[SSSD] [PATCH] ad: support cross domain membership
Jakub Hrozek
jhrozek at redhat.com
Fri Oct 25 18:47:59 UTC 2013
On Fri, Oct 25, 2013 at 08:10:18PM +0200, Jakub Hrozek wrote:
> Well, the main reason I didn't like the original patches was that they
> were hardcoding "DC=". Sure, that works for AD, but I don't like these
> hacks in the generic LDAP code.
>
> Could we modify sdap_domain_get_by_dn() so that it would try to match as
> much as possible?
I meant something like the attached patch.
-------------- next part --------------
>From a40924f1d3e5a641b44939bbe994ad28ec7aefaf Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 25 Oct 2013 20:47:08 +0200
Subject: [PATCH] Choose best match from overlapping domains
---
src/providers/ldap/ldap_common.c | 32 +++++++++++++++++++++++---------
src/util/sss_ldap.c | 21 +++++++++++++++++----
src/util/sss_ldap.h | 6 ++++++
3 files changed, 46 insertions(+), 13 deletions(-)
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 3a7751f0321df6c10bcb3ff6effa0a519eaa29ce..d93becb8a21ae79d6aeb5b1e730da67d84ba0566 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -68,7 +68,10 @@ sdap_domain_get_by_dn(struct sdap_options *opts,
const char *dn)
{
struct sdap_domain *sditer = NULL;
+ struct sdap_domain *sdmatch = NULL;
TALLOC_CTX *tmp_ctx = NULL;
+ int match_len;
+ int best_match_len = 0;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
@@ -76,19 +79,30 @@ sdap_domain_get_by_dn(struct sdap_options *opts,
}
DLIST_FOR_EACH(sditer, opts->sdom) {
- if (sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->user_search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->group_search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->netgroup_search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->sudo_search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->service_search_bases, NULL) ||
- sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->autofs_search_bases, NULL)) {
- break;
+ if (sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->user_search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->group_search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->netgroup_search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->sudo_search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->service_search_bases,
+ NULL, &match_len)
+ || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->autofs_search_bases,
+ NULL, &match_len)) {
+ if (best_match_len < match_len) {
+ /* This is a longer match */
+ best_match_len = match_len;
+ sdmatch = sditer;
+ }
}
}
talloc_free(tmp_ctx);
- return sditer;
+ return sdmatch;
}
diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c
index 6d7b0907ca2fa48d9cff5257ab6bbba0ae7dd5c6..ac05284fc8e018c1907f68285b00a6a46874badf 100644
--- a/src/util/sss_ldap.c
+++ b/src/util/sss_ldap.c
@@ -470,10 +470,11 @@ int sss_ldap_init_recv(struct tevent_req *req, LDAP **ldap, int *sd)
* _filter will contain combined filters from all possible search bases
* or NULL if it should be empty
*/
-bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
- const char *dn,
- struct sdap_search_base **search_bases,
- char **_filter)
+bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx,
+ const char *dn,
+ struct sdap_search_base **search_bases,
+ char **_filter,
+ int *_match_len)
{
struct sdap_search_base *base;
int basedn_len, dn_len;
@@ -484,6 +485,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
bool backslash_found = false;
char *filter = NULL;
bool ret = false;
+ int match_len;
if (dn == NULL) {
DEBUG(SSSDBG_FUNC_DATA, ("dn is NULL\n"));
@@ -511,6 +513,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
if (!base_confirmed) {
continue;
}
+ match_len = basedn_len;
switch (base->scope) {
case LDAP_SCOPE_BASE:
@@ -558,6 +561,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
* Append filter otherwise.
*/
ret = true;
+ *_match_len = match_len;
if (base->filter == NULL || _filter == NULL) {
goto done;
@@ -589,6 +593,15 @@ done:
return ret;
}
+bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
+ const char *dn,
+ struct sdap_search_base **search_bases,
+ char **_filter)
+{
+ return sss_ldap_dn_in_search_bases_len(mem_ctx, dn, search_bases,
+ _filter, NULL);
+}
+
char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags)
{
char hex[9]; /* 4 bytes in hex + terminating zero */
diff --git a/src/util/sss_ldap.h b/src/util/sss_ldap.h
index e5c30eb2115d422ef5a52cc5cd75c85be8fbe2d7..f298b2fbb30cf1532f8e94504ffb83ef73880b81 100644
--- a/src/util/sss_ldap.h
+++ b/src/util/sss_ldap.h
@@ -74,6 +74,12 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
struct sdap_search_base **search_bases,
char **_filter);
+bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx,
+ const char *dn,
+ struct sdap_search_base **search_bases,
+ char **_filter,
+ int *_match_len);
+
char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags);
#endif /* __SSS_LDAP_H__ */
--
1.8.3.1
More information about the sssd-devel
mailing list