[SSSD] [PATCHES] IPA: SID works for homedir
Jakub Hrozek
jhrozek at redhat.com
Wed May 21 13:15:04 UTC 2014
On Wed, May 21, 2014 at 03:58:52PM +0300, Alexander Bokovoy wrote:
> On Tue, 20 May 2014, Jakub Hrozek wrote:
> >On Tue, May 13, 2014 at 11:45:29AM +0200, Pavel Reichl wrote:
> >>Hello,
> >>
> >>Alexander has prepared attached patches, but he was not able to post
> >>them himself as he is currently having bad connection.
> >>
> >>Pavel Reichl
> >
> >I've tested the patches atop my patch called "AD: Initialize
> >user_map_cnt in server mode" that I sent to master today. It's a good
> >start but I would like to propose two amendments that I attach.
> >
> >One makes sure the search by SID also includes UID which we read later,
> >the second makes sure ENOENT or an empty message is handled gracefully
> >and doesn't pollute the logs with a DEBUG message.
> >
> >If you agree, we can apply these patches atop yours or squash them in, I
> >don't mind either way.
> >
> >The second patch looks good to me.
> ACK to both. I'm fine with squashing the patches together.
Thanks for the review, for posterity I have attached the patches I'm
going to push.
-------------- next part --------------
>From 33d70148eac28c548b10eb3aa36ab23169cedc5a Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Tue, 13 May 2014 11:22:29 +0300
Subject: [PATCH 1/2] ipa subdomains provider: make sure search by SID works
for homedir
Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
---
src/providers/ipa/ipa_subdomains_id.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index bef96e6582ab2eb26ebd048d007d4d6faeca12b0..21e9f85a1bf9277073c94708d31612e3bd8e6113 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -484,7 +484,11 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
uint32_t uid;
const char *fqname;
const char *homedir = NULL;
- struct ldb_result *res;
+ struct ldb_result *res = NULL;
+ struct ldb_message *msg = NULL;
+ const char *attrs[] = { SYSDB_NAME,
+ SYSDB_UIDNUM,
+ NULL };
if (filter_type == BE_FILTER_NAME) {
ret = sysdb_getpwnam(mem_ctx, dom, filter_value, &res);
@@ -496,6 +500,9 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
goto done;
}
ret = sysdb_getpwuid(mem_ctx, dom, uid, &res);
+ } else if (filter_type == BE_FILTER_SECID) {
+ ret = sysdb_search_user_by_sid_str(mem_ctx, dom, filter_value,
+ attrs, &msg);
} else {
DEBUG(SSSDBG_OP_FAILURE,
"Unsupported filter type: [%d].\n", filter_type);
@@ -503,24 +510,27 @@ apply_subdomain_homedir(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
goto done;
}
- if (ret != EOK) {
+ if (ret != EOK && ret != ENOENT) {
DEBUG(SSSDBG_OP_FAILURE,
"Failed to make request to our cache: [%d]: [%s]\n",
ret, sss_strerror(ret));
goto done;
}
- if (res->count == 0) {
+ if ((res && res->count == 0) || (msg && msg->num_elements == 0)) {
ret = ENOENT;
goto done;
}
+ if (res != NULL) {
+ msg = res->msgs[0];
+ }
/*
* Homedir is always overriden by subdomain_homedir even if it was
* explicitly set by user.
*/
- fqname = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_NAME, NULL);
- uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
+ fqname = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
+ uid = ldb_msg_find_attr_as_uint64(msg, SYSDB_UIDNUM, 0);
if (uid == 0) {
DEBUG(SSSDBG_OP_FAILURE, "UID for user [%s] is not known.\n",
filter_value);
--
1.9.0
-------------- next part --------------
>From 58092eb1acfefefef9148789062aa9114e00372e Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Tue, 13 May 2014 12:22:58 +0300
Subject: [PATCH 2/2] well known sids: Windows Server 2012 new asserted
identity SIDs
http://support.microsoft.com/kb/2830145
In Windows Server 2012, two new security principal SIDs are introduced to
differentiate between proof of possession and Service-for-User-to-Self
(S4U2Self) protocol transitions .
Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
---
src/util/well_known_sids.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/util/well_known_sids.c b/src/util/well_known_sids.c
index c6dcd2e1a46578f5904085c9573a23ea273168c9..38fe2646faa884f3e14d2b0379b9d9eb7641772c 100644
--- a/src/util/well_known_sids.c
+++ b/src/util/well_known_sids.c
@@ -133,6 +133,8 @@ struct special_map sp_map[] = {
SPECIAL_MAP_ENTRY(3, 2, CREATOR_DOM_NAME, "CREATOR OWNER SERVER"),
SPECIAL_MAP_ENTRY(3, 3, CREATOR_DOM_NAME, "CREATOR GROUP SERVER"),
SPECIAL_MAP_ENTRY(3, 4, CREATOR_DOM_NAME, "OWNER RIGHTS"),
+ SPECIAL_MAP_ENTRY(18,1, "ASSERTED IDENTITY", "AUTHENTICATION ASSERTION"),
+ SPECIAL_MAP_ENTRY(18,2, "ASSERTED IDENTITY", "SERVICE ASSERTION"),
{'\0', '\0', NULL, NULL, NULL}
};
--
1.9.0
More information about the sssd-devel
mailing list