On Wed, Apr 29, 2015 at 03:27:31PM +0200, Sumit Bose wrote:
> On Wed, Apr 29, 2015 at 02:12:48PM +0200, Jakub Hrozek wrote:
> > On Wed, Apr 29, 2015 at 11:25:04AM +0200, Sumit Bose wrote:
> > > Hi,
> > >
> > > while analyzing the test case described in
> > >
https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
> > > the client and server code which are hopefully fixed by the attached
> > > patch set.
> > >
> > > bye,
> > > Sumit
> >
> > > From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose(a)redhat.com>
> > > Date: Tue, 28 Apr 2015 17:18:48 +0200
> > > Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
> > >
> > > Newer versions of the extdom plugin return the full list of
> > > group-memberships during a user lookup request. With these version there
> > > is no need to reject a initgroups request for sub/trusted-domain users
> > > anymore. This is e.g. useful for callers which call getgrouplist()
> > > directly without calling getpwnam() before. Additionally it helps if for
> > > some reasons the lifetime of the user entry and the lifetime of the
> > > initgroups data is different.
> > >
> > > Related to
https://fedorahosted.org/sssd/ticket/2633
> >
> > ACK
> >
> > Makes sense, tested with id from command line and os.initgroups() from
> > Python.
> >
> > > From 627ebf1782fb5dafa2536f5d451e1d39f46f0012 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose(a)redhat.com>
> > > Date: Tue, 28 Apr 2015 17:20:05 +0200
> > > Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
> > >
> > > Newer versions of the extdom plugin return the full list of
> > > group-memberships during user lookups. As a result the lifetime of the
> > > group-membership data is updates in those cases. But if the user is not
> > > looked up directly but is resolved as a group member during a group
> > > lookup SSSD does not resolve all group-membership of the user to avoid
> > > deep recursion and eventually a complete enumeration of the user and
> > > group base. In this case the lifetime of the group-memberships should
> > > not be updated because it might be incomplete.
> > >
> > > Related to
https://fedorahosted.org/sssd/ticket/2633
> >
> > ACK, nice catch
> >
> > > From 0dcbb088866cbc459379f8c0e23a75585b2036a8 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose(a)redhat.com>
> > > Date: Tue, 28 Apr 2015 20:58:15 +0200
> > > Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
> > >
> > > This patch makes ipa_initgr_get_overrides_send() public and add support
> > > to search overrides by UUID or by SID.
> >
> > Do you think this interface might be used more in the future? If yes,
> > then it would be cleaner to also restrict the synopsis of the function
> > with some enum or wrap around mini-request that would pass the ar
> > directly rather than allowing generic char* and then checking against
> > known values.
> >
> > But for now I'm fine with letting the code go, if the programmer uses
> > the interface, he would get an error with an unsupported value..
>
> so far we only have SID and UUID based anchors, so I do not expect any
> additions or increased usage any time soon.
sorry, I found a bug in this patch, will send a new version, soon.
bye,
Sumit
>
> >
> > > From 94f9ab29cd40338e7fa7dee636065cf8d06ec330 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose(a)redhat.com>
> > > Date: Tue, 28 Apr 2015 20:59:43 +0200
> > > Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever
mode
> > >
> > > After the group memberships of a user from a trusted domain are read it
> > > must be checked if there are overrides for the discovered groups to be
> > > able to return the right gid or name to the caller.
> > >
> > > Related to
https://fedorahosted.org/sssd/ticket/2633
> >
> > This patch causes a compilation warning:
> > src/providers/ipa/ipa_subdomains_id.c: In function
'ipa_id_get_groups_overrides_done':
> > src/providers/ipa/ipa_subdomains_id.c:1225:35: warning: unused variable
'state' [-Wunused-variable]
> > struct ipa_get_ad_acct_state *state = tevent_req_data(req,
>
> sorry, must have missed that, new version attached.
>
> bye,
> Sumit
>
> >
> > But functionally-wise seems OK.
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel(a)lists.fedorahosted.org
> >
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> From 659f21eca00085c44233c3c307cd4bf2ad934beb Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose(a)redhat.com>
> Date: Tue, 28 Apr 2015 17:18:48 +0200
> Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
>
> Newer versions of the extdom plugin return the full list of
> group-memberships during a user lookup request. With these version there
> is no need to reject a initgroups request for sub/trusted-domain users
> anymore. This is e.g. useful for callers which call getgrouplist()
> directly without calling getpwnam() before. Additionally it helps if for
> some reasons the lifetime of the user entry and the lifetime of the
> initgroups data is different.
>
> Related to
https://fedorahosted.org/sssd/ticket/2633
> ---
> src/providers/ipa/ipa_s2n_exop.c | 3 ---
> src/providers/ipa/ipa_subdomains.h | 4 ++++
> src/providers/ipa/ipa_subdomains_id.c | 24 +++++++++++++++++-------
> 3 files changed, 21 insertions(+), 10 deletions(-)
>
> diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
> index
688fdefe8eefe29a0cd13010bb3998527f3111f4..7ee2e0f16803a34b0a657ea12b102a8ae4364af8 100644
> --- a/src/providers/ipa/ipa_s2n_exop.c
> +++ b/src/providers/ipa/ipa_s2n_exop.c
> @@ -50,9 +50,6 @@ enum response_types {
> };
>
> /* ==Sid2Name Extended Operation============================================= */
> -#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
> -#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
> -
> struct ipa_s2n_exop_state {
> struct sdap_handle *sh;
>
> diff --git a/src/providers/ipa/ipa_subdomains.h
b/src/providers/ipa/ipa_subdomains.h
> index
5266943f8e34f6e918022ee470f9c8fcc2199a8e..0cece2cc70a81f81ff143259e620be7e3d143244 100644
> --- a/src/providers/ipa/ipa_subdomains.h
> +++ b/src/providers/ipa/ipa_subdomains.h
> @@ -28,6 +28,10 @@
> #include "providers/dp_backend.h"
> #include "providers/ipa/ipa_common.h"
>
> +/* ==Sid2Name Extended Operation============================================= */
> +#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
> +#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
> +
> struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx);
>
> int ipa_subdom_init(struct be_ctx *be_ctx,
> diff --git a/src/providers/ipa/ipa_subdomains_id.c
b/src/providers/ipa/ipa_subdomains_id.c
> index
15776d2e13af158058a874f761671a5801cf3d6a..1253510dcb8523c19d879d4351ffa07995f161f7 100644
> --- a/src/providers/ipa/ipa_subdomains_id.c
> +++ b/src/providers/ipa/ipa_subdomains_id.c
> @@ -386,15 +386,9 @@ struct tevent_req *ipa_get_subdom_acct_send(TALLOC_CTX
*memctx,
> case BE_REQ_GROUP:
> case BE_REQ_BY_SECID:
> case BE_REQ_USER_AND_GROUP:
> + case BE_REQ_INITGROUPS:
> ret = EOK;
> break;
> - case BE_REQ_INITGROUPS:
> - ret = ENOTSUP;
> - DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled
" \
> - "by the IPA provider but are resolved
" \
> - "by the responder directly from the
" \
> - "cache.\n");
> - break;
> default:
> ret = EINVAL;
> DEBUG(SSSDBG_OP_FAILURE, "Invalid sub-domain request
type.\n");
> @@ -434,6 +428,22 @@ static void ipa_get_subdom_acct_connected(struct tevent_req
*subreq)
> return;
> }
>
> + if (state->entry_type == BE_REQ_INITGROUPS) {
> + /* With V1 of the extdom plugin a user lookup will resolve the full
> + * group membership of the user. */
> + if (sdap_is_extension_supported(sdap_id_op_handle(state->op),
> + EXOP_SID2NAME_V1_OID)) {
> + state->entry_type = BE_REQ_USER;
> + } else {
> + DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled
" \
> + "by the IPA provider but are resolved
" \
> + "by the responder directly from the
" \
> + "cache.\n");
> + tevent_req_error(req, ENOTSUP);
> + return;
> + }
> + }
> +
> req_input = talloc(state, struct req_input);
> if (req_input == NULL) {
> DEBUG(SSSDBG_OP_FAILURE, "talloc failed.\n");
> --
> 2.1.0
>
> From 6da4f725dc3338fbd666933a03d919c04f0a84c1 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose(a)redhat.com>
> Date: Tue, 28 Apr 2015 17:20:05 +0200
> Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
>
> Newer versions of the extdom plugin return the full list of
> group-memberships during user lookups. As a result the lifetime of the
> group-membership data is updates in those cases. But if the user is not
> looked up directly but is resolved as a group member during a group
> lookup SSSD does not resolve all group-membership of the user to avoid
> deep recursion and eventually a complete enumeration of the user and
> group base. In this case the lifetime of the group-memberships should
> not be updated because it might be incomplete.
>
> Related to
https://fedorahosted.org/sssd/ticket/2633
> ---
> src/providers/ipa/ipa_s2n_exop.c | 19 +++++++++++--------
> 1 file changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
> index
7ee2e0f16803a34b0a657ea12b102a8ae4364af8..24d1b6c70c557c5e6d488a14f64e97493b924907 100644
> --- a/src/providers/ipa/ipa_s2n_exop.c
> +++ b/src/providers/ipa/ipa_s2n_exop.c
> @@ -685,7 +685,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info
*dom,
> struct resp_attrs *attrs,
> struct resp_attrs *simple_attrs,
> const char *view_name,
> - struct sysdb_attrs *override_attrs);
> + struct sysdb_attrs *override_attrs,
> + bool update_initgr_timeout);
>
> static errno_t s2n_response_to_attrs(TALLOC_CTX *mem_ctx,
> char *retoid,
> @@ -1118,7 +1119,7 @@ static errno_t ipa_s2n_get_fqlist_save_step(struct tevent_req
*req)
>
> ret = ipa_s2n_save_objects(state->dom, &state->req_input,
state->attrs,
> NULL, state->ipa_ctx->view_name,
> - state->override_attrs);
> + state->override_attrs, false);
> if (ret != EOK) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
> return ret;
> @@ -1617,7 +1618,7 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
> || strcmp(state->ipa_ctx->view_name,
> SYSDB_DEFAULT_VIEW_NAME) == 0) {
> ret = ipa_s2n_save_objects(state->dom, state->req_input,
state->attrs,
> - state->simple_attrs, NULL, NULL);
> + state->simple_attrs, NULL, NULL, true);
> if (ret != EOK) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
> goto done;
> @@ -1739,7 +1740,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info
*dom,
> struct resp_attrs *attrs,
> struct resp_attrs *simple_attrs,
> const char *view_name,
> - struct sysdb_attrs *override_attrs)
> + struct sysdb_attrs *override_attrs,
> + bool update_initgr_timeout)
> {
> int ret;
> time_t now;
> @@ -1938,7 +1940,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info
*dom,
> }
> }
>
> - if (attrs->response_type == RESP_USER_GROUPLIST) {
> + if (attrs->response_type == RESP_USER_GROUPLIST
> + && update_initgr_timeout) {
> /* Since RESP_USER_GROUPLIST contains all group memberships it
> * is effectively an initgroups request hence
> * SYSDB_INITGR_EXPIRE will be set.*/
> @@ -2209,7 +2212,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req
*subreq)
> &sid_str);
> if (ret == ENOENT) {
> ret = ipa_s2n_save_objects(state->dom, state->req_input,
state->attrs,
> - state->simple_attrs, NULL, NULL);
> + state->simple_attrs, NULL, NULL, true);
> if (ret != EOK) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
> goto fail;
> @@ -2249,7 +2252,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req
*subreq)
> ret = ipa_s2n_save_objects(state->dom, state->req_input,
state->attrs,
> state->simple_attrs,
> state->ipa_ctx->view_name,
> - state->override_attrs);
> + state->override_attrs, true);
> if (ret != EOK) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
> tevent_req_error(req, ret);
> @@ -2285,7 +2288,7 @@ static void ipa_s2n_get_user_get_override_done(struct
tevent_req *subreq)
>
> ret = ipa_s2n_save_objects(state->dom, state->req_input,
state->attrs,
> state->simple_attrs,
state->ipa_ctx->view_name,
> - override_attrs);
> + override_attrs, true);
> if (ret != EOK) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
> tevent_req_error(req, ret);
> --
> 2.1.0
>
> From 1a6f30051b40910de40fdaa27bc7f93ca94c21ca Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose(a)redhat.com>
> Date: Tue, 28 Apr 2015 20:58:15 +0200
> Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
>
> This patch makes ipa_initgr_get_overrides_send() public and add support
> to search overrides by UUID or by SID.
>
> Related to
https://fedorahosted.org/sssd/ticket/2633
> ---
> src/providers/ipa/ipa_id.c | 75 ++++++++++++++++++++++++++++++++--------------
> src/providers/ipa/ipa_id.h | 10 +++++++
> 2 files changed, 63 insertions(+), 22 deletions(-)
>
> diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
> index
125a17ca6f29077cbb93e0444e395d0de8b23d63..bf38987a36e5d3612490cad87bfe4b8914ced58b 100644
> --- a/src/providers/ipa/ipa_id.c
> +++ b/src/providers/ipa/ipa_id.c
> @@ -294,6 +294,7 @@ struct ipa_initgr_get_overrides_state {
>
> struct ldb_message **groups;
> size_t group_count;
> + const char *groups_id_attr;
> size_t group_idx;
> struct be_acct_req *ar;
>
> @@ -302,13 +303,14 @@ struct ipa_initgr_get_overrides_state {
>
> static int ipa_initgr_get_overrides_step(struct tevent_req *req);
>
> -static struct tevent_req *
> +struct tevent_req *
> ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
> struct tevent_context *ev,
> struct ipa_id_ctx *ipa_ctx,
> struct sss_domain_info *user_dom,
> size_t groups_count,
> - struct ldb_message **groups)
> + struct ldb_message **groups,
> + const char *groups_id_attr)
> {
> int ret;
> struct tevent_req *req;
> @@ -334,6 +336,12 @@ ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
> ret = EINVAL;
> goto done;
> }
> + state->groups_id_attr = talloc_strdup(state, groups_id_attr);
> + if (state->groups_id_attr == NULL) {
> + DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
> + ret = ENOMEM;
> + goto done;
> + }
>
> ret = ipa_initgr_get_overrides_step(req);
> done:
> @@ -366,7 +374,7 @@ static int ipa_initgr_get_overrides_step(struct tevent_req
*req)
> }
>
> ipa_uuid = ldb_msg_find_attr_as_string(state->groups[state->group_idx],
> - SYSDB_UUID, NULL);
> + state->groups_id_attr, NULL);
> if (ipa_uuid == NULL) {
> /* This should never happen, the search filter used to get the list
> * of groups includes "uuid=*"
> @@ -377,11 +385,24 @@ static int ipa_initgr_get_overrides_step(struct tevent_req
*req)
>
> talloc_free(state->ar); /* Avoid spiking memory with many groups */
>
> - ret = get_be_acct_req_for_uuid(state, ipa_uuid,
> - state->user_dom->name,
&state->ar);
> - if (ret != EOK) {
> - DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
> - return ret;
> + if (strcmp(state->groups_id_attr, SYSDB_UUID) == 0) {
> + ret = get_be_acct_req_for_uuid(state, ipa_uuid,
> + state->user_dom->name,
&state->ar);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid
failed.\n");
> + return ret;
> + }
> + } else if (strcmp(state->groups_id_attr, SYSDB_SID_STR) == 0) {
> + ret = get_be_acct_req_for_sid(state, ipa_uuid,
> + state->user_dom->name,
&state->ar);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid
failed.\n");
> + return ret;
> + }
> + } else {
> + DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported groups ID type [%s].\n",
> + state->groups_id_attr);
> + return EINVAL;
> }
>
> DEBUG(SSSDBG_TRACE_LIBS, "Fetching group %s\n", ipa_uuid);
> @@ -408,7 +429,7 @@ static void ipa_initgr_get_overrides_override_done(struct
tevent_req *subreq)
> struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
> struct ipa_initgr_get_overrides_state);
> int ret;
> - struct sysdb_attrs *override_attrs;
> + struct sysdb_attrs *override_attrs = NULL;
>
> ret = ipa_get_ad_override_recv(subreq, &state->dp_error, state,
> &override_attrs);
> @@ -419,15 +440,23 @@ static void ipa_initgr_get_overrides_override_done(struct
tevent_req *subreq)
> return;
> }
>
> - ret = sysdb_store_override(state->user_dom,
state->ipa_ctx->view_name,
> - SYSDB_MEMBER_GROUP,
> - override_attrs,
> - state->groups[state->group_idx]->dn);
> - talloc_free(override_attrs);
> - if (ret != EOK) {
> - DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
> - tevent_req_error(req, ret);
> - return;
> + if (override_attrs != NULL) {
> + if (strcmp(state->ipa_ctx->view_name, SYSDB_DEFAULT_VIEW_NAME) == 0)
{
> + ret = sysdb_apply_default_override(state->user_dom, override_attrs,
> +
state->groups[state->group_idx]->dn);
> + } else {
> + ret = sysdb_store_override(state->user_dom,
> + state->ipa_ctx->view_name,
> + SYSDB_MEMBER_GROUP,
> + override_attrs,
> +
state->groups[state->group_idx]->dn);
> + }
> + talloc_free(override_attrs);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
> + tevent_req_error(req, ret);
> + return;
> + }
> }
>
> state->group_idx++;
> @@ -443,7 +472,7 @@ static void ipa_initgr_get_overrides_override_done(struct
tevent_req *subreq)
> tevent_req_done(req);
> }
>
> -static int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
> +int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
> {
> struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
> struct ipa_initgr_get_overrides_state);
> @@ -882,7 +911,8 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req
*subreq)
> if (state->user_groups != NULL) {
> subreq = ipa_initgr_get_overrides_send(state, state->ev,
state->ipa_ctx,
> state->domain,
state->group_cnt,
> - state->user_groups);
> + state->user_groups,
> + SYSDB_UUID);
> if (subreq == NULL) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send
failed.\n");
> ret = ENOMEM;
> @@ -960,8 +990,9 @@ static void ipa_id_get_account_info_done(struct tevent_req
*subreq)
>
> if (state->user_groups != NULL) {
> subreq = ipa_initgr_get_overrides_send(state, state->ev,
state->ipa_ctx,
> - state->domain,
state->group_cnt,
> - state->user_groups);
> + state->domain,
state->group_cnt,
> + state->user_groups,
> + SYSDB_UUID);
> if (subreq == NULL) {
> DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send
failed.\n");
> ret = ENOMEM;
> diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
> index
2bb5e0d38f42d4bbb04854dfb04804fecf6257e8..c03ca037a2850478a8f4933bac4fcf8bd70ada04 100644
> --- a/src/providers/ipa/ipa_id.h
> +++ b/src/providers/ipa/ipa_id.h
> @@ -119,4 +119,14 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
> struct sss_domain_info *dom,
> struct be_acct_req *ar,
> struct ldb_message **_msg);
> +
> +struct tevent_req *
> +ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
> + struct tevent_context *ev,
> + struct ipa_id_ctx *ipa_ctx,
> + struct sss_domain_info *user_dom,
> + size_t groups_count,
> + struct ldb_message **groups,
> + const char *groups_id_attr);
> +int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error);
> #endif
> --
> 2.1.0
>
> From 6ca93e48d07f626f81177cc03340c103d0689e33 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose(a)redhat.com>
> Date: Tue, 28 Apr 2015 20:59:43 +0200
> Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
>
> After the group memberships of a user from a trusted domain are read it
> must be checked if there are overrides for the discovered groups to be
> able to return the right gid or name to the caller.
>
> Related to
https://fedorahosted.org/sssd/ticket/2633
> ---
> src/providers/ipa/ipa_subdomains_id.c | 70 +++++++++++++++++++++++++++++++++++
> 1 file changed, 70 insertions(+)
>
> diff --git a/src/providers/ipa/ipa_subdomains_id.c
b/src/providers/ipa/ipa_subdomains_id.c
> index
1253510dcb8523c19d879d4351ffa07995f161f7..ed9dcd766292b3ebeb84a659941ee4c1d7b5a62b 100644
> --- a/src/providers/ipa/ipa_subdomains_id.c
> +++ b/src/providers/ipa/ipa_subdomains_id.c
> @@ -569,6 +569,8 @@ struct ipa_get_ad_acct_state {
> static void ipa_get_ad_acct_ad_part_done(struct tevent_req *subreq);
> static void ipa_get_ad_override_done(struct tevent_req *subreq);
> static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req);
> +static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req);
> +static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq);
> static void ipa_get_ad_acct_done(struct tevent_req *subreq);
> static struct ad_id_ctx *ipa_get_ad_id_ctx(struct ipa_id_ctx *ipa_ctx,
> struct sss_domain_info *dom);
> @@ -1123,6 +1125,9 @@ static errno_t ipa_get_ad_apply_override_step(struct
tevent_req *req)
> struct tevent_req *subreq;
> const char *obj_name;
> int entry_type;
> + size_t groups_count = 0;
> + struct ldb_message **groups = NULL;
> + const char *attrs[] = SYSDB_INITGR_ATTRS;
>
> if (state->override_attrs != NULL) {
> /* We are in ipa-server-mode, so the view is the default view by
> @@ -1179,6 +1184,71 @@ static errno_t ipa_get_ad_apply_override_step(struct
tevent_req *req)
> state->ar->entry_type = BE_REQ_USER;
> }
>
> + /* Lookup all groups the user is a member of which do not have ORIGINALAD
> + * attributes set, i.e. where overrides might not have been applied. */
> + ret = sysdb_asq_search(state, state->obj_dom, state->obj_msg->dn,
> +
"(&("SYSDB_GC")("SYSDB_GIDNUM"=*)" \
> + "(!("ORIGINALAD_PREFIX
SYSDB_GIDNUM"=*))" \
> + "(!("ORIGINALAD_PREFIX
SYSDB_NAME"=*)))",
> + SYSDB_INITGR_ATTR,
> + attrs, &groups_count, &groups);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_groups_without_orig
failed.\n");
> + return ret;
> + }
> +
> + if (groups != NULL) {
> + subreq = ipa_initgr_get_overrides_send(state, state->ev,
state->ipa_ctx,
> + state->obj_dom, groups_count,
> + groups, SYSDB_SID_STR);
> + if (subreq == NULL) {
> + DEBUG(SSSDBG_OP_FAILURE, "ipa_initgr_get_overrides_send
failed.\n");
> + return ENOMEM;
> + }
> + tevent_req_set_callback(subreq, ipa_id_get_groups_overrides_done, req);
> + return EOK;
> + }
> +
> + ret = ipa_get_ad_ipa_membership_step(req);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step
failed.\n");
> + return ret;
> + }
> +
> + return EOK;
> +}
> +
> +static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq)
> +{
> + struct tevent_req *req = tevent_req_callback_data(subreq,
> + struct tevent_req);
> + errno_t ret;
> +
> + ret = ipa_initgr_get_overrides_recv(subreq, NULL);
> + talloc_zfree(subreq);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE,
> + "IPA resolve user groups overrides failed [%d].\n", ret);
> + tevent_req_error(req, ret);
> + return;
> + }
> +
> + ret = ipa_get_ad_ipa_membership_step(req);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step
failed.\n");
> + tevent_req_error(req, ret);
> + return;
> + }
> +
> + return;
> +}
> +
> +static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req)
> +{
> + struct ipa_get_ad_acct_state *state = tevent_req_data(req,
> + struct ipa_get_ad_acct_state);
> + errno_t ret;
> + struct tevent_req *subreq;
>
> /* For initgroups request we have to check IPA group memberships of AD
> * users. This has to be done for other user-request as well to make sure
> --
> 2.1.0
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel