>From ec5b977b758cb562c9b0fd22d8ce9b7401a11b69 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 29 May 2015 16:37:54 +0200 Subject: [PATCH 18/24] ldap: use proper sysdb name in groups_by_user_done() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In a recent change set_initgroups_expire_attribute() was added to groups_by_user_done() to make sure that the initgroups timeout is only added to the user object until all groups added to the cache. This change (and the original code in groups_by_user_done() as well) didn't took sub-domain users into account where the name in sysdb might different form the original request and the domain is not the configured domain. This patch tries to ensure that the right name and domain are used. https://fedorahosted.org/sssd/ticket/2663 Reviewed-by: Lukáš Slebodník (cherry picked from commit d0b7e5fcfca7d0db9e3d19be7b51f34d03d3d720) (cherry picked from commit edc1538566e7034eea9b8d592206fbc236233dff) --- src/providers/ldap/ldap_id.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index bf4a344be64ff6c9d5c076810f98fda27dc006dd..ab981faf6374bde4b0191317a33e9175951dc14c 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -1085,6 +1085,7 @@ static void groups_by_user_done(struct tevent_req *subreq) struct groups_by_user_state); int dp_error = DP_ERR_FATAL; int ret; + const char *cname; ret = sdap_get_initgr_recv(subreq); talloc_zfree(subreq); @@ -1108,17 +1109,25 @@ static void groups_by_user_done(struct tevent_req *subreq) return; } + /* state->name is still the name used for the original request. The cached + * object might have a different name, e.g. a fully-qualified name. */ + ret = sysdb_get_real_name(state, state->domain->sysdb, state->domain, + state->name, &cname); + if (ret != EOK) { + cname = state->name; + DEBUG(SSSDBG_OP_FAILURE, "Failed to canonicalize name, using [%s].\n", + cname); + } + if (ret == ENOENT && state->noexist_delete == true) { - ret = sysdb_delete_user(state->ctx->be->domain->sysdb, - state->ctx->be->domain, state->name, 0); + ret = sysdb_delete_user(state->domain->sysdb, state->domain, cname, 0); if (ret != EOK && ret != ENOENT) { tevent_req_error(req, ret); return; } } - ret = set_initgroups_expire_attribute(state->ctx->be->domain, - state->name); + ret = set_initgroups_expire_attribute(state->domain, cname); if (ret != EOK) { state->dp_error = DP_ERR_FATAL; tevent_req_error(req, ret); -- 2.4.3