[SSSD] [PATCH] AD: Always refresh LDAP subdomain list

Jakub Hrozek jhrozek at redhat.com
Tue Dec 17 16:02:07 UTC 2013


On Mon, Dec 16, 2013 at 10:09:58PM +0100, Sumit Bose wrote:
> On Mon, Dec 16, 2013 at 07:05:16PM +0100, Jakub Hrozek wrote:
> > On Mon, Dec 16, 2013 at 07:03:11PM +0100, Jakub Hrozek wrote:
> > > On Mon, Dec 16, 2013 at 12:04:44PM +0100, Sumit Bose wrote:
> > > > On Sat, Dec 14, 2013 at 10:18:32PM +0100, Jakub Hrozek wrote:
> > > > > Hi,
> > > > > 
> > > > > I found this bug when testing the GC patches. Previously, when SSSD was
> > > > > started, but subdomains list was up-to-date, the ad_ctx was not
> > > > > initialized for the subdomain.
> > > > > 
> > > > > I was also thinking whether we should re-initialize the domain-realm
> > > > > mappings after sssd startup, the way we re-initialize kdcinfo files. I
> > > > > don't think it's strictly necessary because if someone deletes a file in
> > > > > /var/lib/sss/pubconf, he should keep the broken pieces, but perhaps we
> > > > > should be at least aware..
> > > > 
> > > > Maybe we can do this during the init phase of the responder? We
> 
> ah, sorry, I had the typo here                          ^^^^^^^^ first.
> I meant to call it during the initialization of the subdomain part of
> the AD and IPA providers.
> 
> bye,
> Sumit

That makes perfect sense :-)

See the attached patch, I moved the code to a separate function.
-------------- next part --------------
>From ecbace46b35f6e2ee3657a72f95f48bc5f8da157 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 13 Dec 2013 19:11:47 +0100
Subject: [PATCH] AD: Always refresh LDAP subdomain list

Previously, if no changes were done to the list of subdomains, the SSSD
didn't update its list of sdap_domain mappings for the new subdomain.
This resulted in errors as no id_ctx was present for the subdomain
during lookup.

This patch moves the block of code performed during update to a function
of its own and calls it during provider initialization as well.
---
 src/providers/ad/ad_subdomains.c | 49 ++++++++++++++++++++++++++--------------
 1 file changed, 32 insertions(+), 17 deletions(-)

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
index 100fb13e99f7bf4b3946b1f5c5f9c626674bfb46..85872be88fa6b44d817819d7240dbd8cb4ca0c85 100644
--- a/src/providers/ad/ad_subdomains.c
+++ b/src/providers/ad/ad_subdomains.c
@@ -414,6 +414,31 @@ done:
     return ret;
 }
 
+static errno_t ad_subdom_reinit(struct ad_subdomains_ctx *ctx)
+{
+    errno_t ret;
+
+    ret = sysdb_update_subdomains(ctx->be_ctx->domain);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_subdomains failed.\n"));
+        return ret;
+    }
+
+    ret = sss_write_domain_mappings(ctx->be_ctx->domain, false);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE, ("sss_krb5_write_mappings failed.\n"));
+        /* Just continue */
+    }
+
+    ret = ads_store_sdap_subdom(ctx, ctx->be_ctx->domain);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("ads_store_sdap_subdom failed.\n"));
+        return ret;
+    }
+
+    return ret;
+}
+
 static void ad_subdomains_get_conn_done(struct tevent_req *req);
 static void ad_subdomains_master_dom_done(struct tevent_req *req);
 static errno_t ad_subdomains_get_slave(struct ad_subdomains_req_ctx *ctx);
@@ -619,25 +644,15 @@ static void ad_subdomains_get_slave_domain_done(struct tevent_req *req)
         goto done;
     }
 
+    DEBUG(SSSDBG_TRACE_LIBS, ("There are %schanges\n",
+                    refresh_has_changes ? "" : "no "));
+
     if (refresh_has_changes) {
-        ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
+        ret = ad_subdom_reinit(ctx->sd_ctx);
         if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_subdomains failed.\n"));
+            DEBUG(SSSDBG_OP_FAILURE, ("Could not reinitialize subdomains\n"));
             goto done;
         }
-
-        ret = ads_store_sdap_subdom(ctx->sd_ctx, ctx->sd_ctx->be_ctx->domain);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, ("ads_store_sdap_subdom failed.\n"));
-            goto done;
-        }
-
-        ret = sss_write_domain_mappings(ctx->sd_ctx->be_ctx->domain, false);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_MINOR_FAILURE,
-                  ("sss_krb5_write_mappings failed.\n"));
-            /* Just continue */
-        }
     }
 
     ret = EOK;
@@ -783,9 +798,9 @@ int ad_subdom_init(struct be_ctx *be_ctx,
         return EFAULT;
     }
 
-    ret = sysdb_update_subdomains(be_ctx->domain);
+    ret = ad_subdom_reinit(ctx);
     if (ret != EOK) {
-        DEBUG(SSSDBG_MINOR_FAILURE, ("Could not load the list of subdomains. "
+        DEBUG(SSSDBG_MINOR_FAILURE, ("Could not reinitialize subdomains. "
               "Users from trusted domains might not be resolved correctly\n"));
         /* Ignore this error and try to discover the subdomains later */
     }
-- 
1.8.4.2



More information about the sssd-devel mailing list