[SSSD] [PATCH] ad: support cross domain membership

Jakub Hrozek jhrozek at redhat.com
Fri Oct 25 18:47:59 UTC 2013


On Fri, Oct 25, 2013 at 08:10:18PM +0200, Jakub Hrozek wrote:
> Well, the main reason I didn't like the original patches was that they
> were hardcoding "DC=". Sure, that works for AD, but I don't like these
> hacks in the generic LDAP code.
> 
> Could we modify sdap_domain_get_by_dn() so that it would try to match as
> much as possible?

I meant something like the attached patch.
-------------- next part --------------
>From a40924f1d3e5a641b44939bbe994ad28ec7aefaf Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 25 Oct 2013 20:47:08 +0200
Subject: [PATCH] Choose best match from overlapping domains

---
 src/providers/ldap/ldap_common.c | 32 +++++++++++++++++++++++---------
 src/util/sss_ldap.c              | 21 +++++++++++++++++----
 src/util/sss_ldap.h              |  6 ++++++
 3 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 3a7751f0321df6c10bcb3ff6effa0a519eaa29ce..d93becb8a21ae79d6aeb5b1e730da67d84ba0566 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -68,7 +68,10 @@ sdap_domain_get_by_dn(struct sdap_options *opts,
                       const char *dn)
 {
     struct sdap_domain *sditer = NULL;
+    struct sdap_domain *sdmatch = NULL;
     TALLOC_CTX *tmp_ctx = NULL;
+    int match_len;
+    int best_match_len = 0;
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
@@ -76,19 +79,30 @@ sdap_domain_get_by_dn(struct sdap_options *opts,
     }
 
     DLIST_FOR_EACH(sditer, opts->sdom) {
-        if (sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->user_search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->group_search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->netgroup_search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->sudo_search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->service_search_bases, NULL) ||
-            sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->autofs_search_bases, NULL)) {
-            break;
+        if (sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->search_bases,
+                                            NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->user_search_bases,
+                                                   NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->group_search_bases,
+                                                   NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->netgroup_search_bases,
+                                                   NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->sudo_search_bases,
+                                                   NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->service_search_bases,
+                                                   NULL, &match_len)
+                || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->autofs_search_bases,
+                                                   NULL, &match_len)) {
+            if (best_match_len < match_len) {
+                /* This is a longer match */
+                best_match_len = match_len;
+                sdmatch = sditer;
+            }
         }
     }
 
     talloc_free(tmp_ctx);
-    return sditer;
+    return sdmatch;
 }
 
 
diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c
index 6d7b0907ca2fa48d9cff5257ab6bbba0ae7dd5c6..ac05284fc8e018c1907f68285b00a6a46874badf 100644
--- a/src/util/sss_ldap.c
+++ b/src/util/sss_ldap.c
@@ -470,10 +470,11 @@ int sss_ldap_init_recv(struct tevent_req *req, LDAP **ldap, int *sd)
  * _filter will contain combined filters from all possible search bases
  * or NULL if it should be empty
  */
-bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
-                                 const char *dn,
-                                 struct sdap_search_base **search_bases,
-                                 char **_filter)
+bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx,
+                                     const char *dn,
+                                     struct sdap_search_base **search_bases,
+                                     char **_filter,
+                                     int *_match_len)
 {
     struct sdap_search_base *base;
     int basedn_len, dn_len;
@@ -484,6 +485,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
     bool backslash_found = false;
     char *filter = NULL;
     bool ret = false;
+    int match_len;
 
     if (dn == NULL) {
         DEBUG(SSSDBG_FUNC_DATA, ("dn is NULL\n"));
@@ -511,6 +513,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
         if (!base_confirmed) {
             continue;
         }
+        match_len = basedn_len;
 
         switch (base->scope) {
         case LDAP_SCOPE_BASE:
@@ -558,6 +561,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
          *  Append filter otherwise.
          */
         ret = true;
+        *_match_len = match_len;
 
         if (base->filter == NULL || _filter == NULL) {
             goto done;
@@ -589,6 +593,15 @@ done:
     return ret;
 }
 
+bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
+                                 const char *dn,
+                                 struct sdap_search_base **search_bases,
+                                 char **_filter)
+{
+    return sss_ldap_dn_in_search_bases_len(mem_ctx, dn, search_bases,
+                                           _filter, NULL);
+}
+
 char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags)
 {
     char hex[9]; /* 4 bytes in hex + terminating zero */
diff --git a/src/util/sss_ldap.h b/src/util/sss_ldap.h
index e5c30eb2115d422ef5a52cc5cd75c85be8fbe2d7..f298b2fbb30cf1532f8e94504ffb83ef73880b81 100644
--- a/src/util/sss_ldap.h
+++ b/src/util/sss_ldap.h
@@ -74,6 +74,12 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx,
                                  struct sdap_search_base **search_bases,
                                  char **_filter);
 
+bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx,
+                                     const char *dn,
+                                     struct sdap_search_base **search_bases,
+                                     char **_filter,
+                                     int *_match_len);
+
 char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags);
 
 #endif /* __SSS_LDAP_H__ */
-- 
1.8.3.1



More information about the sssd-devel mailing list