[SSSD] Ticket #1376 -- Add support for suppressing group members

Paul B. Henson henson at acm.org
Thu Nov 15 18:47:10 UTC 2012


On 11/15/2012 5:45 AM, Stephen Gallagher wrote:

> This is obviously already a significant enhancement, and of course the
> difference will be more pronounced for much larger environments. I'm
> prepared to give this an ack, with one comment to whoever pushes the
> patch upstream: please reflow the changes in nsssrv_cmd.c's fill_grent()
> that are now exceeding the 80-character line limit due to the new
> indentation.

Hmm, I see a few other lines in that file that exceed 80 characters; are 
there scenarios where there is an exception to that limit or were those 
just not caught ;)?

It looks like there were only two lines in my diff for that file that 
exceeded 80 characters, the attached updated patch should fix that.

Thanks for the ack. Will this just go into head or will it be pushed 
back to the 1.9 branch? I've got an open RHEL support ticket requesting 
this be back ported to RHEL 6, given they're supposed to be shipping 1.9 
in RHEL 6.4, it might be easier to get them to include it if it becomes 
part of the 1.9 branch :). Or if whoever commits this "accidentally" 
slips it into the RHEL 6 repo while they're twiddling bits ;)...

-------------- next part --------------
From 9afcdda5edfbc254b7f385aa18769f3505c3b24b Mon Sep 17 00:00:00 2001
From: "Paul B. Henson" <henson at acm.org>
Date: Tue, 13 Nov 2012 03:31:43 -0800
Subject: [PATCH] Add ignore_group_members option.

---
 src/confdb/confdb.c                    |  9 +++++++++
 src/confdb/confdb.h                    |  2 ++
 src/config/SSSDConfig/__init__.py.in   |  1 +
 src/config/SSSDConfigTest.py           |  2 ++
 src/config/etc/sssd.api.conf           |  1 +
 src/man/sssd.conf.5.xml                | 17 +++++++++++++++++
 src/providers/ldap/ldap_id.c           |  9 ++++++++-
 src/providers/ldap/sdap_async_groups.c |  6 +++++-
 src/responder/nss/nsssrv_cmd.c         | 35 ++++++++++++++++++----------------
 9 files changed, 64 insertions(+), 18 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index 13035a4..3707f18 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -894,6 +894,15 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
         goto done;
     }
 
+    ret = get_entry_as_bool(res->msgs[0], &domain->ignore_group_members,
+                            CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS, 0);
+    if(ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              ("Invalid value for %s\n",
+               CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS));
+        goto done;
+    }
+
     ret = get_entry_as_uint32(res->msgs[0], &domain->id_min,
                               CONFDB_DOMAIN_MINID,
                               confdb_get_min_id(domain));
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 88e80c1..eb16d01 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -162,6 +162,7 @@
 #define CONFDB_DOMAIN_CASE_SENSITIVE "case_sensitive"
 #define CONFDB_DOMAIN_SUBDOMAIN_HOMEDIR "subdomain_homedir"
 #define CONFDB_DOMAIN_DEFAULT_SUBDOMAIN_HOMEDIR "/home/%d/%u"
+#define CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS "ignore_group_members"
 
 #define CONFDB_DOMAIN_USER_CACHE_TIMEOUT "entry_cache_user_timeout"
 #define CONFDB_DOMAIN_GROUP_CACHE_TIMEOUT "entry_cache_group_timeout"
@@ -200,6 +201,7 @@ struct sss_domain_info {
     int timeout;
     bool enumerate;
     bool fqnames;
+    bool ignore_group_members;
     uint32_t id_min;
     uint32_t id_max;
 
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 9bd6995..fd54c7b 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -111,6 +111,7 @@ option_strings = {
     'cache_credentials' : _('Cache credentials for offline login'),
     'store_legacy_passwords' : _('Store password hashes'),
     'use_fully_qualified_names' : _('Display users/groups in fully-qualified form'),
+    'ignore_group_members' : _('Don\'t include group members in group lookups'),
     'entry_cache_timeout' : _('Entry cache timeout length (seconds)'),
     'lookup_family_order' : _('Restrict or prefer a specific address family when performing DNS lookups'),
     'account_cache_expiration' : _('How long to keep cached entries after last successful login (days)'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 9a05dca..8f003f5 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -493,6 +493,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'cache_credentials',
             'store_legacy_passwords',
             'use_fully_qualified_names',
+            'ignore_group_members',
             'filter_users',
             'filter_groups',
             'entry_cache_timeout',
@@ -833,6 +834,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'cache_credentials',
             'store_legacy_passwords',
             'use_fully_qualified_names',
+            'ignore_group_members',
             'filter_users',
             'filter_groups',
             'entry_cache_timeout',
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 48fe7eb..3ed9d58 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -97,6 +97,7 @@ force_timeout = int, None, false
 cache_credentials = bool, None, false
 store_legacy_passwords = bool, None, false
 use_fully_qualified_names = bool, None, false
+ignore_group_members = bool, None, false
 entry_cache_timeout = int, None, false
 lookup_family_order = str, None, false
 account_cache_expiration = int, None, false
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 33d99c7..985397d 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -1203,6 +1203,23 @@ override_homedir = /home/%u
                     </listitem>
                 </varlistentry>
                 <varlistentry>
+                    <term>ignore_group_members (bool)</term>
+                    <listitem>
+                        <para>
+                            Do not return group members for group lookups.
+                        </para>
+                        <para>
+                            If set to TRUE, the group membership attribute
+                            is not requested from the ldap server, and
+                            group members are not returned when processing
+                            group lookup calls.
+                        </para>
+                        <para>
+                            Default: FALSE
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
                     <term>auth_provider (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index b8520df..0c2d63d 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -340,6 +340,7 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
     enum idmap_error_code err;
     char *sid;
     bool use_id_mapping = dp_opt_get_bool(ctx->opts->basic, SDAP_ID_MAPPING);
+    const char *member_filter[2];
 
     req = tevent_req_create(memctx, &state, struct groups_get_state);
     if (!req) return NULL;
@@ -438,9 +439,15 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
+    member_filter[0] = (const char *)ctx->opts->group_map[SDAP_AT_GROUP_MEMBER].name;
+    member_filter[1] = NULL;
+
     /* TODO: handle attrs_type */
     ret = build_attrs_from_map(state, ctx->opts->group_map, SDAP_OPTS_GROUP,
-                               NULL, &state->attrs, NULL);
+                               state->domain->ignore_group_members ?
+                                   (const char **)member_filter : NULL,
+                               &state->attrs, NULL);
+
     if (ret != EOK) goto fail;
 
     ret = groups_get_retry(req);
diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index f0185e4..67dddae 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -1648,8 +1648,12 @@ static void sdap_get_groups_done(struct tevent_req *subreq)
     if (state->check_count == 0) {
         DEBUG(9, ("All groups processed\n"));
 
+        /* If ignore_group_members is set for the domain, don't update
+         * group memberships in the cache.
+         */
         ret = sdap_save_groups(state, state->sysdb, state->dom, state->opts,
-                               state->groups, state->count, true, NULL,
+                               state->groups, state->count,
+                               !state->dom->ignore_group_members, NULL,
                                &state->higher_usn);
         if (ret) {
             DEBUG(2, ("Failed to store groups.\n"));
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 036e88f..a453e59 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -2035,24 +2035,27 @@ static int fill_grent(struct sss_packet *packet,
                                             pwfield.str, pwfield.len);
 
         memnum = 0;
-        el = ldb_msg_find_element(msg, SYSDB_MEMBERUID);
-        if (el) {
-            ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
-            if (ret != EOK) {
-                num = 0;
-                goto done;
+        if (!dom->ignore_group_members) {
+            el = ldb_msg_find_element(msg, SYSDB_MEMBERUID);
+            if (el) {
+                ret = fill_members(packet, dom, nctx, el, &rzero, &rsize,
+                                   &memnum);
+                if (ret != EOK) {
+                    num = 0;
+                    goto done;
+                }
+                sss_packet_get_body(packet, &body, &blen);
             }
-            sss_packet_get_body(packet, &body, &blen);
-        }
-
-        el = ldb_msg_find_element(msg, SYSDB_GHOST);
-        if (el) {
-            ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum);
-            if (ret != EOK) {
-                num = 0;
-                goto done;
+            el = ldb_msg_find_element(msg, SYSDB_GHOST);
+            if (el) {
+                ret = fill_members(packet, dom, nctx, el, &rzero, &rsize,
+                                   &memnum);
+                if (ret != EOK) {
+                    num = 0;
+                    goto done;
+                }
+                sss_packet_get_body(packet, &body, &blen);
             }
-            sss_packet_get_body(packet, &body, &blen);
         }
         if (memnum) {
             /* set num of members */
-- 
1.7.11.7


More information about the sssd-devel mailing list