[SSSD] [PATCH] IPA: verify group memberships of trusted domain users

Sumit Bose sbose at redhat.com
Fri Dec 12 10:04:46 UTC 2014


Hi,

This patch tries to assure on IPA clients that users from trusted
domains are really belong ot all groups they are member of and should
fix https://fedorahosted.org/sssd/ticket/2529 .

bye,
Sumit
-------------- next part --------------
From 57f82b2f316d78b1971d6d045c6662a54fe8a6a6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 11 Dec 2014 10:49:39 +0100
Subject: [PATCH] IPA: verify group memberships of trusted domain users

Depending on the state of the cache group object a freshly created or
updates user entry for a trusted domain user might already be a member
of the group or not. This cache makes sure the requested user is a
member of all groups returned from the extdom request.

Resolves https://fedorahosted.org/sssd/ticket/2529
---
 src/providers/ipa/ipa_s2n_exop.c | 56 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 6fc9b8502b8704634ac629abc0ee925998e5b227..e5af61ce2715ff0042275061ecb6a795096a16ac 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -568,7 +568,7 @@ static errno_t add_v1_user_data(BerElement *ber, struct resp_attrs *attrs)
          attrs->ngroups++);
 
     if (attrs->ngroups > 0) {
-        attrs->groups = talloc_array(attrs, char *, attrs->ngroups);
+        attrs->groups = talloc_zero_array(attrs, char *, attrs->ngroups + 1);
         if (attrs->groups == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");
             ret = ENOMEM;
@@ -1666,6 +1666,11 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
     const char *tmp_str;
     struct ldb_result *res;
     enum sysdb_member_type type;
+    char **sysdb_grouplist;
+    char **add_groups;
+    char **del_groups;
+    bool in_transaction = false;
+    int tret;
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
@@ -1873,6 +1878,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
                 }
             }
 
+            ret = sysdb_transaction_start(dom->sysdb);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
+                goto done;
+            }
+            in_transaction = true;
+
             ret = sysdb_store_user(dom, name, NULL,
                                    attrs->a.user.pw_uid,
                                    gid, attrs->a.user.pw_gecos,
@@ -1883,6 +1895,41 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
                 DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_user failed.\n");
                 goto done;
             }
+
+            if (attrs->response_type == RESP_USER_GROUPLIST) {
+                ret = get_sysdb_grouplist(tmp_ctx, dom->sysdb, dom, name,
+                                          &sysdb_grouplist);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_OP_FAILURE, "get_sysdb_grouplist failed.\n");
+                    goto done;
+                }
+
+                ret = diff_string_lists(tmp_ctx, attrs->groups, sysdb_grouplist,
+                                        &add_groups, &del_groups, NULL);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_OP_FAILURE, "diff_string_lists failed.\n");
+                    goto done;
+                }
+
+                DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n",
+                                             name);
+                ret = sysdb_update_members(dom, name, SYSDB_MEMBER_USER,
+                                           (const char *const *) add_groups,
+                                           (const char *const *) del_groups);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_CRIT_FAILURE, "Membership update failed [%d]: %s\n",
+                                               ret, sss_strerror(ret));
+                    goto done;
+                }
+            }
+
+            ret = sysdb_transaction_commit(dom->sysdb);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
+                goto done;
+            }
+            in_transaction = false;
+
             break;
         case RESP_GROUP:
         case RESP_GROUP_MEMBERS:
@@ -1975,6 +2022,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
     }
 
 done:
+    if (in_transaction) {
+        tret = sysdb_transaction_cancel(dom->sysdb);
+        if (tret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
+        }
+    }
+
     talloc_free(tmp_ctx);
 
     return ret;
-- 
2.1.0



More information about the sssd-devel mailing list