[SSSD] Ticket #1376 -- Add support for suppressing group members

Paul B. Henson henson at acm.org
Wed Nov 14 23:39:06 UTC 2012


On 11/14/2012 1:41 PM, Stephen Gallagher wrote:

> Minor: Please use the new SSSDBG macros in confdb_get_domain_internal().
> You don't need to update the existing code, but all new code should use
> the macros. See util.h for a listing of them.

Done.

> ../src/providers/ldap/sdap.h:481:5: note: expected 'const char **' but
> argument is of type 'char **'

Fixed.

> You need to add 'ignore_group_members' to the tuple of expected values
> in the test in SSSDConfigTest.py

D'oh, I actually had an open editor buffer with that change in it that 
it seems I lost track of and never saved 8-/.

> Please indent the rest of the ?: structure so that it's clear that
> member_filter : NULL is part of the above. &state->attrs, NULL should be
> on the next line. It'll read easier that way.

Done.

> !state->dom->ignore_group_members with a comment as to what that means?
> The if-then-else construct is a bit confusing there.

Good suggestion, I guess I had just had ternaries on my mind from the 
previous use :).

> nsssrv_cmd.c has added a tab at the beginning of the line
> if (!dom->ignore_group_members) {

Oops, I try to play chameleon when working on other people's code bases 
but I guess my editor slipped that one past me.

I've attached an updated patch that I believe addresses all of your 
issues, let me know if I missed something or anything else needs a tuneup.

Thanks...
-------------- next part --------------
From 225f95fc30f4a231b1b43c360f9d0b869f4ee62b Mon Sep 17 00:00:00 2001
From: "Paul B. Henson" <henson at acm.org>
Date: Tue, 13 Nov 2012 03:31:43 -0800
Subject: [PATCH] Add ignore_group_members option.

---
 src/confdb/confdb.c                    |  9 +++++++++
 src/confdb/confdb.h                    |  2 ++
 src/config/SSSDConfig/__init__.py.in   |  1 +
 src/config/SSSDConfigTest.py           |  2 ++
 src/config/etc/sssd.api.conf           |  1 +
 src/man/sssd.conf.5.xml                | 17 +++++++++++++++++
 src/providers/ldap/ldap_id.c           |  9 ++++++++-
 src/providers/ldap/sdap_async_groups.c |  6 +++++-
 src/responder/nss/nsssrv_cmd.c         | 33 +++++++++++++++++----------------
 9 files changed, 62 insertions(+), 18 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index 13035a4..3707f18 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -894,6 +894,15 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
         goto done;
     }
 
+    ret = get_entry_as_bool(res->msgs[0], &domain->ignore_group_members,
+                            CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS, 0);
+    if(ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              ("Invalid value for %s\n",
+               CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS));
+        goto done;
+    }
+
     ret = get_entry_as_uint32(res->msgs[0], &domain->id_min,
                               CONFDB_DOMAIN_MINID,
                               confdb_get_min_id(domain));
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 88e80c1..eb16d01 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -162,6 +162,7 @@
 #define CONFDB_DOMAIN_CASE_SENSITIVE "case_sensitive"
 #define CONFDB_DOMAIN_SUBDOMAIN_HOMEDIR "subdomain_homedir"
 #define CONFDB_DOMAIN_DEFAULT_SUBDOMAIN_HOMEDIR "/home/%d/%u"
+#define CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS "ignore_group_members"
 
 #define CONFDB_DOMAIN_USER_CACHE_TIMEOUT "entry_cache_user_timeout"
 #define CONFDB_DOMAIN_GROUP_CACHE_TIMEOUT "entry_cache_group_timeout"
@@ -200,6 +201,7 @@ struct sss_domain_info {
     int timeout;
     bool enumerate;
     bool fqnames;
+    bool ignore_group_members;
     uint32_t id_min;
     uint32_t id_max;
 
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 9bd6995..fd54c7b 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -111,6 +111,7 @@ option_strings = {
     'cache_credentials' : _('Cache credentials for offline login'),
     'store_legacy_passwords' : _('Store password hashes'),
     'use_fully_qualified_names' : _('Display users/groups in fully-qualified form'),
+    'ignore_group_members' : _('Don\'t include group members in group lookups'),
     'entry_cache_timeout' : _('Entry cache timeout length (seconds)'),
     'lookup_family_order' : _('Restrict or prefer a specific address family when performing DNS lookups'),
     'account_cache_expiration' : _('How long to keep cached entries after last successful login (days)'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 9a05dca..8f003f5 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -493,6 +493,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'cache_credentials',
             'store_legacy_passwords',
             'use_fully_qualified_names',
+            'ignore_group_members',
             'filter_users',
             'filter_groups',
             'entry_cache_timeout',
@@ -833,6 +834,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'cache_credentials',
             'store_legacy_passwords',
             'use_fully_qualified_names',
+            'ignore_group_members',
             'filter_users',
             'filter_groups',
             'entry_cache_timeout',
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 48fe7eb..3ed9d58 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -97,6 +97,7 @@ force_timeout = int, None, false
 cache_credentials = bool, None, false
 store_legacy_passwords = bool, None, false
 use_fully_qualified_names = bool, None, false
+ignore_group_members = bool, None, false
 entry_cache_timeout = int, None, false
 lookup_family_order = str, None, false
 account_cache_expiration = int, None, false
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 33d99c7..985397d 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -1203,6 +1203,23 @@ override_homedir = /home/%u
                     </listitem>
                 </varlistentry>
                 <varlistentry>
+                    <term>ignore_group_members (bool)</term>
+                    <listitem>
+                        <para>
+                            Do not return group members for group lookups.
+                        </para>
+                        <para>
+                            If set to TRUE, the group membership attribute
+                            is not requested from the ldap server, and
+                            group members are not returned when processing
+                            group lookup calls.
+                        </para>
+                        <para>
+                            Default: FALSE
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
                     <term>auth_provider (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index b8520df..0c2d63d 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -340,6 +340,7 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
     enum idmap_error_code err;
     char *sid;
     bool use_id_mapping = dp_opt_get_bool(ctx->opts->basic, SDAP_ID_MAPPING);
+    const char *member_filter[2];
 
     req = tevent_req_create(memctx, &state, struct groups_get_state);
     if (!req) return NULL;
@@ -438,9 +439,15 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
+    member_filter[0] = (const char *)ctx->opts->group_map[SDAP_AT_GROUP_MEMBER].name;
+    member_filter[1] = NULL;
+
     /* TODO: handle attrs_type */
     ret = build_attrs_from_map(state, ctx->opts->group_map, SDAP_OPTS_GROUP,
-                               NULL, &state->attrs, NULL);
+                               state->domain->ignore_group_members ?
+                                   (const char **)member_filter : NULL,
+                               &state->attrs, NULL);
+
     if (ret != EOK) goto fail;
 
     ret = groups_get_retry(req);
diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index f0185e4..67dddae 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -1648,8 +1648,12 @@ static void sdap_get_groups_done(struct tevent_req *subreq)
     if (state->check_count == 0) {
         DEBUG(9, ("All groups processed\n"));
 
+        /* If ignore_group_members is set for the domain, don't update
+         * group memberships in the cache.
+         */
         ret = sdap_save_groups(state, state->sysdb, state->dom, state->opts,
-                               state->groups, state->count, true, NULL,
+                               state->groups, state->count,
+                               !state->dom->ignore_group_members, NULL,
                                &state->higher_usn);
         if (ret) {
             DEBUG(2, ("Failed to store groups.\n"));
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 036e88f..b33c7b2 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -2035,24 +2035,25 @@ static int fill_grent(struct sss_packet *packet,
                                             pwfield.str, pwfield.len);
 
         memnum = 0;
-        el = ldb_msg_find_element(msg, SYSDB_MEMBERUID);
-        if (el) {
-            ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
-            if (ret != EOK) {
-                num = 0;
-                goto done;
+        if (!dom->ignore_group_members) {
+            el = ldb_msg_find_element(msg, SYSDB_MEMBERUID);
+            if (el) {
+                ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
+                if (ret != EOK) {
+                    num = 0;
+                    goto done;
+                }
+                sss_packet_get_body(packet, &body, &blen);
             }
-            sss_packet_get_body(packet, &body, &blen);
-        }
-
-        el = ldb_msg_find_element(msg, SYSDB_GHOST);
-        if (el) {
-            ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
-            if (ret != EOK) {
-                num = 0;
-                goto done;
+            el = ldb_msg_find_element(msg, SYSDB_GHOST);
+            if (el) {
+                ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
+                if (ret != EOK) {
+                    num = 0;
+                    goto done;
+                }
+                sss_packet_get_body(packet, &body, &blen);
             }
-            sss_packet_get_body(packet, &body, &blen);
         }
         if (memnum) {
             /* set num of members */
-- 
1.7.11.7


More information about the sssd-devel mailing list