[SSSD] [PATCHES] IPA: SID works for homedir

Jakub Hrozek jhrozek at redhat.com
Wed May 21 13:15:04 UTC 2014


On Wed, May 21, 2014 at 03:58:52PM +0300, Alexander Bokovoy wrote:
> On Tue, 20 May 2014, Jakub Hrozek wrote:
> >On Tue, May 13, 2014 at 11:45:29AM +0200, Pavel Reichl wrote:
> >>Hello,
> >>
> >>Alexander has prepared attached patches, but he was not able to post
> >>them himself as he is currently having bad connection.
> >>
> >>Pavel Reichl
> >
> >I've tested the patches atop my patch called "AD: Initialize
> >user_map_cnt in server mode" that I sent to master today. It's a good
> >start but I would like to propose two amendments that I attach.
> >
> >One makes sure the search by SID also includes UID which we read later,
> >the second makes sure ENOENT or an empty message is handled gracefully
> >and doesn't pollute the logs with a DEBUG message.
> >
> >If you agree, we can apply these patches atop yours or squash them in, I
> >don't mind either way.
> >
> >The second patch looks good to me.
> ACK to both. I'm fine with squashing the patches together.

Thanks for the review, for posterity I have attached the patches I'm
going to push.
-------------- next part --------------
>From 33d70148eac28c548b10eb3aa36ab23169cedc5a Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Tue, 13 May 2014 11:22:29 +0300
Subject: [PATCH 1/2] ipa subdomains provider: make sure search by SID works
 for homedir

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
---
 src/providers/ipa/ipa_subdomains_id.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index bef96e6582ab2eb26ebd048d007d4d6faeca12b0..21e9f85a1bf9277073c94708d31612e3bd8e6113 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -484,7 +484,11 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
     uint32_t uid;
     const char *fqname;
     const char *homedir = NULL;
-    struct ldb_result *res;
+    struct ldb_result *res = NULL;
+    struct ldb_message *msg = NULL;
+    const char *attrs[] = { SYSDB_NAME,
+                            SYSDB_UIDNUM,
+                            NULL };
 
     if (filter_type == BE_FILTER_NAME) {
         ret = sysdb_getpwnam(mem_ctx, dom, filter_value, &res);
@@ -496,6 +500,9 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
             goto done;
         }
         ret = sysdb_getpwuid(mem_ctx, dom, uid, &res);
+    } else if (filter_type == BE_FILTER_SECID) {
+        ret = sysdb_search_user_by_sid_str(mem_ctx, dom, filter_value,
+                                           attrs, &msg);
     } else {
         DEBUG(SSSDBG_OP_FAILURE,
               "Unsupported filter type: [%d].\n", filter_type);
@@ -503,24 +510,27 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
         goto done;
     }
 
-    if (ret != EOK) {
+    if (ret != EOK && ret != ENOENT) {
         DEBUG(SSSDBG_OP_FAILURE,
               "Failed to make request to our cache: [%d]: [%s]\n",
                ret, sss_strerror(ret));
         goto done;
     }
 
-    if (res->count == 0) {
+    if ((res && res->count == 0) || (msg && msg->num_elements == 0)) {
         ret = ENOENT;
         goto done;
     }
 
+    if (res != NULL) {
+        msg = res->msgs[0];
+    }
     /*
      * Homedir is always overriden by subdomain_homedir even if it was
      * explicitly set by user.
      */
-    fqname = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_NAME, NULL);
-    uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
+    fqname = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
+    uid = ldb_msg_find_attr_as_uint64(msg, SYSDB_UIDNUM, 0);
     if (uid == 0) {
         DEBUG(SSSDBG_OP_FAILURE, "UID for user [%s] is not known.\n",
                                   filter_value);
-- 
1.9.0

-------------- next part --------------
>From 58092eb1acfefefef9148789062aa9114e00372e Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Tue, 13 May 2014 12:22:58 +0300
Subject: [PATCH 2/2] well known sids: Windows Server 2012 new asserted
 identity SIDs

http://support.microsoft.com/kb/2830145

In Windows Server 2012, two new security principal SIDs are introduced to
differentiate between proof of possession and Service-for-User-to-Self
(S4U2Self) protocol transitions .

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
---
 src/util/well_known_sids.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/util/well_known_sids.c b/src/util/well_known_sids.c
index c6dcd2e1a46578f5904085c9573a23ea273168c9..38fe2646faa884f3e14d2b0379b9d9eb7641772c 100644
--- a/src/util/well_known_sids.c
+++ b/src/util/well_known_sids.c
@@ -133,6 +133,8 @@ struct special_map sp_map[] = {
     SPECIAL_MAP_ENTRY(3, 2, CREATOR_DOM_NAME, "CREATOR OWNER SERVER"),
     SPECIAL_MAP_ENTRY(3, 3, CREATOR_DOM_NAME, "CREATOR GROUP SERVER"),
     SPECIAL_MAP_ENTRY(3, 4, CREATOR_DOM_NAME, "OWNER RIGHTS"),
+    SPECIAL_MAP_ENTRY(18,1, "ASSERTED IDENTITY", "AUTHENTICATION ASSERTION"),
+    SPECIAL_MAP_ENTRY(18,2, "ASSERTED IDENTITY", "SERVICE ASSERTION"),
 
     {'\0', '\0', NULL, NULL, NULL}
 };
-- 
1.9.0



More information about the sssd-devel mailing list