[SSSD] [PATCHES] Changes to AD functional level handling

Jakub Hrozek jhrozek at redhat.com
Thu Aug 28 16:48:22 UTC 2014


Hi,

attached are three patches related to
https://fedorahosted.org/sssd/ticket/2418

The first one simply adds the Windows Server 2012 R2 functional level.

The second falls back to the oldest supported Windows Server in case we
can't convert the the functional level but there is one in the rootDSE.

And finally the last patch relaxes the requirement for tokenGroups.
According to MSFT documentation, tokenGroups is available since Windows
2000, but the oldest release we have around is 2003, so I only
downgraded the requirement to 2003.
-------------- next part --------------
>From 2f8755d056145c4d7cae035fd439d6a008b0fc1c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 27 Aug 2014 17:14:07 +0200
Subject: [PATCH 1/3] LDAP: Add Windows Server 2012 R2 functional level

https://fedorahosted.org/sssd/ticket/2418

According to http://msdn.microsoft.com/en-us/library/cc223272.aspx a
Windows Server 2012 R2 has a functional level set to '6'. We need to
support that value in order for tokenGroups to be functional.

For more information on the functional levels, please refer to:
    http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx
---
 src/providers/ldap/sdap.c | 1 +
 src/providers/ldap/sdap.h | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 9231cc2b0ef0072a8cf168c581d9f69966385e40..56faf51239a8fccb807421f17094f5ba2e17fd35 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -1187,6 +1187,7 @@ int sdap_get_server_opts_from_rootdse(TALLOC_CTX *memctx,
             case DS_BEHAVIOR_WIN2008:
             case DS_BEHAVIOR_WIN2008R2:
             case DS_BEHAVIOR_WIN2012:
+            case DS_BEHAVIOR_WIN2012R2:
                 opts->dc_functional_level = dc_level;
                 DEBUG(SSSDBG_CONF_SETTINGS,
                       "Setting AD compatibility level to [%d]\n",
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index da1471c2f4742aecfc13624e5085ffc5bff972eb..41063149f65ca1035731d14563b9ff953ae5ac63 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -377,7 +377,8 @@ enum dc_functional_level {
     DS_BEHAVIOR_WIN2003 = 2,
     DS_BEHAVIOR_WIN2008 = 3,
     DS_BEHAVIOR_WIN2008R2 = 4,
-    DS_BEHAVIOR_WIN2012 = 5
+    DS_BEHAVIOR_WIN2012 = 5,
+    DS_BEHAVIOR_WIN2012R2 = 6
 };
 
 struct sdap_domain {
-- 
1.9.3

-------------- next part --------------
>From 9f228daebca4f9917f3a3d1575806de0a38b4782 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 27 Aug 2014 17:21:26 +0200
Subject: [PATCH 2/3] LDAP: Fall back to functional level of Windows Server
 2003

The newest functional level we branch for is currently
DS_BEHAVIOR_WIN2003. Therefore (and also because extended support for
Windows server 2003 ends in 2015) we can safely set the functional level
to 2003 if the attribute is present but not a known value.
---
 src/providers/ldap/sdap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 56faf51239a8fccb807421f17094f5ba2e17fd35..f2178dd0ad9a318e6c3ae820a1c7812b353780bc 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -1196,7 +1196,8 @@ int sdap_get_server_opts_from_rootdse(TALLOC_CTX *memctx,
             default:
                 DEBUG(SSSDBG_MINOR_FAILURE,
                       "Received invalid value for AD compatibility level. "
-                       "Continuing without AD performance enhancements\n");
+                      "Using the lowest-common compatibility level\n");
+                opts->dc_functional_level = DS_BEHAVIOR_WIN2003;
             }
         } else if (ret != ENOENT) {
             DEBUG(SSSDBG_MINOR_FAILURE,
-- 
1.9.3

-------------- next part --------------
>From 9b6670e1c568ea76af0875773ab9d0e2c5982698 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Thu, 28 Aug 2014 18:07:52 +0200
Subject: [PATCH 3/3] LDAP: Enable tokenGroups with Windows Server 2003

According to Microsoft documentation, the tokenGroups attribute is
available since Windows 2000:
http://msdn.microsoft.com/en-us/library/cc220937.aspx

We were not able to test against Windows 2000, though, as we don't have
that OS around, so this patch only changes the compatibility level do
2003.
---
 src/providers/ldap/sdap_async_initgroups.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 2eecdf9a3e9a42fdfd101132b0b856540893cee7..62e76cc4ac76fa2edf1de67c0468d2a5e99f9599 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -2907,7 +2907,7 @@ static void sdap_get_initgr_user(struct tevent_req *subreq)
             return;
         }
 
-        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008
+        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
             && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
             /* Take advantage of AD's tokenGroups mechanism to look up all
              * parent groups in a single request.
@@ -3008,7 +3008,7 @@ static void sdap_get_initgr_done(struct tevent_req *subreq)
 
     case SDAP_SCHEMA_RFC2307BIS:
     case SDAP_SCHEMA_AD:
-        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008
+        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
             && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
 
             ret = sdap_ad_tokengroups_initgroups_recv(subreq);
-- 
1.9.3



More information about the sssd-devel mailing list