[SSSD] [PATCH] LDAP: tokengroups do not work with id_provider=ldap

Jakub Hrozek jhrozek at redhat.com
Mon Jun 23 09:20:52 UTC 2014


On Tue, Jun 17, 2014 at 06:30:31PM +0200, Pavel Reichl wrote:
> Hello,
> 
> please see attached patch.
> 
> Regards,
> 
> PR

The patch solves the problem, but I think one part should be improved:

> @@ -875,7 +893,13 @@ static void sdap_ad_tokengroups_initgr_mapping_done(struct tevent_req *subreq)
>          domain = find_subdomain_by_sid(get_domains_head(state->domain), sid);
>          if (domain == NULL) {
>              DEBUG(SSSDBG_MINOR_FAILURE, "Domain not found for SID %s\n", sid);
> -            continue;
> +            if (state->domain->parent == NULL &&
> +                state->domain->subdomains == NULL) {
> +                domain = state->domain;
> +                DEBUG(SSSDBG_TRACE_FUNC, "Using domain %s\n", domain->name);
> +            } else {
> +                continue;
> +            }
>          }

I think this is a bit dangerous. I wonder if we should have some
modification of find_subdomain_by_sid that would return the first
configured domain if no subdomain provider was configured or if no
domains had a SID. This could be a separate function.

Anyhow, find_subdomain_by_sid is misnamed, we routinely use the function
to find the primary domain.



More information about the sssd-devel mailing list