[SSSD] [PATCH] IPA: Use GC for AD initgroup requests

Sumit Bose sbose at redhat.com
Thu Mar 6 20:13:55 UTC 2014


Hi,

the current AD provider code expects a connection to the Global Catalog
to resolve cross-domain group memberships correctly. The patch enables
this for trusted domains in the IPA provider.

bye,
Sumit
-------------- next part --------------
From 704eeedc786c92d4b632636c3b0f23d3b4a3d224 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 6 Mar 2014 15:37:57 +0100
Subject: [PATCH] IPA: Use GC for AD initgroup requests

---
 src/providers/ipa/ipa_subdomains_id.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 0adf806..bef96e6 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -307,13 +307,22 @@ ipa_get_ad_acct_send(TALLOC_CTX *mem_ctx,
     /* Currently only LDAP port for AD is used because POSIX
      * attributes are not replicated to GC by default
      */
-    clist = talloc_zero_array(req, struct sdap_id_conn_ctx *, 2);
-    if (clist == NULL) {
-        ret = ENOMEM;
-        goto fail;
+
+    if ((state->ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_INITGROUPS) {
+        clist = ad_gc_conn_list(req, ad_id_ctx, state->user_dom);
+        if (clist == NULL) {
+            ret = ENOMEM;
+            goto fail;
+        }
+    } else {
+        clist = talloc_zero_array(req, struct sdap_id_conn_ctx *, 2);
+        if (clist == NULL) {
+            ret = ENOMEM;
+            goto fail;
+        }
+        clist[0] = ad_id_ctx->ldap_ctx;
+        clist[1] = NULL;
     }
-    clist[0] = ad_id_ctx->ldap_ctx;
-    clist[1] = NULL;
 
     /* Now we already need ad_id_ctx in particular sdap_id_conn_ctx */
     sdom = sdap_domain_get(sdap_id_ctx->opts, state->user_dom);
-- 
1.8.5.3



More information about the sssd-devel mailing list