goto fail;
}
+ if (! is_object_overridable(state->ar)) {
+ state->dp_error = DP_ERR_OK;
+ tevent_req_done(req);
+ return;
+ }
+
ret = get_object_from_cache(state, state->domain, state->ar,
&state->obj_msg);
if (ret == ENOENT) {
diff --git a/src/providers/ipa/ipa_subdomains_id.c
b/src/providers/ipa/ipa_subdomains_id.c
index 472985d4ab4f785aa9c4af94bf8021829ca1c3c8..7966a763ee860bbf426f3e308a3f1457a8c8d5fa
100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -915,6 +915,13 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
NULL };
char *name;
+ if ((ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_SERVICES) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Services for IPA subdomains aren't handled by SSSD.\n");
+ ret = ENOENT;
+ goto done;
+ }
+
With adding is_object_overridable(), I don't think this branch is
reachable.
if (ar->filter_type == BE_FILTER_SECID) {
ret = sysdb_search_object_by_sid(mem_ctx, dom, ar->filter_value, attrs,
&res);
--
2.4.3
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]]
[be_get_account_info] (0x0200): Got request for [0x1005][FAST
BE_REQ_SERVICES][1][name=dns]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [be_req_set_domain] (0x0400): Changing
request domain from [persei.dev] to [persei.dev]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [services_get_send] (0x1000): Preparing
to search for services with filter [(&(cn=dns)(objectclass=ipService))]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_id_op_connect_step] (0x4000):
reusing cached connection
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_services_next_base] (0x0400):
Searching for services with base [cn=accounts,dc=persei,dc=dev]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_print_server] (0x2000): Searching
10.34.58.89
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[(&(cn=dns)(objectclass=ipService))][cn=accounts,dc=persei,dc=dev].
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [objectClass]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [cn]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [ipServicePort]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [ipServiceProtocol]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [entryUSN]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 14
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_op_add] (0x2000): New operation
14 timeout 6
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
sh[0x13f08d0], connected[1], ops[0x1429ae0], ldap[0x13ed340]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_process_message] (0x4000):
Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_generic_op_finished]
(0x0400): Search result: Success(0), no errmsg set
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_op_destructor] (0x2000):
Operation 14 finished
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_get_services_process] (0x0400):
Search for services, returned 0 results.
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_id_op_done] (0x4000): releasing
operation connection
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): start ldb transaction
(nesting: 0)
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sysdb_search_services] (0x2000):
Search services with filter:
(&(objectclass=service)(&(serviceProtocol=*)(|(nameAlias=dns)(name=dns))))
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x1413950
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x13fb3f0
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Running timer event
0x1413950 "ltdb_callback"
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Destroying timer event
0x13fb3f0 "ltdb_timeout"
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Ending timer event
0x1413950 "ltdb_callback"
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sysdb_search_services] (0x2000): No
such entry
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): cancel ldb transaction
(nesting: 0)
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [get_object_from_cache] (0x0020):
Unexpected entry type [5].
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ipa_id_get_account_info_orig_done]
(0x0040): get_object_from_cache failed.
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [ipa_account_info_error_text] (0x0020):
Bug: dp_error is OK on failed request
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [acctinfo_callback] (0x0100): Request
processed. Returned 3,22,Account info lookup failed
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
sh[0x13f08d0], connected[1], ops[(nil)], ldap[0x13ed340]
(Fri Dec 4 15:53:50 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
ldap_result found nothing!
(Fri Dec 4 15:53:55 2015) [sssd[be[persei.dev]]] [sbus_dispatch] (0x4000): dbus conn:
0x13d1980
(Fri Dec 4 15:53:55 2015) [sssd[be[persei.dev]]] [sbus_dispatch] (0x4000): Dispatching.
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]]
[be_get_account_info] (0x0200): Got request for [0x1005][FAST
BE_REQ_SERVICES][1][name=dns]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [be_req_set_domain] (0x0400): Changing
request domain from [persei.dev] to [persei.dev]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [services_get_send] (0x1000): Preparing
to search for services with filter [(&(cn=dns)(objectclass=ipService))]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_id_op_connect_step] (0x4000):
reusing cached connection
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_services_next_base] (0x0400):
Searching for services with base [cn=accounts,dc=persei,dc=dev]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_print_server] (0x2000): Searching
10.34.58.89
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[(&(cn=dns)(objectclass=ipService))][cn=accounts,dc=persei,dc=dev].
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [objectClass]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [cn]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [ipServicePort]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [ipServiceProtocol]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [entryUSN]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 14
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_op_add] (0x2000): New operation
14 timeout 6
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
sh[0xb8f8d0], connected[1], ops[0xbb7d90], ldap[0xb8c340]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_process_message] (0x4000):
Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_generic_op_finished]
(0x0400): Search result: Success(0), no errmsg set
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_op_destructor] (0x2000):
Operation 14 finished
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_get_services_process] (0x0400):
Search for services, returned 0 results.
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_id_op_done] (0x4000): releasing
operation connection
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): start ldb transaction
(nesting: 0)
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sysdb_search_services] (0x2000):
Search services with filter:
(&(objectclass=service)(&(serviceProtocol=*)(|(nameAlias=dns)(name=dns))))
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0xbc7880
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0xb9e260
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Running timer event
0xbc7880 "ltdb_callback"
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Destroying timer event
0xb9e260 "ltdb_timeout"
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): Ending timer event
0xbc7880 "ltdb_callback"
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sysdb_search_services] (0x2000): No
such entry
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [ldb] (0x4000): cancel ldb transaction
(nesting: 0)
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
sh[0xb8f8d0], connected[1], ops[(nil)], ldap[0xb8c340]
(Fri Dec 4 15:52:36 2015) [sssd[be[persei.dev]]] [sdap_process_result] (0x2000): Trace:
ldap_result found nothing!
(Fri Dec 4 15:52:40 2015) [sssd[be[persei.dev]]] [sbus_dispatch] (0x4000): dbus conn:
0xb70980
(Fri Dec 4 15:52:40 2015) [sssd[be[persei.dev]]] [sbus_dispatch] (0x4000): Dispatching.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org