[SSSD] [PATCH] Use AD domain flat name to match domains
Jakub Hrozek
jhrozek at redhat.com
Sun May 5 21:21:19 UTC 2013
Hi,
the attached patch implements the changes described in #1468. The logic
itself is implemented in confdb_get_domain_internal, which breaks the
layering a little because there is some knowledge about the providers
used in the responders, in particular loading the flat name is only
called if the id_provider equals "AD".
Also technically the NetBIOS name could be completely different from the
AD domain name and could have been read from the rootDSE. But honestly
I really don't think it's worth it, so I went with a config option, that
would be unset in the vast majority of deployments.
-------------- next part --------------
>From cfc64322d0427f9d2ffc5681d016091ebf9dffd1 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 5 May 2013 20:36:06 +0200
Subject: [PATCH] Use AD domain flat name to match domains
https://fedorahosted.org/sssd/ticket/1468
This patch adds the possibility to autoconfigure the flat (NetBIOS)
names for the AD provider using the existing ad_domain value. But
because in AD it is possible to use a completely different flat name,
there also is an option to specify the flat name independently of the AD
domain name.
---
src/confdb/confdb.c | 48 ++++++++++++++++++++++++++++++++++
src/confdb/confdb.h | 4 +++
src/config/SSSDConfig/__init__.py.in | 1 +
src/config/etc/sssd.api.d/sssd-ad.conf | 1 +
src/man/sssd-ad.5.xml | 14 ++++++++++
src/providers/ad/ad_opts.h | 1 +
6 files changed, 69 insertions(+)
diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index e1888678eaf45446a89c4a290d55356deae0afdf..6e6f73a98330926f9698581563a80a3758c3b42f 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -864,6 +864,54 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
domain->mpg = true;
}
+ /* Load AD specific configuration for the responders */
+ if (strcasecmp(domain->provider, "ad") == 0) {
+ const char *flat_name;
+
+ /* Check if there is a flat name configured. If so, use it. */
+ flat_name = ldb_msg_find_attr_as_string(res->msgs[0],
+ CONFDB_AD_FLAT_NAME,
+ NULL);
+ if (flat_name == NULL) {
+ char *dotname;
+
+ /* Otherwise get the domain name */
+ tmp = ldb_msg_find_attr_as_string(res->msgs[0],
+ CONFDB_AD_DOM_NAME,
+ domain->name);
+ if (tmp == NULL) {
+ /* No domain name set? */
+ ret = EINVAL;
+ goto done;
+ }
+
+ flat_name = talloc_strdup(tmp_ctx, tmp);
+ if (flat_name == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ /* Use the domain name up until the first dot. However, an AD
+ * domain w/o a dot is still a legal setting
+ */
+ dotname = strchr(flat_name, '.');
+ if (dotname) {
+ *dotname = '\0';
+ }
+ }
+
+ domain->flat_name = talloc_strdup(domain, flat_name);
+ if (domain->flat_name == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ if (strlen(domain->flat_name) > 15) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("The flat name of AD domain"
+ "is longer than the 15 character limit\n"));
+ }
+ }
+
domain->timeout = ldb_msg_find_attr_as_int(res->msgs[0],
CONFDB_DOMAIN_TIMEOUT, 0);
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 1d9647394ce59f12f59d55f22c6d42e669c39a11..a8c034d6d95e860b7f4a0c50087ec569057f2084 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -183,6 +183,10 @@
#define CONFDB_PROXY_PAM_TARGET "proxy_pam_target"
#define CONFDB_PROXY_FAST_ALIAS "proxy_fast_alias"
+/* AD Provider */
+#define CONFDB_AD_DOM_NAME "ad_domain"
+#define CONFDB_AD_FLAT_NAME "ad_flat_domain"
+
struct confdb_ctx;
struct config_file_ctx;
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index bc7bb0a781a64b264d350a7766cf45de869273cf..3f3e2c64a3cd5096624990f6113bc66dce533ac1 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -153,6 +153,7 @@ option_strings = {
# [provider/ad]
'ad_domain' : _('Active Directory domain'),
+ 'ad_flat_domain' : _('Active Directory flat domain name'),
'ad_server' : _('Active Directory server address'),
'ad_backup_server' : _('Active Directory backup server address'),
'ad_hostname' : _('Active Directory client hostname'),
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index b4b1d0ba11d600a8b9a300f15cc8058be470f422..08d8f63a860995fbba545f7d3e441043bc6382f0 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -1,5 +1,6 @@
[provider/ad]
ad_domain = str, None, false
+ad_flat_domain = str, None, false
ad_server = str, None, false
ad_backup_server = str, None, false
ad_hostname = str, None, false
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index c19607715dafd39f167c3066831ae7ad09ffe459..5b946e536125118416ada73e2b66f5331e1a9979 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -99,6 +99,20 @@ ldap_id_mapping = False
</varlistentry>
<varlistentry>
+ <term>ad_flat_domain (string)</term>
+ <listitem>
+ <para>
+ Specifies the flat (NetBIOS) name of the
+ Active Directory domain. This parameter is
+ optional. If not provided, the ad_domain value
+ up to the first dot is used.
+ </para>
+ <para>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>ad_server, ad_backup_server (string)</term>
<listitem>
<para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 32bbe3db2f4048056c7e96619eaf53ce22bf52f8..3be2f5882458079f64185067d0f35c8b962425cc 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -29,6 +29,7 @@
struct dp_option ad_basic_opts[] = {
{ "ad_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+ { "ad_flat_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ad_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ad_backup_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "ad_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING },
--
1.8.2.1
More information about the sssd-devel
mailing list