[SSSD] [PATCH] ldap_opts: Get rid on 389ds specific values in rfc2307bis schema

Lukas Slebodnik lslebodn at redhat.com
Fri Jul 25 12:33:24 UTC 2014


On (25/07/14 10:40), Jakub Hrozek wrote:
>On Tue, Jul 22, 2014 at 01:28:17PM +0200, Lukas Slebodnik wrote:
>> On (21/07/14 11:10), Stephen Gallagher wrote:
>> >On 07/20/2014 03:20 PM, Jakub Hrozek wrote:
>> >> On Fri, Jul 18, 2014 at 05:32:09PM +0200, Lukas Slebodnik wrote:
>> >>> On (18/07/14 16:34), Jakub Hrozek wrote:
>> >>>> On Thu, Jul 17, 2014 at 04:35:31PM +0200, Lukas Slebodnik
>> >>>> wrote:
>> >>>>> ehlo,
>> >>>>> 
>> >>>>> There is problem with OpenLDAP server and dereferencing of
>> >>>>> attributes that is not in the schema  of the server?
>> >>>>> 
>> >>>>> sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b
>> >>>>> 'dc=example,dc=com' \ -E 'deref=member:uid,dummy_attr'
>> >>>>> cn=ref_grp Protocol error (2) Additional information:
>> >>>>> Dereference control: attribute decoding error sh-4.2$ echo
>> >>>>> $? 2
>> >>>>> 
>> >>>>> The attribute nsUniqueID is a 389-only, non-standard
>> >>>>> attribute. It is an operational attribute that is not in the
>> >>>>> rfc2307bis nor inetOrgPerson nor posixAccount schema.
>> >>>>> OpenLDAP supports the standard entryUUID attribute, which is
>> >>>>> basically the same (uniquely identifies an entry throughout a
>> >>>>> replication topology), but uses the standard UUID format
>> >>>>> rather than the non-standard format used by 389.
>> >>>>> 
>> >>>>> 4x FIXME removed :-)
>> >>>>> 
>> >>>>> 
>> >>>>> Any comments are welcomed.
>> >>>>> 
>> >>>>> LS
>> >>>> 
>> >>>> Thanks for the detective work on finding the root cause of the
>> >>>> problem!
>> >>>> 
>> >>>> I wonder if we could remove the attribute completely, though.
>> >>>> It appears to be completely unused now:
>> >>>> 
>> >>>> $ git grep -l SYSDB_UUID src/db/sysdb.h:#define SYSDB_UUID
>> >>>> "uniqueID" src/providers/ad/ad_opts.h:    { "ldap_user_uuid",
>> >>>> "objectGUID", SYSDB_UUID, NULL }, src/providers/ad/ad_opts.h:
>> >>>> { "ldap_group_uuid", "objectGUID", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ad/ad_opts.h:    { "ldap_netgroup_uuid",
>> >>>> "nsUniqueId", SYSDB_UUID, NULL }, src/providers/ipa/ipa_opts.h:
>> >>>> { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ipa/ipa_opts.h:    { "ldap_group_uuid",
>> >>>> "nsUniqueId", SYSDB_UUID, NULL }, src/providers/ipa/ipa_opts.h:
>> >>>> { "ipa_netgroup_uuid", "ipaUniqueID", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ipa/ipa_opts.h:    { "ipa_host_uuid",
>> >>>> "ipaUniqueID", SYSDB_UUID, NULL}, src/providers/ipa/ipa_opts.h:
>> >>>> { "ipa_hostgroup_uuid", "ipaUniqueID", SYSDB_UUID, NULL}, 
>> >>>> src/providers/ipa/ipa_opts.h:    { "ipa_selinux_usermap_uuid",
>> >>>> "ipaUniqueID", SYSDB_UUID, NULL}, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_user_uuid", NULL,
>> >>>> SYSDB_UUID, NULL }, src/providers/ldap/ldap_opts.h:    {
>> >>>> "ldap_group_uuid", NULL, SYSDB_UUID, NULL }, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_user_uuid",
>> >>>> "nsUniqueId", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_group_uuid",
>> >>>> "nsUniqueId", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_user_uuid",
>> >>>> "objectGUID", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_group_uuid",
>> >>>> "objectGUID", SYSDB_UUID, NULL }, 
>> >>>> src/providers/ldap/ldap_opts.h:    { "ldap_netgroup_uuid",
>> >>>> "nsUniqueId", SYSDB_UUID, NULL },
>> >>>> 
>> >>>> And according to "git log -S" it was actually never used.
>> >>>> 
>> >>>> So my proposal is to just remove the attribute along with
>> >>>> SYSDB_UUID.
>> >>> I was thinking about this change but I thought that we need to
>> >>> deprecate options before removing. I don't have a problem with
>> >>> removing them. and it should not be a problem in this case. I
>> >>> would like to know opinion of older developers (Sumit, Stephen,
>> >>> ...) Why were these options introduced? Do they help with ldap
>> >>> search?
>> >>> 
>> >>> LS
>> >> 
>> >> Sure, being defensive when removing anything is a good idea. But
>> >> since the option doesn't do anything and never did, I think we're
>> >> fine. You're right that removing an option requires two acks,
>> >> though. So far you have mine :-)
>> >
>> >I'll ack it as well. I suspect that this was planned for a future use
>> >that we never ended up with. I don't remember any reason for it.
>> >
>> I prepared separate patches for different *_uuid options.
>> I thought it would be simple change. There is small complication with
>> IPA_UNIQUE_ID. I am not sure why it was used for storing HBAC rules.
>> (0005-Remove-macro-IPA_UNIQUE_ID.patch). HBAC works with 5th patch.
>> I hope I tested all possible ways. If we agree with this version it can be
>> squashed to 4th patch (0004-LDAP-Remove-unused-option-ipa_hostgroup_uuid)
>
>I can't see a reason either. The only benefit of storing the uniqueID,
>as far as I can see, is to be able to match objects with their server
>side counterparts. I also tested some HBAC combinations, even offline
>auth with cache using the old RDN, but with patched code -- everything
>worked fine, because the code doesn't care about either the DN format or
>the presence of UUID. We don't need to upgrade sysdb either.
>
>I wonder if, with some very old IPA versions, the rules could have no
>name? The following code in hbac_attrs_to_rule() seems to suggest it:
>
>274     ret = sysdb_attrs_get_el(hbac_ctx->rules[idx],
>275                              IPA_CN, &el);
>276     if (ret != EOK || el->num_values == 0) {
>277         DEBUG(SSSDBG_CONF_SETTINGS, "rule has no name, assuming '(none)'.\n");
>278         new_rule->name = talloc_strdup(new_rule, "(none)");
>279     } else {
>280         new_rule->name = talloc_strndup(new_rule,
>281                                         (const char*) el->values[0].data,
>282                                         el->values[0].length);
>283     }
>284
>
>Your patches make 'cn' mandatory because it's used as an RDN value,
>so additional change to patch 5/7 should also change the code above to
>require CN.  BTW I also tested that IPA wouldn't let you define two rules
>with the same CN..
>
>So I think we should push these patches to master, if we can't justify
>the presence of some code, it should be removed..but at the same time,
>sssd-1-11 should only contain minimal and safe changes at this point.
>
>Can you also prepare patches #1, #2 so that they apply on sssd-1-11 and
>send a version of #3 that only removes the LDAP part?

Attached patches remove only options ldap_*_uuid. They can be applied on master
or sssd-1-11.

Now, you should decide which patch set you want to push to which branch :-)

LS


-------------- next part --------------
>From f58ae4d0a316cd1297668ddb44bf28a255b8402c Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 25 Jul 2014 14:09:32 +0200
Subject: [PATCH 1/3] LDAP: Remove unused option ldap_netgroup_uuid

---
 src/config/SSSDConfig/__init__.py.in         |  1 -
 src/config/SSSDConfig/sssd_upgrade_config.py |  1 -
 src/config/etc/sssd.api.d/sssd-ldap.conf     |  1 -
 src/man/sssd-ldap.5.xml                      | 17 -----------------
 src/providers/ad/ad_opts.h                   |  2 --
 src/providers/ldap/ldap_opts.h               |  2 --
 src/providers/ldap/sdap.h                    |  1 -
 7 files changed, 25 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 8be6f8db4725aa0bd24d1a31cc7fcd1a8aca6205..f74171be166aac1e5a3a1a10e84aa219196b2687 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -298,7 +298,6 @@ option_strings = {
     'ldap_netgroup_name' : _('Netgroup name'),
     'ldap_netgroup_member' : _('Netgroups members attribute'),
     'ldap_netgroup_triple' : _('Netgroup triple attribute'),
-    'ldap_netgroup_uuid' : _('Netgroup UUID attribute'),
     'ldap_netgroup_modify_timestamp' : _('Modification time attribute for netgroups'),
 
     'ldap_service_search_base' : _('Base DN for service lookups'),
diff --git a/src/config/SSSDConfig/sssd_upgrade_config.py b/src/config/SSSDConfig/sssd_upgrade_config.py
index 7e4cbbff45fa7aebb0fcb1d64049441602cdfc43..33d9fed74424a7d3ee28e888aaed724d0a8a94ff 100644
--- a/src/config/SSSDConfig/sssd_upgrade_config.py
+++ b/src/config/SSSDConfig/sssd_upgrade_config.py
@@ -197,7 +197,6 @@ class SSSDConfigFile(SSSDChangeConf):
                     'ldap_netgroup_name' : 'netgroupName',
                     'ldap_netgroup_member' : 'netgroupMember',
                     'ldap_netgroup_triple' : 'netgroupTriple',
-                    'ldap_netgroup_uuid' : 'netgroupUUID',
                     'ldap_netgroup_modify_timestamp' : 'netgroupModifyTimestamp',
                    }
         krb5_kw = { 'krb5_server' : 'krb5KDCIP',
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index ca1dee08de83dbaf55add980f2bf1add3ef29232..ce1ed3fb76e48e74fb5366b817d6958ab671730d 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -102,7 +102,6 @@ ldap_netgroup_object_class = str, None, false
 ldap_netgroup_name = str, None, false
 ldap_netgroup_member = str, None, false
 ldap_netgroup_triple = str, None, false
-ldap_netgroup_uuid = str, None, false
 ldap_netgroup_modify_timestamp = str, None, false
 ldap_service_object_class = str, None, false
 ldap_service_name = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 01efb29fecc2d7bda1ee0100a28bba61a6568a0b..4656f34fda4cdd12a6c45c0975ed1a8ef6816928 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1089,23 +1089,6 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>ldap_netgroup_uuid (string)</term>
-                    <listitem>
-                        <para>
-                            The LDAP attribute that contains the UUID/GUID of
-                            an LDAP netgroup object.
-                        </para>
-                        <para>
-                            In IPA provider, ipa_netgroup_uuid should
-                            be used instead.
-                        </para>
-                        <para>
-                            Default: nsUniqueId
-                        </para>
-                    </listitem>
-                </varlistentry>
-
-                <varlistentry>
                     <term>ldap_netgroup_modify_timestamp (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index feb7ba124fbcb5e2f506d157c0efba2722aa24ea..8d705d21317f9a3ccef6d0331d59398925cc6fde 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -220,8 +220,6 @@ struct sdap_attr_map ad_netgroup_map[] = {
     { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
     { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
     { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     SDAP_ATTR_MAP_TERMINATOR
 };
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 217436113ec3b66b0e903ad4ddf8911eeb58ae4a..a254da10889b96e2f700e01aed48bc3a5aea9d16 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -306,8 +306,6 @@ struct sdap_attr_map netgroup_map[] = {
     { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
     { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
     { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     SDAP_ATTR_MAP_TERMINATOR
 };
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 178aecce1bf8b51dc8f1931aa07d989b8f31f11d..bcd071426faa4a71eff9958fc24c7d07ee692686 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -308,7 +308,6 @@ enum sdap_netgroup_attrs {
     SDAP_AT_NETGROUP_NAME,
     SDAP_AT_NETGROUP_MEMBER,
     SDAP_AT_NETGROUP_TRIPLE,
-    SDAP_AT_NETGROUP_UUID,
     SDAP_AT_NETGROUP_MODSTAMP,
 
     SDAP_OPTS_NETGROUP /* attrs counter */
-- 
1.9.3

-------------- next part --------------
>From 9e32cbad16730757ce7370646ea1e764aa1d788d Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 22 Jul 2014 10:01:03 +0200
Subject: [PATCH 2/3] LDAP: Remove unused option ldap_group_uuid

---
 src/config/SSSDConfig/__init__.py.in         |  1 -
 src/config/SSSDConfig/sssd_upgrade_config.py |  1 -
 src/config/etc/sssd.api.d/sssd-ad.conf       |  1 -
 src/config/etc/sssd.api.d/sssd-ipa.conf      |  1 -
 src/config/etc/sssd.api.d/sssd-ldap.conf     |  1 -
 src/man/sssd-ldap.5.xml                      | 13 -------------
 src/providers/ad/ad_opts.h                   |  1 -
 src/providers/ipa/ipa_opts.h                 |  1 -
 src/providers/ldap/ldap_opts.h               |  4 ----
 src/providers/ldap/sdap.h                    |  1 -
 10 files changed, 25 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index f74171be166aac1e5a3a1a10e84aa219196b2687..7f0dc22bad637d9cd6f2f292a4a975fe100c046e 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -286,7 +286,6 @@ option_strings = {
     'ldap_group_pwd' : _('Group password'),
     'ldap_group_gid_number' : _('GID attribute'),
     'ldap_group_member' : _('Group member attribute'),
-    'ldap_group_uuid' : _('Group UUID attribute'),
     'ldap_group_objectsid' : _("objectSID attribute"),
     'ldap_group_modify_timestamp' : _('Modification time attribute for groups'),
     'ldap_group_type' : _('Type of the group and other flags'),
diff --git a/src/config/SSSDConfig/sssd_upgrade_config.py b/src/config/SSSDConfig/sssd_upgrade_config.py
index 33d9fed74424a7d3ee28e888aaed724d0a8a94ff..97be6543f8f86eb0189843003f675d2efcfcc8a5 100644
--- a/src/config/SSSDConfig/sssd_upgrade_config.py
+++ b/src/config/SSSDConfig/sssd_upgrade_config.py
@@ -184,7 +184,6 @@ class SSSDConfigFile(SSSDChangeConf):
                     'ldap_group_pwd' : 'userPassword',
                     'ldap_group_gid_number' : 'groupGidNumber',
                     'ldap_group_member' : 'groupMember',
-                    'ldap_group_uuid' : 'groupUUID',
                     'ldap_group_modify_timestamp' : 'modifyTimestamp',
                     'ldap_network_timeout' : 'network_timeout',
                     'ldap_offline_timeout' : 'offline_timeout',
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 3a0dda8bde9d6c56df7ededee8920a46ccf15da4..678432ba339ed459ad242b7521aa3b4343b35597 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -88,7 +88,6 @@ ldap_group_object_class = str, None, false
 ldap_group_name = str, None, false
 ldap_group_gid_number = str, None, false
 ldap_group_member = str, None, false
-ldap_group_uuid = str, None, false
 ldap_group_objectsid = str, None, false
 ldap_group_modify_timestamp = str, None, false
 ldap_group_entry_usn = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 198076d6fba4df542f4a37b6ce6735a3f26b2a24..7694609dcdf91acb9ff4ab0380480b8065e3c114 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -95,7 +95,6 @@ ldap_group_object_class = str, None, false
 ldap_group_name = str, None, false
 ldap_group_gid_number = str, None, false
 ldap_group_member = str, None, false
-ldap_group_uuid = str, None, false
 ldap_group_objectsid = str, None, false
 ldap_group_modify_timestamp = str, None, false
 ldap_group_entry_usn = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index ce1ed3fb76e48e74fb5366b817d6958ab671730d..bf085aa853bb41b537479ed3794f6c22e2b07eb3 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -90,7 +90,6 @@ ldap_group_object_class = str, None, false
 ldap_group_name = str, None, false
 ldap_group_gid_number = str, None, false
 ldap_group_member = str, None, false
-ldap_group_uuid = str, None, false
 ldap_group_objectsid = str, None, false
 ldap_group_modify_timestamp = str, None, false
 ldap_group_entry_usn = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 4656f34fda4cdd12a6c45c0975ed1a8ef6816928..7cc2d4bbaa7099d7e42dc978226165f3170963c6 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -856,19 +856,6 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>ldap_group_uuid (string)</term>
-                    <listitem>
-                        <para>
-                            The LDAP attribute that contains the UUID/GUID of
-                            an LDAP group object.
-                        </para>
-                        <para>
-                            Default: nsUniqueId
-                        </para>
-                    </listitem>
-                </varlistentry>
-
-                <varlistentry>
                     <term>ldap_group_objectsid (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 8d705d21317f9a3ccef6d0331d59398925cc6fde..43896a3819fecc99bb05a65d439739658305fa6d 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -207,7 +207,6 @@ struct sdap_attr_map ad_2008r2_group_map[] = {
     { "ldap_group_pwd", NULL, SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    { "ldap_group_uuid", "objectGUID", SYSDB_UUID, NULL },
     { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 2b97044b405fa2d7a93c2b33cb04271e0f2dc98b..276e781a0a632ccc6e65834cc428f6495ee93265 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -207,7 +207,6 @@ struct sdap_attr_map ipa_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    { "ldap_group_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_group_objectsid", "ipaNTSecurityIdentifier", SYSDB_SID_STR, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index a254da10889b96e2f700e01aed48bc3a5aea9d16..89532c9a4cafc119f7263ce0b6d3d5a63478e96d 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -185,7 +185,6 @@ struct sdap_attr_map rfc2307_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "memberuid", SYSDB_MEMBER, NULL },
-    { "ldap_group_uuid", NULL, SYSDB_UUID, NULL },
     { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
@@ -239,8 +238,6 @@ struct sdap_attr_map rfc2307bis_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_group_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
@@ -293,7 +290,6 @@ struct sdap_attr_map gen_ad2008r2_group_map[] = {
     { "ldap_group_pwd", NULL, SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    { "ldap_group_uuid", "objectGUID", SYSDB_UUID, NULL },
     { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index bcd071426faa4a71eff9958fc24c7d07ee692686..9823b5da3ca8735054608080e2e194ab4e01ccbc 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -294,7 +294,6 @@ enum sdap_group_attrs {
     SDAP_AT_GROUP_PWD,
     SDAP_AT_GROUP_GID,
     SDAP_AT_GROUP_MEMBER,
-    SDAP_AT_GROUP_UUID,
     SDAP_AT_GROUP_OBJECTSID,
     SDAP_AT_GROUP_MODSTAMP,
     SDAP_AT_GROUP_USN,
-- 
1.9.3

-------------- next part --------------
>From e50c8bc0d30027ec561e71d3f971f567309240a5 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 22 Jul 2014 09:51:18 +0200
Subject: [PATCH 3/3] LDAP: Remove unused option ldap_user_uuid

There is problem with OpenLDAP server and dereferencing of attributes
that is not in the schema  of the server?

sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b 'dc=example,dc=com' \
                   -E 'deref=member:uid,dummy_attr' cn=ref_grp
Protocol error (2)
Additional information: Dereference control: attribute decoding error
sh-4.2$ echo $?
2

The attribute nsUniqueID is a 389-only, non-standard attribute.
It is an operational attribute that is not in the rfc2307bis nor inetOrgPerson
nor posixAccount schema. It was a default value of option ldap_user_uuid,
but it was not use anywhere.

Resolves:
https://fedorahosted.org/sssd/ticket/2383
---
 src/config/SSSDConfig/__init__.py.in         |  1 -
 src/config/SSSDConfig/sssd_upgrade_config.py |  1 -
 src/config/etc/sssd.api.d/sssd-ad.conf       |  1 -
 src/config/etc/sssd.api.d/sssd-ipa.conf      |  1 -
 src/config/etc/sssd.api.d/sssd-ldap.conf     |  1 -
 src/man/sssd-ldap.5.xml                      | 13 -------------
 src/providers/ad/ad_opts.h                   |  1 -
 src/providers/ipa/ipa_opts.h                 |  1 -
 src/providers/ldap/ldap_opts.h               |  4 ----
 src/providers/ldap/sdap.h                    |  1 -
 10 files changed, 25 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 7f0dc22bad637d9cd6f2f292a4a975fe100c046e..bc657d3658ec8a19bfe05fd21750b7c4eafbeba5 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -249,7 +249,6 @@ option_strings = {
     'ldap_user_gecos' : _('GECOS attribute'),
     'ldap_user_home_directory' : _('Home directory attribute'),
     'ldap_user_shell' : _('Shell attribute'),
-    'ldap_user_uuid' : _('UUID attribute'),
     'ldap_user_objectsid' : _("objectSID attribute"),
     'ldap_user_primary_group' : _('Active Directory primary group attribute for ID-mapping'),
     'ldap_user_principal' : _('User principal attribute (for Kerberos)'),
diff --git a/src/config/SSSDConfig/sssd_upgrade_config.py b/src/config/SSSDConfig/sssd_upgrade_config.py
index 97be6543f8f86eb0189843003f675d2efcfcc8a5..3d9f788c3b4707a8b6e8958d11d5068437d31156 100644
--- a/src/config/SSSDConfig/sssd_upgrade_config.py
+++ b/src/config/SSSDConfig/sssd_upgrade_config.py
@@ -170,7 +170,6 @@ class SSSDConfigFile(SSSDChangeConf):
                     'ldap_user_gecos' : 'userGecos',
                     'ldap_user_home_directory' : 'userHomeDirectory',
                     'ldap_user_shell' : 'userShell',
-                    'ldap_user_uuid' : 'userUUID',
                     'ldap_user_principal' : 'userPrincipal',
                     'ldap_force_upper_case_realm' : 'force_upper_case_realm',
                     'ldap_user_fullname' : 'userFullname',
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 678432ba339ed459ad242b7521aa3b4343b35597..77f7eac71b9c591ed7c12add1a26ec3225cf85d1 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -62,7 +62,6 @@ ldap_user_gid_number = str, None, false
 ldap_user_gecos = str, None, false
 ldap_user_home_directory = str, None, false
 ldap_user_shell = str, None, false
-ldap_user_uuid = str, None, false
 ldap_user_objectsid = str, None, false
 ldap_user_primary_group = str, None, false
 ldap_user_principal = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 7694609dcdf91acb9ff4ab0380480b8065e3c114..e1ebf0888356288efb0c9cb34ed569cc47a0825a 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -69,7 +69,6 @@ ldap_user_gid_number = str, None, false
 ldap_user_gecos = str, None, false
 ldap_user_home_directory = str, None, false
 ldap_user_shell = str, None, false
-ldap_user_uuid = str, None, false
 ldap_user_objectsid = str, None, false
 ldap_user_primary_group = str, None, false
 ldap_user_principal = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index bf085aa853bb41b537479ed3794f6c22e2b07eb3..4e3f0e9ea95d0d22bec5e6d40e25251da3aee298 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -56,7 +56,6 @@ ldap_user_gid_number = str, None, false
 ldap_user_gecos = str, None, false
 ldap_user_home_directory = str, None, false
 ldap_user_shell = str, None, false
-ldap_user_uuid = str, None, false
 ldap_user_objectsid = str, None, false
 ldap_user_primary_group = str, None, false
 ldap_user_principal = str, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 7cc2d4bbaa7099d7e42dc978226165f3170963c6..c808033a1237a0dd9544f6bc7cb77666264889a6 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -338,19 +338,6 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>ldap_user_uuid (string)</term>
-                    <listitem>
-                        <para>
-                            The LDAP attribute that contains the UUID/GUID of
-                            an LDAP user object.
-                        </para>
-                        <para>
-                            Default: nsUniqueId
-                        </para>
-                    </listitem>
-                </varlistentry>
-
-                <varlistentry>
                     <term>ldap_user_objectsid (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 43896a3819fecc99bb05a65d439739658305fa6d..19ad14d62b5e74fae54fbac71807fed35198aaf1 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -174,7 +174,6 @@ struct sdap_attr_map ad_2008r2_user_map[] = {
     { "ldap_user_principal", "userPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "name", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    { "ldap_user_uuid", "objectGUID", SYSDB_UUID, NULL },
     { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
     { "ldap_user_primary_group", "primaryGroupID", SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 276e781a0a632ccc6e65834cc428f6495ee93265..a1334610c9b5162abc50134e50f350cc11ccfef3 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -174,7 +174,6 @@ struct sdap_attr_map ipa_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_user_objectsid", "ipaNTSecurityIdentifier", SYSDB_SID_STR, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 89532c9a4cafc119f7263ce0b6d3d5a63478e96d..803bd3f19c32691eb10a5eec9cd333224af4f7a0 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -152,7 +152,6 @@ struct sdap_attr_map rfc2307_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", NULL, SYSDB_MEMBEROF, NULL },
-    { "ldap_user_uuid", NULL, SYSDB_UUID, NULL },
     { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
@@ -204,8 +203,6 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL },
     { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
@@ -257,7 +254,6 @@ struct sdap_attr_map gen_ad2008r2_user_map[] = {
     { "ldap_user_principal", "userPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "name", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    { "ldap_user_uuid", "objectGUID", SYSDB_UUID, NULL },
     { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
     { "ldap_user_primary_group", "primaryGroupID", SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 9823b5da3ca8735054608080e2e194ab4e01ccbc..af7b2f033618d74dd4cc61e2760d82a1283b7716 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -256,7 +256,6 @@ enum sdap_user_attrs {
     SDAP_AT_USER_PRINC,
     SDAP_AT_USER_FULLNAME,
     SDAP_AT_USER_MEMBEROF,
-    SDAP_AT_USER_UUID,
     SDAP_AT_USER_OBJECTSID,
     SDAP_AT_USER_PRIMARY_GROUP,
     SDAP_AT_USER_MODSTAMP,
-- 
1.9.3



More information about the sssd-devel mailing list