[SSSD] [PATCH] Look up originalDN if not available during LDAP auth

Pavel Březina pbrezina at redhat.com
Wed Nov 20 14:13:15 UTC 2013


On 11/12/2013 12:19 PM, Jakub Hrozek wrote:
> On Tue, Nov 05, 2013 at 02:32:29PM +0100, Pavel Březina wrote:
>> On 10/01/2013 09:03 PM, Jakub Hrozek wrote:
>>> Hi,
>>>
>>> the attached two patches fix #2077. I wrote the patches even though
>>> there are unresolved 1.11 issues because there was a customer looking
>>> for a test package.
>>
>> Patch 1: Ack.
>>
>> Patch 2: Nack.
>>
>>> static struct tevent_req *get_user_dn_send(TALLOC_CTX *memctx,
>>>                                            struct tevent_context *ev,
>>>                                            struct sss_domain_info *domain,
>>>                                            struct sdap_handle *sh,
>>>                                            struct sdap_options *opts,
>>>                                            const char *username)
>>> {
>>>     struct tevent_req *req;
>>>     struct tevent_req *subreq;
>>>     struct get_user_dn_state *state;
>>>     char *clean_name;
>>>     char *filter;
>>>     const char **attrs;
>>>     errno_t ret;
>>>
>>>     req = tevent_req_create(memctx, &state, struct get_user_dn_state);
>>>     if (!req) return NULL;
>>>
>>>     state->username = username;
>>
>> Input string should be strdupped to be safe, due to asynchronous
>> nature of the request.
>
> This is not necessary, get_user_dn_send is a specialized one-time
> request and the username will always be allocated on top of the parent
> request. We already do too many allocations.
>
>>
>>> static void get_user_dn_done(struct tevent_req *subreq)
>>> {
>>>     errno_t ret;
>>>     struct tevent_req *req = tevent_req_callback_data(subreq,
>>>                                                       struct tevent_req);
>>>     struct get_user_dn_state *state = tevent_req_data(req,
>>>                                                     struct get_user_dn_state);
>>>     struct ldb_message_element *el;
>>>     struct sysdb_attrs **users;
>>>     size_t count;
>>>
>>>     ret = sdap_search_user_recv(state, subreq, NULL, &users, &count);
>>>     talloc_zfree(subreq);
>>>     if (ret && ret != ENOENT) {
>>>         DEBUG(SSSDBG_OP_FAILURE, ("Failed to retrieve users\n"));
>>>         tevent_req_error(req, ret);
>>>         return;
>>>     }
>>>
>>>     if (count == 0) {
>>>         DEBUG(SSSDBG_OP_FAILURE, ("No such user\n"));
>>>         tevent_req_error(req, ENOMEM);
>>>         return;
>>>     } else if (count > 1) {
>>>         DEBUG(SSSDBG_OP_FAILURE, ("Multiple users matched\n"));
>>>         tevent_req_error(req, EIO);
>>>         return;
>>>     }
>>>
>>>     /* exactly one user. Get the originalDN */
>>>     ret = sysdb_attrs_get_el(users[0], SYSDB_ORIG_DN, &el);
>>>     if (ret || el == NULL || el->num_values == 0) {
>>>         DEBUG(SSSDBG_OP_FAILURE,
>>>               ("originalDN is not available for [%s].\n", state->username));
>>>
>>>         tevent_req_error(req, ret ? ret : EIO);
>>>         return;
>>>     }
>>
>> You can use directly sysdb_attrs_get_el_ext() with alloc param set
>> to false. That will make error handling easier.
>
> Done, the code indeed looks better now.

Ack.




More information about the sssd-devel mailing list