[SSSD] [PATCH] LDAP: Try all attributes when saving an entry

Jakub Hrozek jhrozek at redhat.com
Wed Oct 23 11:21:48 UTC 2013


Hi,

this bug was reported on #sssd by a user. He was running some flavor of
IBM Tivoli where the entries only had an "ID", not separate "UID" and
"GID". But due to a bug in sssd he couldn't use the same value for both,
this configuration:

ldap_user_uid_number = idAttribute
ldap_user_gid_number = idAttribute

only saved the ID into UID and left GID empty. It appears we have a long
standing bug in sdap_parse where we only consider first match. If this
patch is accepted, I would also like to refactor sdap_parse in master
because currently it is a 250-lines long function with multiple
branches..
-------------- next part --------------
>From 4dfca430bdf6e78f05bfc41b3a31a148f4b1ceb6 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 21 Oct 2013 17:24:16 +0200
Subject: [PATCH] LDAP: Try all attributes when saving an entry

The same LDAP attribute might be used several times for the same user or
group attribute. For instance, some servers have a global "ID" number
that should be used for both UID and GID. However, our
sdap_parse_entry() function only copied the LDAP attribute to the first
matching sysdb attribute.

This patch adds a second nested loop that checks if any of the other
LDAP attributes are eligible.
---
 src/providers/ldap/sdap.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 078326ad3614ed2cd41659ea279642a46a0e24e1..3c118009c2bde57629234a6cc700233c4f9d032f 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -144,7 +144,7 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
     struct ldb_val v;
     char *str;
     int lerrno;
-    int a, i, ret;
+    int a, i, ret, ai;
     const char *name;
     bool store;
     bool base64;
@@ -319,8 +319,18 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
                         v.length = vals[i]->bv_len;
                     }
 
-                    ret = sysdb_attrs_add_val(attrs, name, &v);
-                    if (ret) goto done;
+                    /* The same LDAP attr might be used for more sysdb attrs.
+                     * Find all that match and copy the value
+                     */
+                    for (ai = a; ai < attrs_num; ai++) {
+                        /* check if this attr is valid with the chosen schema */
+                        if (!map[ai].name) continue;
+                        /* check if it is an attr we are interested in */
+                        if (strcasecmp(base_attr, map[ai].name) == 0) {
+                            ret = sysdb_attrs_add_val(attrs, map[ai].sys_name, &v);
+                            if (ret) goto done;
+                        }
+                    }
                 }
                 ldap_value_free_len(vals);
             }
-- 
1.8.3.1



More information about the sssd-devel mailing list