[SSSD] [PATCHES] Use namingContext to set empty search bases
Sumit Bose
sbose at redhat.com
Tue Nov 2 09:57:23 UTC 2010
Hi,
these two patches make the use of the ldap_search_base option optional
and should fix ticket #558.
bye,
Sumit
-------------- next part --------------
From fd7f7085335f2731ded5ee5cd4923561b693893d Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 2 Nov 2010 09:35:00 +0100
Subject: [PATCH 1/2] Use namingContext to set empty search bases
---
src/providers/ldap/sdap.c | 75 ++++++++++++++++++++++++++++
src/providers/ldap/sdap.h | 4 ++
src/providers/ldap/sdap_async_connection.c | 8 +++
3 files changed, 87 insertions(+), 0 deletions(-)
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 4d911c4..9df7d9a 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -404,6 +404,81 @@ int sdap_set_rootdse_supported_lists(struct sysdb_attrs *rootdse,
}
+static char *get_naming_context(TALLOC_CTX *mem_ctx,
+ struct sysdb_attrs *rootdse)
+{
+ struct ldb_message_element *el = NULL;
+ int i;
+ char *naming_context = NULL;
+
+ for (i = 0; i < rootdse->num; i++) {
+ el = &rootdse->a[i];
+ if (strcasecmp(el->name, "namingContexts") == 0) {
+ if (el->num_values == 0) {
+ DEBUG(3, ("Missing namingContexts value in rootDSE.\n"));
+ } else if (el->num_values == 1) {
+ naming_context = talloc_strndup(mem_ctx,
+ (char *) el->values[0].data,
+ el->values[0].length);
+ if (naming_context == NULL) {
+ DEBUG(1, ("talloc_strndup failed.\n"));
+ }
+ } else {
+ DEBUG(3, ("More than one namingContexts found.\n"));
+ }
+
+ return naming_context;
+ }
+ }
+
+ DEBUG(3, ("No attribute 'namingContexts' found in rootDSE.\n"))
+ return NULL;
+}
+
+errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
+ struct sdap_handle *sh,
+ struct sdap_options *opts)
+{
+ int ret;
+ char *naming_context = NULL;
+ const int search_base_options[] = { SDAP_SEARCH_BASE,
+ SDAP_USER_SEARCH_BASE,
+ SDAP_GROUP_SEARCH_BASE,
+ SDAP_NETGROUP_SEARCH_BASE,
+ -1 };
+ int o;
+
+
+ for (o = 0; search_base_options[o] != -1; o++) {
+ if (dp_opt_get_string(opts->basic, search_base_options[o]) == NULL) {
+ if (naming_context == NULL) {
+ naming_context = get_naming_context(opts->basic, rootdse);
+ if (naming_context == NULL) {
+ DEBUG(1, ("get_naming_context failed.\n"));
+ ret = EINVAL;
+ goto done;
+ }
+ }
+
+ DEBUG(3, ("Setting option [%s] to [%s].\n",
+ opts->basic[search_base_options[o]].opt_name,
+ naming_context));
+ ret = dp_opt_set_string(opts->basic, search_base_options[o],
+ naming_context);
+ if (ret != EOK) {
+ DEBUG(1, ("dp_opt_set_string failed.\n"));
+ goto done;
+ }
+ }
+ }
+
+ ret = EOK;
+
+done:
+ talloc_free(naming_context);
+ return ret;
+}
+
int build_attrs_from_map(TALLOC_CTX *memctx,
struct sdap_attr_map *map,
size_t size, const char ***_attrs)
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index be4cf8a..cae6510 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -317,4 +317,8 @@ int build_attrs_from_map(TALLOC_CTX *memctx,
int sdap_control_create(struct sdap_handle *sh, const char *oid, int iscritical,
struct berval *value, int dupval, LDAPControl **ctrlp);
+
+errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
+ struct sdap_handle *sh,
+ struct sdap_options *opts);
#endif /* _SDAP_H_ */
diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index fbbec18..0cb9162 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -1277,6 +1277,14 @@ static void sdap_cli_rootdse_done(struct tevent_req *subreq)
return;
}
+ ret = sdap_set_config_options_with_rootdse(rootdse, state->sh,
+ state->opts);
+ if (ret) {
+ DEBUG(1, ("sdap_set_config_options_with_rootdse failed.\n"));
+ tevent_req_error(req, ret);
+ return;
+ }
+
sasl_mech = dp_opt_get_string(state->opts->basic, SDAP_SASL_MECH);
if (sasl_mech && state->use_rootdse) {
--
1.7.2.3
-------------- next part --------------
From 1957baa3e4ec88b769b1acba597f20342737237f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 2 Nov 2010 10:06:31 +0100
Subject: [PATCH 2/2] Make ldap_search_base a non-mandatory option
---
src/config/etc/sssd.api.d/sssd-ldap.conf | 2 +-
src/man/sssd-ldap.5.xml | 19 ++++++++-
src/providers/ldap/ldap_common.c | 60 ++++++++++++-----------------
3 files changed, 42 insertions(+), 39 deletions(-)
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 1af6b0c..404f4d5 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -1,6 +1,6 @@
[provider/ldap]
ldap_uri = str, None, false
-ldap_search_base = str, None, true
+ldap_search_base = str, None, false
ldap_schema = str, None, true, rfc2307
ldap_default_bind_dn = str, None, false
ldap_default_authtok_type = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 8c38ca7..2071eb4 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -76,6 +76,13 @@
The default base DN to use for
performing LDAP user operations.
</para>
+ <para>
+ Default: If not set the value of the namingContexts
+ attribute from the RootDSE of the LDAP server is
+ used. The namingContexts attribute must have a
+ single value with the DN of the search base of the
+ LDAP server to make this work.
+ </para>
</listitem>
</varlistentry>
@@ -1045,7 +1052,9 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
</para>
<para>
Default: the value of
- <emphasis>ldap_search_base</emphasis>
+ <emphasis>ldap_search_base</emphasis> or the value
+ of the namingContexts attribute of the RootDSE of the
+ LDAP server.
</para>
</listitem>
</varlistentry>
@@ -1059,7 +1068,9 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
</para>
<para>
Default: the value of
- <emphasis>ldap_search_base</emphasis>
+ <emphasis>ldap_search_base</emphasis> or the value
+ of the namingContexts attribute of the RootDSE of the
+ LDAP server.
</para>
</listitem>
</varlistentry>
@@ -1073,7 +1084,9 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
</para>
<para>
Default: the value of
- <emphasis>ldap_search_base</emphasis>
+ <emphasis>ldap_search_base</emphasis> or the value
+ of the namingContexts attribute of the RootDSE of the
+ LDAP server.
</para>
</listitem>
</varlistentry>
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 543774b..16693a4 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -34,7 +34,7 @@ int ldap_child_debug_fd = -1;
struct dp_option default_basic_opts[] = {
{ "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
- { "ldap_search_base", DP_OPT_STRING, { "dc=example,dc=com" }, NULL_STRING },
+ { "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
{ "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
@@ -185,12 +185,18 @@ int ldap_get_options(TALLOC_CTX *memctx,
struct sdap_attr_map *default_netgroup_map;
struct sdap_options *opts;
char *schema;
+ const char *search_base;
const char *pwd_policy;
int ret;
int account_cache_expiration;
int offline_credentials_expiration;
const char *ldap_deref;
int ldap_deref_val;
+ int o;
+ const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
+ SDAP_GROUP_SEARCH_BASE,
+ SDAP_NETGROUP_SEARCH_BASE,
+ -1 };
opts = talloc_zero(memctx, struct sdap_options);
if (!opts) return ENOMEM;
@@ -203,41 +209,25 @@ int ldap_get_options(TALLOC_CTX *memctx,
goto done;
}
- /* set user/group/netgroup search bases if they are not */
- if (NULL == dp_opt_get_string(opts->basic, SDAP_USER_SEARCH_BASE)) {
- ret = dp_opt_set_string(opts->basic, SDAP_USER_SEARCH_BASE,
- dp_opt_get_string(opts->basic,
- SDAP_SEARCH_BASE));
- if (ret != EOK) {
- goto done;
- }
- DEBUG(6, ("Option %s set to %s\n",
- opts->basic[SDAP_USER_SEARCH_BASE].opt_name,
- dp_opt_get_string(opts->basic, SDAP_USER_SEARCH_BASE)));
- }
-
- if (NULL == dp_opt_get_string(opts->basic, SDAP_GROUP_SEARCH_BASE)) {
- ret = dp_opt_set_string(opts->basic, SDAP_GROUP_SEARCH_BASE,
- dp_opt_get_string(opts->basic,
- SDAP_SEARCH_BASE));
- if (ret != EOK) {
- goto done;
- }
- DEBUG(6, ("Option %s set to %s\n",
- opts->basic[SDAP_GROUP_SEARCH_BASE].opt_name,
- dp_opt_get_string(opts->basic, SDAP_GROUP_SEARCH_BASE)));
- }
-
- if (NULL == dp_opt_get_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE)) {
- ret = dp_opt_set_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE,
- dp_opt_get_string(opts->basic,
- SDAP_SEARCH_BASE));
- if (ret != EOK) {
- goto done;
+ search_base = dp_opt_get_string(opts->basic, SDAP_SEARCH_BASE);
+ if (search_base != NULL) {
+ /* set user/group/netgroup search bases if they are not */
+ for (o = 0; search_base_options[o] != -1; o++) {
+ if (NULL == dp_opt_get_string(opts->basic, search_base_options[o])) {
+ ret = dp_opt_set_string(opts->basic, search_base_options[o],
+ search_base);
+ if (ret != EOK) {
+ goto done;
+ }
+ DEBUG(6, ("Option %s set to %s\n",
+ opts->basic[search_base_options[o]].opt_name,
+ dp_opt_get_string(opts->basic,
+ search_base_options[o])));
+ }
}
- DEBUG(6, ("Option %s set to %s\n",
- opts->basic[SDAP_NETGROUP_SEARCH_BASE].opt_name,
- dp_opt_get_string(opts->basic, SDAP_NETGROUP_SEARCH_BASE)));
+ } else {
+ DEBUG(5, ("Search base not set, trying to discover it later when "
+ "connecting to the LDAP server.\n"));
}
pwd_policy = dp_opt_get_string(opts->basic, SDAP_PWD_POLICY);
--
1.7.2.3
More information about the sssd-devel
mailing list