[SSSD] [PATCH] LDAP: Try all attributes when saving an entry
Jakub Hrozek
jhrozek at redhat.com
Wed Oct 23 11:21:48 UTC 2013
Hi,
this bug was reported on #sssd by a user. He was running some flavor of
IBM Tivoli where the entries only had an "ID", not separate "UID" and
"GID". But due to a bug in sssd he couldn't use the same value for both,
this configuration:
ldap_user_uid_number = idAttribute
ldap_user_gid_number = idAttribute
only saved the ID into UID and left GID empty. It appears we have a long
standing bug in sdap_parse where we only consider first match. If this
patch is accepted, I would also like to refactor sdap_parse in master
because currently it is a 250-lines long function with multiple
branches..
-------------- next part --------------
>From 4dfca430bdf6e78f05bfc41b3a31a148f4b1ceb6 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 21 Oct 2013 17:24:16 +0200
Subject: [PATCH] LDAP: Try all attributes when saving an entry
The same LDAP attribute might be used several times for the same user or
group attribute. For instance, some servers have a global "ID" number
that should be used for both UID and GID. However, our
sdap_parse_entry() function only copied the LDAP attribute to the first
matching sysdb attribute.
This patch adds a second nested loop that checks if any of the other
LDAP attributes are eligible.
---
src/providers/ldap/sdap.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 078326ad3614ed2cd41659ea279642a46a0e24e1..3c118009c2bde57629234a6cc700233c4f9d032f 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -144,7 +144,7 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
struct ldb_val v;
char *str;
int lerrno;
- int a, i, ret;
+ int a, i, ret, ai;
const char *name;
bool store;
bool base64;
@@ -319,8 +319,18 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
v.length = vals[i]->bv_len;
}
- ret = sysdb_attrs_add_val(attrs, name, &v);
- if (ret) goto done;
+ /* The same LDAP attr might be used for more sysdb attrs.
+ * Find all that match and copy the value
+ */
+ for (ai = a; ai < attrs_num; ai++) {
+ /* check if this attr is valid with the chosen schema */
+ if (!map[ai].name) continue;
+ /* check if it is an attr we are interested in */
+ if (strcasecmp(base_attr, map[ai].name) == 0) {
+ ret = sysdb_attrs_add_val(attrs, map[ai].sys_name, &v);
+ if (ret) goto done;
+ }
+ }
}
ldap_value_free_len(vals);
}
--
1.8.3.1
More information about the sssd-devel
mailing list