[SSSD] [PATCHv2] Add explicit request for supportedSASLMechanisms

Alexander Gordeev lasaine at lvk.cs.msu.su
Thu Jun 24 08:04:47 UTC 2010


В Thu, 24 Jun 2010 09:46:10 +0200
Sumit Bose <sbose at redhat.com> пишет:

> Hi,
> 
> On Thu, Jun 24, 2010 at 01:35:09AM +0400, Alexander Gordeev wrote:
> > supportedSASLMechanisms is an operational attribute so it's not returned
> > by openldap if not told explicitly. This change adds an explicit request
> > for this attribute.
> > 
> > Signed-off-by: Alexander Gordeev <lasaine at lvk.cs.msu.su>
> > ---
> >  src/providers/ldap/sdap_async.c |    6 +++++-
> >  1 files changed, 5 insertions(+), 1 deletions(-)
> > 
> > diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c
> > index 20828d2..82d01ad 100644
> > --- a/src/providers/ldap/sdap_async.c
> > +++ b/src/providers/ldap/sdap_async.c
> > @@ -637,6 +637,10 @@ struct tevent_req *sdap_get_rootdse_send(TALLOC_CTX *memctx,
> >  {
> >      struct tevent_req *req, *subreq;
> >      struct sdap_get_rootdse_state *state;
> > +    const char *attrs[] = {
> > +	    "supportedSASLMechanisms",
> > +	    NULL
> > +    };
> 
> thank you for the patch. You are right adding an explicit attribute list
> here. I have checked the related RFC 4512 and found in section 5.1:
> 
> "It is noted that root DSE attributes are operational and, like other
> operational attributes, are not returned in search requests unless
> requested by name."
> 
> The idea behind the root DSE search is to find out which features are
> supported by the sever. This is not restricted to SASL mechanisms, but
> should also include LDAP controls, extensions etc. Would you mind to add
> at least the attributes mentioned in the RFC, namely:
> 
> - altServer
> - namingContexts
> - supportedControl
> - supportedExtension
> - supportedFeatures
> - supportedLDAPVersion
> - supportedSASLMechanisms
> 
> Maybe Stephen or Simo also know about other root DSE attributes which
> might be specific to openLDAP or 389DS (formerly known as Fedora
> Directory Server (FDS)) and we want to include here.

Sure, I can add them. Maybe it's better to use just '+' as attribute
list? '+' means we'll get all operational attributes. Or even '*' '+',
which means we'll get both regular and operational attrs?

For example:

$ ldapsearch -LLL -x -s base -b "" '(objectclass=*)' '*' '+'
dn:
objectClass: top
objectClass: OpenLDAProotDSE
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
namingContexts: dc=gnet
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.3344810.2.3
supportedControl: 1.3.6.1.1.13.2
supportedControl: 1.3.6.1.1.13.1
supportedControl: 1.3.6.1.1.12
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedExtension: 1.3.6.1.1.8
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: GSSAPI
entryDN:
subschemaSubentry: cn=Subschema

-- 
  Alexander
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100624/3b40cb58/attachment.sig>


More information about the sssd-devel mailing list