>From 0f1ee428e87012323c1446c3d63fe59d12331c01 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl@redhat.com>
Date: Mon, 20 Apr 2015 11:33:29 -0400
Subject: [PATCH] simple-access-provider: make user grp res more robust

Not all user groups need to be resolved if group deny list is empty.

Resolves:
https://fedorahosted.org/sssd/ticket/2519
---
 src/providers/simple/simple_access_check.c | 34 +++++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/src/providers/simple/simple_access_check.c b/src/providers/simple/simple_access_check.c
index c8217f6d4ef2560931d3151276085eb2a6028be5..f06bfa48ef09e4a5075f8f7360476beae387de00 100644
--- a/src/providers/simple/simple_access_check.c
+++ b/src/providers/simple/simple_access_check.c
@@ -395,6 +395,8 @@ struct simple_check_groups_state {
 
     const char **group_names;
     size_t num_names;
+
+    int failed_to_resolve_groups;
 };
 
 static void simple_check_get_groups_next(struct tevent_req *subreq);
@@ -430,6 +432,7 @@ simple_check_get_groups_send(TALLOC_CTX *mem_ctx,
 
     state->ev = ev;
     state->ctx = ctx;
+    state->failed_to_resolve_groups = 0;
 
     DEBUG(SSSDBG_TRACE_LIBS, "Looking up groups for user %s\n", username);
 
@@ -548,14 +551,13 @@ static void simple_check_get_groups_next(struct tevent_req *subreq)
         DEBUG(SSSDBG_OP_FAILURE,
               "Could not resolve name of group with GID %"SPRIgid"\n",
               state->lookup_groups[state->giter].gid);
-        tevent_req_error(req, ret);
-        return;
+        state->failed_to_resolve_groups++;
+    } else {
+        state->num_names++;
+        state->giter++;
     }
 
-    state->num_names++;
-    state->giter++;
-
-    if (state->giter < state->num_groups) {
+    if (state->giter + state->failed_to_resolve_groups < state->num_groups) {
         subreq = simple_resolve_group_send(req, state->ev, state->ctx,
                                    state->lookup_groups[state->giter].domain,
                                    state->lookup_groups[state->giter].gid);
@@ -677,7 +679,8 @@ simple_check_get_groups_primary(struct simple_check_groups_state *state,
 static errno_t
 simple_check_get_groups_recv(struct tevent_req *req,
                              TALLOC_CTX *mem_ctx,
-                             const char ***_group_names)
+                             const char ***_group_names,
+                             bool *_failed_to_resolve_group)
 {
     struct simple_check_groups_state *state;
 
@@ -686,6 +689,7 @@ simple_check_get_groups_recv(struct tevent_req *req,
     TEVENT_REQ_RETURN_ON_ERROR(req);
 
     *_group_names = talloc_steal(mem_ctx, state->group_names);
+    *_failed_to_resolve_group = state->failed_to_resolve_groups > 0;
     return EOK;
 }
 
@@ -772,9 +776,11 @@ static void simple_access_check_done(struct tevent_req *subreq)
     struct simple_access_check_state *state =
                         tevent_req_data(req, struct simple_access_check_state);
     errno_t ret;
+    bool failed_to_resolve_group;
 
     /* We know the names now. Run the check. */
-    ret = simple_check_get_groups_recv(subreq, state, &state->group_names);
+    ret = simple_check_get_groups_recv(subreq, state, &state->group_names,
+                                       &failed_to_resolve_group);
     talloc_zfree(subreq);
     if (ret == ENOENT) {
         /* If the user wasn't found, just shortcut */
@@ -786,6 +792,18 @@ static void simple_access_check_done(struct tevent_req *subreq)
               "Could not collect groups of user %s\n", state->username);
         tevent_req_error(req, ret);
         return;
+    } else if (ret == EOK && failed_to_resolve_group) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Could not collect groups of user %s\n", state->username);
+        if (state->ctx->deny_groups == NULL) {
+            DEBUG(SSSDBG_TRACE_FUNC,
+                  "But no deny groups were defined so we can continue.\n");
+        } else {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Some deny groups were defined, we can't continue\n");
+            tevent_req_error(req, ret);
+            return;
+        }
     }
 
     ret = simple_check_groups(state->ctx, state->group_names,
-- 
2.1.0

