>From 858ac06668a0b9d5cca84b7782fd3e95662e30f8 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl@redhat.com>
Date: Wed, 16 Jul 2014 13:33:58 +0100
Subject: [PATCH 1/3] IPA: new attribute map for non-posix groups

Create new set of attributes to be used when processing non-posix groups.

Resolves:
https://fedorahosted.org/sssd/ticket/2343
---
 src/providers/ipa/ipa_common.c             |  9 +++++++++
 src/providers/ipa/ipa_opts.h               |  8 ++++++++
 src/providers/ldap/ldap_id.c               |  8 +++++++-
 src/providers/ldap/sdap.h                  | 11 +++++++++++
 src/providers/ldap/sdap_async.h            |  3 ++-
 src/providers/ldap/sdap_async_initgroups.c | 12 +++++++++---
 6 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index f594de27a65ab1ff702d0c593a57e89bfd469532..54d0ecf3b5fa58f4bcf2ec144ecad578bf9c894b 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -568,6 +568,15 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
 
     ret = sdap_get_map(ipa_opts->id,
                        cdb, conf_path,
+                       ipa_np_group_map,
+                       SDAP_OPTS_NP_GROUP,
+                       &ipa_opts->id->np_group_map);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    ret = sdap_get_map(ipa_opts->id,
+                       cdb, conf_path,
                        ipa_netgroup_map,
                        IPA_OPTS_NETGROUP,
                        &ipa_opts->id->netgroup_map);
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index c7197beb1ecae2935255c46559287ad1186f760e..854163107da11866620fed6933c3680f810291bb 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -215,6 +215,14 @@ struct sdap_attr_map ipa_group_map[] = {
     SDAP_ATTR_MAP_TERMINATOR
 };
 
+/* map for non-posix groups */
+struct sdap_attr_map ipa_np_group_map[] = {
+    { "ldap_group_object_class", "nestedgroup", SYSDB_GROUP_CLASS, NULL },
+    { "ldap_group_name", "cn", SYSDB_NAME, NULL },
+    { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
+    SDAP_ATTR_MAP_TERMINATOR
+};
+
 struct sdap_attr_map ipa_netgroup_map[] = {
     { "ipa_netgroup_object_class", "ipaNisNetgroup", SYSDB_NETGROUP_CLASS, NULL },
     { "ipa_netgroup_name", "cn", SYSDB_NAME, NULL },
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index c788b6bdd6235f5b940d99382b115a2534dbb1d9..e164cde4cd551b80b95edaed477ca64bf3ea0011 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -919,6 +919,7 @@ struct groups_by_user_state {
 
     const char *name;
     const char **attrs;
+    const char **np_attrs;
 
     int dp_error;
     int sdap_ret;
@@ -966,6 +967,10 @@ static struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                NULL, &state->attrs, NULL);
     if (ret != EOK) goto fail;
 
+    ret = build_attrs_from_map(state, ctx->opts->np_group_map, SDAP_OPTS_NP_GROUP,
+                               NULL, &state->np_attrs, NULL);
+    if (ret != EOK) goto fail;
+
     ret = groups_by_user_retry(req);
     if (ret != EOK) {
         goto fail;
@@ -1020,7 +1025,8 @@ static void groups_by_user_connect_done(struct tevent_req *subreq)
                                   state->ctx,
                                   state->conn,
                                   state->name,
-                                  state->attrs);
+                                  state->attrs,
+                                  state->np_attrs);
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 6bab0e1c1ce520ba248cc6634349493d82b31233..94048bfc71d730b57341601e0a70bee242cae081 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -302,6 +302,16 @@ enum sdap_group_attrs {
     SDAP_OPTS_GROUP /* attrs counter */
 };
 
+/* the objectclass must be the first attribute.
+ * Functions depend on this */
+enum sdap_np_group_attrs {
+    SDAP_OC_NP_GROUP = 0,
+    SDAP_AT_NP_GROUP_NAME,
+    SDAP_AT_NP_GROUP_MEMBER,
+
+    SDAP_OPTS_NP_GROUP /* attrs counter */
+};
+
 enum sdap_netgroup_attrs {
     SDAP_OC_NETGROUP = 0,
     SDAP_AT_NETGROUP_NAME,
@@ -414,6 +424,7 @@ struct sdap_options {
     struct sdap_attr_map *user_map;
     size_t user_map_cnt;
     struct sdap_attr_map *group_map;
+    struct sdap_attr_map *np_group_map;
     struct sdap_attr_map *netgroup_map;
     struct sdap_attr_map *service_map;
 
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index 808254a249a3758d3f2ac257b7701c3b73526047..2ed7cb7ea38ff8a6108b5470b5b720e63c218eb5 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -134,7 +134,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
                                         const char *name,
-                                        const char **grp_attrs);
+                                        const char **grp_attrs,
+                                        const char **np_grp_attrs);
 int sdap_get_initgr_recv(struct tevent_req *req);
 
 struct tevent_req *sdap_exop_modify_passwd_send(TALLOC_CTX *memctx,
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 2eecdf9a3e9a42fdfd101132b0b856540893cee7..ae442ff5c5904a9c9ada83fd4f681d30afcd3204 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -706,6 +706,7 @@ struct sdap_initgr_nested_state {
     const char *orig_dn;
 
     const char **grp_attrs;
+    const char **np_grp_attrs;
 
     struct ldb_message_element *memberof;
     char *filter;
@@ -729,7 +730,8 @@ static struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
                                                   struct sss_domain_info *dom,
                                                   struct sdap_handle *sh,
                                                   struct sysdb_attrs *user,
-                                                  const char **grp_attrs)
+                                                  const char **grp_attrs,
+                                                  const char **np_grp_attrs)
 {
     struct tevent_req *req;
     struct sdap_initgr_nested_state *state;
@@ -2592,6 +2594,7 @@ struct sdap_get_initgr_state {
     struct sdap_id_conn_ctx *conn;
     const char *name;
     const char **grp_attrs;
+    const char **np_grp_attrs;
     const char **user_attrs;
     char *user_base_filter;
     char *filter;
@@ -2616,7 +2619,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
                                         const char *name,
-                                        const char **grp_attrs)
+                                        const char **grp_attrs,
+                                        const char **np_grp_attrs)
 {
     struct tevent_req *req;
     struct sdap_get_initgr_state *state;
@@ -2951,9 +2955,11 @@ static void sdap_get_initgr_user(struct tevent_req *subreq)
         break;
 
     case SDAP_SCHEMA_IPA_V1:
+
         subreq = sdap_initgr_nested_send(state, state->ev, state->opts,
                                          state->sysdb, state->dom, state->sh,
-                                         state->orig_user, state->grp_attrs);
+                                         state->orig_user, state->grp_attrs,
+                                         state->np_grp_attrs);
         if (!subreq) {
             tevent_req_error(req, ENOMEM);
             return;
-- 
1.9.3

