[SSSD] [PATCH] Revert "LDAP: Change defaults for ldap_user/group_objectsid"

Lukas Slebodnik lslebodn at redhat.com
Fri Nov 7 12:41:35 UTC 2014


ehlo,

patches are result of discussion in thread
"[REGRESSION] [PATCH] LDAP: Change defaults for ldap_user/group_objectsid"
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-October/022136.html

Patches for master and 1-11 branch are attached.

LS
-------------- next part --------------
>From 63c155b2ed966751b1895d74b12a2dcda1cd9f6f Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 7 Nov 2014 13:27:53 +0100
Subject: [PATCH] Revert "LDAP: Change defaults for ldap_user/group_objectsid"

This reverts commit f834f712548db811695ea0fd6d6b31d3bd03e2a3.

OpenLDAP server cannot dereference unknown attributes. The attribute objectSID
isn't in any standard objectclass on OpenLDAP server. This is a reason why
objectSID cannot be set by default in rfc2307 map and rfc2307bis map.
It is the same problem as using non standard attribute "nsUniqueId"
in ticket https://fedorahosted.org/sssd/ticket/2383
---
 src/man/sssd-ldap.5.xml        | 4 ++--
 src/providers/ldap/ldap_opts.h | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index dad6f27933ced506fed7cd040e9fe91968295632..2dcf7e3f8ab5c307e0262efdebfc148c30ea3679 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -360,7 +360,7 @@
                             necessary for ActiveDirectory servers.
                         </para>
                         <para>
-                            Default: ipaNTSecurityIdentifier for IPA, objectSID
+                            Default: objectSid for ActiveDirectory, not set
                             for other servers.
                         </para>
                     </listitem>
@@ -882,7 +882,7 @@
                             necessary for ActiveDirectory servers.
                         </para>
                         <para>
-                            Default: ipaNTSecurityIdentifier for IPA, objectSID
+                            Default: objectSid for ActiveDirectory, not set
                             for other servers.
                         </para>
                     </listitem>
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 29d9faf99784bfc3526398488be837a2716ee11d..dedbdac0bcf647337d4c00b1fbb82d6b46be5b54 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -156,7 +156,7 @@ struct sdap_attr_map rfc2307_user_map[] = {
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", NULL, SYSDB_MEMBEROF, NULL },
     { "ldap_user_uuid", NULL, SYSDB_UUID, NULL },
-    { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
@@ -190,7 +190,7 @@ struct sdap_attr_map rfc2307_group_map[] = {
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "memberuid", SYSDB_MEMBER, NULL },
     { "ldap_group_uuid", NULL, SYSDB_UUID, NULL },
-    { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
     { "ldap_group_type", NULL, SYSDB_GROUP_TYPE, NULL },
@@ -210,7 +210,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
     { "ldap_user_uuid", NULL, SYSDB_UUID, NULL },
-    { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
@@ -244,7 +244,7 @@ struct sdap_attr_map rfc2307bis_group_map[] = {
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
     { "ldap_group_uuid", NULL, SYSDB_UUID, NULL },
-    { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
     { "ldap_group_type", NULL, SYSDB_GROUP_TYPE, NULL },
-- 
2.1.0

-------------- next part --------------
>From 1bf980b83858a5e7e903698b3ed4845f9043723d Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 7 Nov 2014 13:34:50 +0100
Subject: [PATCH] Revert "LDAP: Change defaults for ldap_user/group_objectsid"

This reverts commit 29e5b5d17d9700022958bf1f59bb861cdf68bb57.

OpenLDAP server cannot dereference unknown attributes. The attribute objectSID
isn't in any standard objectclass on OpenLDAP server. This is a reason why
objectSID cannot be set by default in rfc2307 map and rfc2307bis map.
It is the same problem as using non standard attribute "nsUniqueId"
in ticket https://fedorahosted.org/sssd/ticket/2383
---
 src/man/sssd-ldap.5.xml        | 4 ++--
 src/providers/ldap/ldap_opts.h | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index c952e9539757d368008b9e5a75369833417a2c7f..ecbf2f54c189ab91e797c2ddf05b209cab43c6c3 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -346,7 +346,7 @@
                             necessary for ActiveDirectory servers.
                         </para>
                         <para>
-                            Default: ipaNTSecurityIdentifier for IPA, objectSID
+                            Default: objectSid for ActiveDirectory, not set
                             for other servers.
                         </para>
                     </listitem>
@@ -851,7 +851,7 @@
                             necessary for ActiveDirectory servers.
                         </para>
                         <para>
-                            Default: ipaNTSecurityIdentifier for IPA, objectSID
+                            Default: objectSid for ActiveDirectory, not set
                             for other servers.
                         </para>
                     </listitem>
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 39654ac1e4063c819bac24099edfcaac8d531643..82d46e75d59f0a124ff40e33043de552a9f06453 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -153,7 +153,7 @@ struct sdap_attr_map rfc2307_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", NULL, SYSDB_MEMBEROF, NULL },
-    { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
@@ -186,7 +186,7 @@ struct sdap_attr_map rfc2307_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "memberuid", SYSDB_MEMBER, NULL },
-    { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
     { "ldap_group_type", NULL, SYSDB_GROUP_TYPE, NULL },
@@ -205,7 +205,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
@@ -238,7 +238,7 @@ struct sdap_attr_map rfc2307bis_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
+    { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
     { "ldap_group_type", NULL, SYSDB_GROUP_TYPE, NULL },
-- 
2.1.0



More information about the sssd-devel mailing list