[SSSD] [PATCHES] IPA: check overrrides for IPA users as well

Sumit Bose sbose at redhat.com
Thu Nov 13 10:58:13 UTC 2014


On Thu, Nov 13, 2014 at 11:46:43AM +0100, Lukas Slebodnik wrote:
> On (12/11/14 21:39), Sumit Bose wrote:
> >On Mon, Nov 10, 2014 at 03:17:04PM +0100, Sumit Bose wrote:
> >> Hi,
> >> 
> >> this patch-set should solve https://fedorahosted.org/sssd/ticket/2481
> >> "ID Views implementation does not support IPA user&group overrides". It
> >> depends on the already commit patches which bring back ldap_user_uuid
> >> and ldap_group_uuid and "sysdb: add sysdb_search_object_by_uuid()" which
> >> is still under review.
> >> 
> >> Most of the patches adds support for UUIDs here and there, The main part
> >> of the work is done in the 0006 where the user and group lookup request
> >> is extended in a similar way like for AD users where the overrides are
> >> checked first, then the original object and eventually a final lookup in
> >> the override tree. I will file a ticket to refactor the code so that code
> >> paths for IPA and AD users are unified but for the time being I think
> >> it is better to have them separate so that changes in one path do not
> >> break the other path.
> >> 
> >
> >Please find attached a new version of the patch set. It is rebased on
> >current master plus the "sysdb: add sysdb_search_object_by_uuid()" patch
> >and fixes a segfault in the 6th patch.
> >
> >bye,
> >Sumit
> 
> >From 9047069105444545a2f5dc0be3ef30d4c43689d1 Mon Sep 17 00:00:00 2001
> >From: Sumit Bose <sbose at redhat.com>
> >Date: Fri, 7 Nov 2014 21:34:55 +0100
> >Subject: [PATCH 5/7] IPA: make get_object_from_cache() public
> >
> >Related to https://fedorahosted.org/sssd/ticket/2481
> >---
> > src/providers/ipa/ipa_id.h            | 5 +++++
> > src/providers/ipa/ipa_subdomains_id.c | 9 +++++----
> > 2 files changed, 10 insertions(+), 4 deletions(-)
> >
> 
> >From 9047069105444545a2f5dc0be3ef30d4c43689d1 Mon Sep 17 00:00:00 2001
> >From: Sumit Bose <sbose at redhat.com>
> >Date: Fri, 7 Nov 2014 21:34:55 +0100
> >Subject: [PATCH 5/7] IPA: make get_object_from_cache() public
> >
> >Related to https://fedorahosted.org/sssd/ticket/2481
> >---
> > src/providers/ipa/ipa_id.h            | 5 +++++
> > src/providers/ipa/ipa_subdomains_id.c | 9 +++++----
> > 2 files changed, 10 insertions(+), 4 deletions(-)
> >
> 
> 
> I can see two attachements 0005-IPA-make-get_object_from_cache-public.patch
> but there isn't 6th patch.
> 
> Is it expected?

no, new set attached.

bye,
Sumit

> 
> LS
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 9f807e92b8db786c331842117e1481dbb494a1f7 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 6 Nov 2014 13:13:27 +0100
Subject: [PATCH 1/7] ipa: add split_ipa_anchor()

This call extracts the domain and the UUID part from an IPA override
anchor.

Related to https://fedorahosted.org/sssd/ticket/2481
---
 Makefile.am                         |  2 ++
 src/providers/ipa/ipa_id.h          |  2 ++
 src/providers/ipa/ipa_utils.c       | 63 +++++++++++++++++++++++++++++++++++++
 src/tests/cmocka/test_sysdb_views.c | 32 +++++++++++++++++++
 4 files changed, 99 insertions(+)
 create mode 100644 src/providers/ipa/ipa_utils.c

diff --git a/Makefile.am b/Makefile.am
index b85341f..c083a2e 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2066,6 +2066,7 @@ endif # BUILD_IFP
 
 test_sysdb_views_SOURCES = \
     src/tests/cmocka/test_sysdb_views.c \
+    src/providers/ipa/ipa_utils.c \
     $(NULL)
 test_sysdb_views_CFLAGS = \
     $(AM_CFLAGS) \
@@ -2388,6 +2389,7 @@ libsss_ipa_la_SOURCES = \
     src/providers/ipa/ipa_subdomains_id.c \
     src/providers/ipa/ipa_subdomains_ext_groups.c \
     src/providers/ipa/ipa_views.c \
+    src/providers/ipa/ipa_utils.c \
     src/providers/ipa/ipa_s2n_exop.c \
     src/providers/ipa/ipa_hbac_hosts.c \
     src/providers/ipa/ipa_hbac_private.h \
diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index e13aded..033ac40 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -103,4 +103,6 @@ struct tevent_req *ipa_subdomain_account_send(TALLOC_CTX *memctx,
 
 errno_t ipa_subdomain_account_recv(struct tevent_req *req, int *dp_error_out);
 
+errno_t split_ipa_anchor(TALLOC_CTX *mem_ctx, const char *anchor,
+                         char **_anchor_domain, char **_ipa_uuid);
 #endif
diff --git a/src/providers/ipa/ipa_utils.c b/src/providers/ipa/ipa_utils.c
new file mode 100644
index 0000000..86ba51c
--- /dev/null
+++ b/src/providers/ipa/ipa_utils.c
@@ -0,0 +1,63 @@
+/*
+    SSSD
+
+    IPA Module utility functions
+
+    Authors:
+        Sumit Bose <sbose at redhat.com>
+
+    Copyright (C) 2014 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "util/util.h"
+
+#define OVERRIDE_ANCHOR_IPA_PREFIX ":IPA:"
+#define OVERRIDE_ANCHOR_IPA_PREFIX_LEN (sizeof(OVERRIDE_ANCHOR_IPA_PREFIX) -1 )
+
+errno_t split_ipa_anchor(TALLOC_CTX *mem_ctx, const char *anchor,
+                         char **_anchor_domain, char **_ipa_uuid)
+{
+    const char *sep;
+
+    if (anchor == NULL) {
+        return EINVAL;
+    }
+    if (strncmp(OVERRIDE_ANCHOR_IPA_PREFIX, anchor,
+                OVERRIDE_ANCHOR_IPA_PREFIX_LEN) != 0) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "No IPA anchor [%s].\n", anchor);
+        return ENOMSG;
+    }
+
+    sep = strchr(anchor + OVERRIDE_ANCHOR_IPA_PREFIX_LEN, ':');
+    if (sep == NULL || sep[1] == '\0') {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Broken IPA anchor [%s].\n", anchor);
+        return EINVAL;
+    }
+
+    *_anchor_domain = talloc_strndup(mem_ctx,
+                                 anchor + OVERRIDE_ANCHOR_IPA_PREFIX_LEN,
+                                 sep - anchor - OVERRIDE_ANCHOR_IPA_PREFIX_LEN);
+    *_ipa_uuid = talloc_strdup(mem_ctx, sep + 1);
+
+    if (*_anchor_domain == NULL || *_ipa_uuid == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_strndup failed.\n");
+        talloc_free(*_anchor_domain);
+        talloc_free(*_ipa_uuid);
+        return ENOMEM;
+    }
+
+    return EOK;
+}
diff --git a/src/tests/cmocka/test_sysdb_views.c b/src/tests/cmocka/test_sysdb_views.c
index 9fb2d72..0dc5144 100644
--- a/src/tests/cmocka/test_sysdb_views.c
+++ b/src/tests/cmocka/test_sysdb_views.c
@@ -29,6 +29,7 @@
 #include <popt.h>
 
 #include "tests/cmocka/common_mock.h"
+#include "providers/ipa/ipa_id.h"
 
 #define TESTS_PATH "tests_sysdb_views"
 #define TEST_CONF_FILE "tests_conf.ldb"
@@ -189,6 +190,35 @@ void test_sysdb_add_overrides_to_object(void **state)
     assert_int_equal(ldb_val_string_cmp(&el->values[1], "OVERRIDEKEY2"), 0);
 }
 
+void test_split_ipa_anchor(void **state)
+{
+    int ret;
+    char *dom;
+    char *uuid;
+    struct sysdb_test_ctx *test_ctx = talloc_get_type_abort(*state,
+                                                         struct sysdb_test_ctx);
+
+    ret = split_ipa_anchor(test_ctx, NULL, &dom, &uuid);
+    assert_int_equal(ret, EINVAL);
+
+    ret = split_ipa_anchor(test_ctx, "fwfkwjfkw", &dom, &uuid);
+    assert_int_equal(ret, ENOMSG);
+
+    ret = split_ipa_anchor(test_ctx, ":IPA:", &dom, &uuid);
+    assert_int_equal(ret, EINVAL);
+
+    ret = split_ipa_anchor(test_ctx, ":IPA:abc", &dom, &uuid);
+    assert_int_equal(ret, EINVAL);
+
+    ret = split_ipa_anchor(test_ctx, ":IPA:abc:", &dom, &uuid);
+    assert_int_equal(ret, EINVAL);
+
+    ret = split_ipa_anchor(test_ctx, ":IPA:abc:def", &dom, &uuid);
+    assert_int_equal(ret, EOK);
+    assert_string_equal(dom, "abc");
+    assert_string_equal(uuid, "def");
+}
+
 int main(int argc, const char *argv[])
 {
     int rv;
@@ -206,6 +236,8 @@ int main(int argc, const char *argv[])
     const UnitTest tests[] = {
         unit_test_setup_teardown(test_sysdb_add_overrides_to_object,
                                  test_sysdb_setup, test_sysdb_teardown),
+        unit_test_setup_teardown(test_split_ipa_anchor,
+                                 test_sysdb_setup, test_sysdb_teardown),
     };
 
     /* Set debug level to invalid value so we can deside if -d 0 was used. */
-- 
1.8.3.1

-------------- next part --------------
From ec4cf492945cb8f30fcb2467e9d26836de7ff6d8 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 Nov 2014 13:55:01 +0100
Subject: [PATCH 2/7] LDAP: add support for lookups by UUID

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/data_provider.h |  2 ++
 src/providers/ldap/ldap_id.c  | 58 +++++++++++++++++++++++++++++++++++++++----
 2 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index e1cb4be..5df493e 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -127,6 +127,7 @@
 #define BE_FILTER_IDNUM 2
 #define BE_FILTER_ENUM 3
 #define BE_FILTER_SECID 4
+#define BE_FILTER_UUID 5
 
 #define BE_REQ_USER          0x0001
 #define BE_REQ_GROUP         0x0002
@@ -139,6 +140,7 @@
 #define BE_REQ_HOST          0x0010
 #define BE_REQ_BY_SECID      0x0011
 #define BE_REQ_USER_AND_GROUP 0x0012
+#define BE_REQ_BY_UUID      0x0013
 #define BE_REQ_TYPE_MASK     0x00FF
 #define BE_REQ_FAST          0x1000
 
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index e8b3a0e..2e58f4e 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -179,6 +179,20 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,
             goto done;
         }
         break;
+    case BE_FILTER_UUID:
+        attr_name = ctx->opts->user_map[SDAP_AT_USER_UUID].name;
+        if (attr_name == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "UUID search not configured for this backend.\n");
+            ret = EINVAL;
+            goto done;
+        }
+
+        ret = sss_filter_sanitize(state, name, &clean_name);
+        if (ret != EOK) {
+            goto done;
+        }
+        break;
     default:
         ret = EINVAL;
         goto done;
@@ -458,8 +472,9 @@ static void users_get_done(struct tevent_req *subreq)
             break;
 
         case BE_FILTER_SECID:
-            /* Since it is not clear if the SID belongs to a user or a group
-             * we have nothing to do here. */
+        case BE_FILTER_UUID:
+            /* Since it is not clear if the SID/UUID belongs to a user or a
+             * group we have nothing to do here. */
             break;
 
         default:
@@ -635,6 +650,20 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,
             goto done;
         }
         break;
+    case BE_FILTER_UUID:
+        attr_name = ctx->opts->group_map[SDAP_AT_GROUP_UUID].name;
+        if (attr_name == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "UUID search not configured for this backend.\n");
+            ret = EINVAL;
+            goto done;
+        }
+
+        ret = sss_filter_sanitize(state, name, &clean_name);
+        if (ret != EOK) {
+            goto done;
+        }
+        break;
     default:
         ret = EINVAL;
         goto done;
@@ -884,8 +913,9 @@ static void groups_get_done(struct tevent_req *subreq)
             break;
 
         case BE_FILTER_SECID:
-            /* Since it is not clear if the SID belongs to a user or a group
-             * we have nothing to do here. */
+        case BE_FILTER_UUID:
+            /* Since it is not clear if the SID/UUID belongs to a user or a
+             * group we have nothing to do here. */
             break;
 
         default:
@@ -1401,7 +1431,8 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
             goto done;
         }
 
-        if (ar->filter_type == BE_FILTER_SECID) {
+        if (ar->filter_type == BE_FILTER_SECID
+                || ar->filter_type == BE_FILTER_UUID) {
             ret = EINVAL;
             state->err = "Invalid filter type";
             goto done;
@@ -1430,6 +1461,21 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
                                          noexist_delete);
         break;
 
+    case BE_REQ_BY_UUID:
+        if (ar->filter_type != BE_FILTER_UUID) {
+            ret = EINVAL;
+            state->err = "Invalid filter type";
+            goto done;
+        }
+
+        subreq = get_user_and_group_send(breq, be_ctx->ev, id_ctx,
+                                         sdom, conn,
+                                         ar->filter_value,
+                                         ar->filter_type,
+                                         ar->attr_type,
+                                         noexist_delete);
+        break;
+
     case BE_REQ_USER_AND_GROUP:
         if (!(ar->filter_type == BE_FILTER_NAME ||
               ar->filter_type == BE_FILTER_IDNUM)) {
@@ -1504,6 +1550,8 @@ sdap_handle_acct_req_done(struct tevent_req *subreq)
         break;
     case BE_REQ_BY_SECID:
         /* Fallthrough */
+    case BE_REQ_BY_UUID:
+        /* Fallthrough */
     case BE_REQ_USER_AND_GROUP:
         err = "Lookup by SID failed";
         ret = sdap_get_user_and_group_recv(subreq, &state->dp_error,
-- 
1.8.3.1

-------------- next part --------------
From 15ea0a84cc1d1ded27c6f84ac563b7902f203526 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 Nov 2014 21:33:36 +0100
Subject: [PATCH 3/7] LDAP: always store UUID if available

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ldap/sdap_async_groups.c | 20 ++++++++++++++++++++
 src/providers/ldap/sdap_async_users.c  | 19 +++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index a82d2aa..dc1b60d 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -511,6 +511,7 @@ static int sdap_save_group(TALLOC_CTX *memctx,
     bool posix_group;
     bool use_id_mapping;
     char *sid_str;
+    const char *uuid;
     struct sss_domain_info *subdomain;
     int32_t ad_group_type;
 
@@ -547,6 +548,25 @@ static int sdap_save_group(TALLOC_CTX *memctx,
         sid_str = NULL;
     }
 
+    /* Always store UUID if available */
+    ret = sysdb_attrs_get_string(attrs,
+                                 opts->group_map[SDAP_AT_GROUP_UUID].sys_name,
+                                 &uuid);
+    if (ret == EOK) {
+        ret = sysdb_attrs_add_string(group_attrs, SYSDB_UUID, uuid);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE, "Could not add UUID string: [%s]\n",
+                                         strerror(ret));
+            goto done;
+        }
+    } else if (ret == ENOENT) {
+        DEBUG(SSSDBG_TRACE_ALL, "UUID not available for group [%s].\n",
+                                 group_name);
+    } else {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Could not identify UUID [%s]\n",
+                                     strerror(ret));
+    }
+
     /* If this object has a SID available, we will determine the correct
      * domain by its SID. */
     if (sid_str != NULL) {
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index 2331ba9..c6da5c1 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -140,6 +140,7 @@ int sdap_save_user(TALLOC_CTX *memctx,
     TALLOC_CTX *tmpctx = NULL;
     bool use_id_mapping;
     char *sid_str;
+    const char *uuid;
     char *dom_sid_str = NULL;
     struct sss_domain_info *subdomain;
 
@@ -177,6 +178,24 @@ int sdap_save_user(TALLOC_CTX *memctx,
         sid_str = NULL;
     }
 
+    /* Always store UUID if available */
+    ret = sysdb_attrs_get_string(attrs,
+                                 opts->user_map[SDAP_AT_USER_UUID].sys_name,
+                                 &uuid);
+    if (ret == EOK) {
+        ret = sysdb_attrs_add_string(user_attrs, SYSDB_UUID, uuid);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_MINOR_FAILURE, "Could not add UUID string: [%s]\n",
+                                         strerror(ret));
+            goto done;
+        }
+    } else if (ret == ENOENT) {
+        DEBUG(SSSDBG_TRACE_ALL, "UUID not available for user.\n");
+    } else {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Could not identify UUID [%s]\n",
+                                     strerror(ret));
+    }
+
     /* If this object has a SID available, we will determine the correct
      * domain by its SID. */
     if (sid_str != NULL) {
-- 
1.8.3.1

-------------- next part --------------
From 3adf966d906cf491f7ca852bb36921fc05542dbf Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 Nov 2014 15:05:41 +0100
Subject: [PATCH 4/7] ipa: add get_be_acct_req_for_uuid()

This new call creates the needs data for a lookup by UUID which is
needed when trying to find the original object for an IPA override
object.

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ipa/ipa_id.h    |  4 ++++
 src/providers/ipa/ipa_views.c | 42 ++++++++++++++++++++++++++++++++++++------
 2 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index 033ac40..890d00d 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -83,6 +83,10 @@ errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,
                                 const char *domain_name,
                                 struct be_acct_req **_ar);
 
+errno_t get_be_acct_req_for_uuid(TALLOC_CTX *mem_ctx, const char *uuid,
+                                 const char *domain_name,
+                                 struct be_acct_req **_ar);
+
 struct tevent_req *ipa_get_ad_override_send(TALLOC_CTX *mem_ctx,
                                             struct tevent_context *ev,
                                             struct sdap_id_ctx *sdap_id_ctx,
diff --git a/src/providers/ipa/ipa_views.c b/src/providers/ipa/ipa_views.c
index 2eb7721..ee58689 100644
--- a/src/providers/ipa/ipa_views.c
+++ b/src/providers/ipa/ipa_views.c
@@ -140,9 +140,10 @@ static errno_t be_acct_req_to_override_filter(TALLOC_CTX *mem_ctx,
     return EOK;
 }
 
-errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,
-                                const char *domain_name,
-                                struct be_acct_req **_ar)
+static errno_t get_be_acct_req_for_xyz(TALLOC_CTX *mem_ctx, const char *val,
+                                       const char *domain_name,
+                                       int type,
+                                       struct be_acct_req **_ar)
 {
     struct be_acct_req *ar;
 
@@ -152,9 +153,22 @@ errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,
         return ENOMEM;
     }
 
-    ar->entry_type = BE_REQ_BY_SECID;
-    ar->filter_type = BE_FILTER_SECID;
-    ar->filter_value = talloc_strdup(ar, sid);
+    switch (type) {
+    case BE_REQ_BY_SECID:
+        ar->entry_type = BE_REQ_BY_SECID;
+        ar->filter_type = BE_FILTER_SECID;
+        break;
+    case BE_REQ_BY_UUID:
+        ar->entry_type = BE_REQ_BY_UUID;
+        ar->filter_type = BE_FILTER_UUID;
+        break;
+    default:
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported request type [%d].\n", type);
+        talloc_free(ar);
+        return EINVAL;
+    }
+
+    ar->filter_value = talloc_strdup(ar, val);
     ar->domain = talloc_strdup(ar, domain_name);
     if (ar->filter_value == NULL || ar->domain == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
@@ -168,6 +182,22 @@ errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,
     return EOK;
 }
 
+errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,
+                                const char *domain_name,
+                                struct be_acct_req **_ar)
+{
+    return get_be_acct_req_for_xyz(mem_ctx, sid, domain_name, BE_REQ_BY_SECID,
+                                   _ar);
+}
+
+errno_t get_be_acct_req_for_uuid(TALLOC_CTX *mem_ctx, const char *uuid,
+                                 const char *domain_name,
+                                 struct be_acct_req **_ar)
+{
+    return get_be_acct_req_for_xyz(mem_ctx, uuid, domain_name, BE_REQ_BY_UUID,
+                                   _ar);
+}
+
 struct ipa_get_ad_override_state {
     struct tevent_context *ev;
     struct sdap_id_ctx *sdap_id_ctx;
-- 
1.8.3.1

-------------- next part --------------
From 9047069105444545a2f5dc0be3ef30d4c43689d1 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 Nov 2014 21:34:55 +0100
Subject: [PATCH 5/7] IPA: make get_object_from_cache() public

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ipa/ipa_id.h            | 5 +++++
 src/providers/ipa/ipa_subdomains_id.c | 9 +++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index 890d00d..9d219f2 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -109,4 +109,9 @@ errno_t ipa_subdomain_account_recv(struct tevent_req *req, int *dp_error_out);
 
 errno_t split_ipa_anchor(TALLOC_CTX *mem_ctx, const char *anchor,
                          char **_anchor_domain, char **_ipa_uuid);
+
+errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
+                              struct sss_domain_info *dom,
+                              struct be_acct_req *ar,
+                              struct ldb_message **_msg);
 #endif
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 0d00d09..dd1eae1 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -848,10 +848,10 @@ done:
     return ret;
 }
 
-static errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
-                                     struct sss_domain_info *dom,
-                                     struct be_acct_req *ar,
-                                     struct ldb_message **_msg)
+errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
+                              struct sss_domain_info *dom,
+                              struct be_acct_req *ar,
+                              struct ldb_message **_msg)
 {
     errno_t ret;
     uint32_t id;
@@ -861,6 +861,7 @@ static errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
                             SYSDB_UIDNUM,
                             SYSDB_SID_STR,
                             SYSDB_OBJECTCLASS,
+                            SYSDB_UUID,
                             NULL };
     char *name;
 
-- 
1.8.3.1

-------------- next part --------------
From 9286597c2ed35db04403f72caa75bbfb966cae9b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 5 Nov 2014 15:58:04 +0100
Subject: [PATCH 6/7] IPA: check overrrides for IPA users as well

Currently overrides were only available for sub-domains, e.g. trusted AD
domains. With this patch overrides can be used for IPA users as well.

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ipa/ipa_id.c            | 406 +++++++++++++++++++++++++++++++++-
 src/providers/ipa/ipa_subdomains_id.c |  16 ++
 src/providers/ipa/ipa_views.c         |  15 ++
 3 files changed, 435 insertions(+), 2 deletions(-)

diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
index cd65f5b..fe14c33 100644
--- a/src/providers/ipa/ipa_id.c
+++ b/src/providers/ipa/ipa_id.c
@@ -56,6 +56,13 @@ static const char *ipa_account_info_error_text(int ret, int *dp_error,
     return default_text;
 }
 
+static struct tevent_req *
+ipa_id_get_account_info_send(TALLOC_CTX *memctx, struct tevent_context *ev,
+                             struct ipa_id_ctx *ipa_ctx, struct be_req *be_req,
+                             struct be_acct_req *ar);
+
+static int ipa_id_get_account_info_recv(struct tevent_req *req, int *dp_error);
+
 static struct tevent_req *ipa_id_get_netgroup_send(TALLOC_CTX *memctx,
                                                    struct tevent_context *ev,
                                                    struct ipa_id_ctx *ipa_ctx,
@@ -100,7 +107,9 @@ void ipa_account_info_handler(struct be_req *breq)
     } else {
         /* any account request is handled by sdap,
          * any invalid request is caught there. */
-        return sdap_handle_account_info(breq, ctx, ctx->conn);
+
+        req = ipa_id_get_account_info_send(breq, be_ctx->ev, ipa_ctx, breq,
+                                           ar);
     }
 
     if (!req) {
@@ -115,13 +124,18 @@ static void ipa_account_info_done(struct tevent_req *req)
     struct be_req *breq = tevent_req_callback_data(req, struct be_req);
     struct be_acct_req *ar = talloc_get_type(be_req_get_data(breq),
                                              struct be_acct_req);
+    struct be_ctx *be_ctx = be_req_get_be_ctx(breq);
     const char *error_text;
     int ret, dp_error;
 
     if ((ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_NETGROUP) {
         ret = ipa_id_get_netgroup_recv(req, &dp_error);
     } else {
-        ret = ipa_subdomain_account_recv(req, &dp_error);
+        if (strcasecmp(ar->domain, be_ctx->domain->name) != 0) {
+            ret = ipa_subdomain_account_recv(req, &dp_error);
+        } else {
+            ret = ipa_id_get_account_info_recv(req, &dp_error);
+        }
     }
     talloc_zfree(req);
 
@@ -130,6 +144,394 @@ static void ipa_account_info_done(struct tevent_req *req)
     sdap_handler_done(breq, dp_error, ret, error_text);
 }
 
+struct ipa_id_get_account_info_state {
+    struct tevent_context *ev;
+    struct ipa_id_ctx *ipa_ctx;
+    struct sdap_id_ctx *ctx;
+    struct sdap_id_op *op;
+    struct sysdb_ctx *sysdb;
+    struct sss_domain_info *domain;
+    struct be_req *be_req;
+    struct be_acct_req *ar;
+    const char *realm;
+
+    struct sysdb_attrs *override_attrs;
+    struct ldb_message *obj_msg;
+    int dp_error;
+};
+
+static void ipa_id_get_account_info_connected(struct tevent_req *subreq);
+static void ipa_id_get_account_info_got_override(struct tevent_req *subreq);
+static errno_t ipa_id_get_account_info_get_original_step(struct tevent_req *req,
+                                                        struct be_acct_req *ar);
+static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq);
+static void ipa_id_get_account_info_done(struct tevent_req *subreq);
+
+static struct tevent_req *
+ipa_id_get_account_info_send(TALLOC_CTX *memctx, struct tevent_context *ev,
+                             struct ipa_id_ctx *ipa_ctx, struct be_req *be_req,
+                             struct be_acct_req *ar)
+{
+    int ret;
+    struct tevent_req *req;
+    struct tevent_req *subreq;
+    struct ipa_id_get_account_info_state *state;
+
+    req = tevent_req_create(memctx, &state,
+                            struct ipa_id_get_account_info_state);
+    if (req == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");
+        return NULL;
+    }
+
+    state->ev = ev;
+    state->ipa_ctx = ipa_ctx;
+    state->ctx = ipa_ctx->sdap_id_ctx;
+    state->dp_error = DP_ERR_FATAL;
+
+    state->op = sdap_id_op_create(state, state->ctx->conn->conn_cache);
+    if (state->op == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed.\n");
+        ret = ENOMEM;
+        goto fail;
+    }
+
+    state->domain = find_domain_by_name(state->ctx->be->domain,
+                                        ar->domain, true);
+    if (state->domain == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "find_domain_by_name failed.\n");
+        ret = ENOMEM;
+        goto fail;
+    }
+    state->sysdb = state->domain->sysdb;
+    state->be_req = be_req;
+    state->ar = ar;
+    state->realm = dp_opt_get_string(state->ipa_ctx->ipa_options->basic,
+                                     IPA_KRB5_REALM);
+    if (state->realm == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "No Kerberos realm for IPA?\n");
+        ret = EINVAL;
+        goto fail;
+    }
+
+    /* We can skip the override lookup and go directly to the original object
+     * if
+     * - the lookup is by SID
+     * - there is no view set of it is the default view
+     * - if the EXTRA_INPUT_MAYBE_WITH_VIEW flag is not set
+     */
+    if (state->ipa_ctx->view_name == NULL
+            || state->ar->filter_type == BE_FILTER_SECID
+            || strcmp(state->ipa_ctx->view_name,
+                      SYSDB_DEFAULT_VIEW_NAME) == 0
+            || state->ar->extra_value == NULL
+            || strcmp(state->ar->extra_value,
+                      EXTRA_INPUT_MAYBE_WITH_VIEW) != 0 ) {
+        ret = ipa_id_get_account_info_get_original_step(req, ar);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "ipa_subdomain_account_get_original_step failed.\n");
+            goto fail;
+        }
+    } else {
+        subreq = sdap_id_op_connect_send(state->op, state, &ret);
+        if (subreq == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect_send failed.\n");
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, ipa_id_get_account_info_connected, req);
+    }
+
+    return req;
+
+fail:
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static void ipa_id_get_account_info_connected(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    int dp_error = DP_ERR_FATAL;
+    int ret;
+
+    ret = sdap_id_op_connect_recv(subreq, &dp_error);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect request failed.\n");
+        goto fail;
+    }
+
+    subreq = ipa_get_ad_override_send(state, state->ev, state->ctx,
+                                      state->ipa_ctx->ipa_options, state->realm,
+                                      state->ipa_ctx->view_name, state->ar);
+    if (subreq == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_override_send failed.\n");
+        ret = ENOMEM;
+        goto fail;
+    }
+
+    tevent_req_set_callback(subreq, ipa_id_get_account_info_got_override, req);
+
+    return;
+
+fail:
+    state->dp_error = dp_error;
+    tevent_req_error(req, ret);
+    return;
+}
+
+static void ipa_id_get_account_info_got_override(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    int dp_error = DP_ERR_FATAL;
+    int ret;
+    const char *anchor = NULL;
+    char *anchor_domain;
+    char *ipa_uuid;
+
+    ret = ipa_get_ad_override_recv(subreq, &dp_error, state,
+                                   &state->override_attrs);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "IPA override lookup failed: %d\n", ret);
+        goto fail;
+    }
+
+    if (state->override_attrs != NULL) {
+        ret = sysdb_attrs_get_string(state->override_attrs,
+                                     SYSDB_OVERRIDE_ANCHOR_UUID,
+                                     &anchor);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n");
+            goto fail;
+        }
+
+        ret = split_ipa_anchor(state, anchor, &anchor_domain, &ipa_uuid);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Unsupported override anchor [%s].\n", anchor);
+            ret = EINVAL;
+            goto fail;
+        }
+
+        if (strcmp(state->ar->domain, anchor_domain) == 0) {
+
+            ret = get_be_acct_req_for_uuid(state, ipa_uuid,
+                                           state->ar->domain,
+                                           &state->ar);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
+                goto fail;
+            }
+        } else {
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  "Anchor from a different domain [%s], expected [%s]. " \
+                  "This is currently not supported, continue lookup in " \
+                  "local IPA domain.\n",
+                  anchor_domain, state->ar->domain);
+        }
+    }
+
+    ret = ipa_id_get_account_info_get_original_step(req, state->ar);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "ipa_subdomain_account_get_original_step failed.\n");
+        goto fail;
+    }
+
+    return;
+
+fail:
+    state->dp_error = dp_error;
+    tevent_req_error(req, ret);
+    return;
+}
+
+static errno_t ipa_id_get_account_info_get_original_step(struct tevent_req *req,
+                                                         struct be_acct_req *ar)
+{
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    struct tevent_req *subreq;
+    int ret;
+
+    subreq = sdap_handle_acct_req_send(state, state->be_req, ar,
+                                       state->ipa_ctx->sdap_id_ctx,
+                                       state->ipa_ctx->sdap_id_ctx->opts->sdom,
+                                       state->ipa_ctx->sdap_id_ctx->conn, true);
+    if (subreq == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct_req_send failed.\n");
+        return ENOMEM;
+    }
+    tevent_req_set_callback(subreq, ipa_id_get_account_info_orig_done, req);
+
+    return EOK;
+}
+
+static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    int dp_error = DP_ERR_FATAL;
+    int ret;
+    const char *uuid;
+    const char *class;
+    enum sysdb_member_type type;
+
+    ret = sdap_handle_acct_req_recv(subreq, &dp_error, NULL, NULL);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct request failed: %d\n", ret);
+        goto fail;
+    }
+
+    ret = get_object_from_cache(state, state->domain, state->ar,
+                                &state->obj_msg);
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Object not found, ending request\n");
+        tevent_req_done(req);
+        return;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "get_object_from_cache failed.\n");
+        goto fail;
+    }
+
+    if (state->override_attrs == NULL) {
+        uuid = ldb_msg_find_attr_as_string(state->obj_msg, SYSDB_UUID, NULL);
+        if (uuid == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot find a UUID.\n");
+            ret = EINVAL;
+            goto fail;
+        }
+
+        ret = get_be_acct_req_for_uuid(state, uuid, state->domain->name,
+                                       &state->ar);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
+            goto fail;
+        }
+
+        subreq = ipa_get_ad_override_send(state, state->ev,
+                                          state->ipa_ctx->sdap_id_ctx,
+                                          state->ipa_ctx->ipa_options,
+                                          state->realm,
+                                          state->ipa_ctx->view_name,
+                                          state->ar);
+        if (subreq == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_override_send failed.\n");
+            ret = ENOMEM;
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, ipa_id_get_account_info_done, req);
+        return;
+    } else {
+        class = ldb_msg_find_attr_as_string(state->obj_msg, SYSDB_OBJECTCLASS,
+                                            NULL);
+        if (class == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot find an objectclass.\n");
+            ret = EINVAL;
+            goto fail;
+        }
+
+        if (strcmp(class, SYSDB_USER_CLASS) == 0) {
+            type = SYSDB_MEMBER_USER;
+        } else {
+            type = SYSDB_MEMBER_GROUP;
+        }
+
+        ret = sysdb_store_override(state->domain, state->ipa_ctx->view_name,
+                                   type,
+                                   state->override_attrs, state->obj_msg->dn);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
+            goto fail;
+        }
+    }
+
+    state->dp_error = DP_ERR_OK;
+    tevent_req_done(req);
+    return;
+
+fail:
+    state->dp_error = dp_error;
+    tevent_req_error(req, ret);
+    return;
+}
+
+static void ipa_id_get_account_info_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    int dp_error = DP_ERR_FATAL;
+    int ret;
+    const char *class;
+    enum sysdb_member_type type;
+
+    ret = ipa_get_ad_override_recv(subreq, &dp_error, state,
+                                   &state->override_attrs);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "IPA override lookup failed: %d\n", ret);
+        goto fail;
+    }
+
+    class = ldb_msg_find_attr_as_string(state->obj_msg, SYSDB_OBJECTCLASS,
+                                        NULL);
+    if (class == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot find an objectclass.\n");
+        ret = EINVAL;
+        goto fail;
+    }
+
+    if (strcmp(class, SYSDB_USER_CLASS) == 0) {
+        type = SYSDB_MEMBER_USER;
+    } else {
+        type = SYSDB_MEMBER_GROUP;
+    }
+
+    ret = sysdb_store_override(state->domain, state->ipa_ctx->view_name,
+                               type,
+                               state->override_attrs, state->obj_msg->dn);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
+        goto fail;
+    }
+
+    state->dp_error = DP_ERR_OK;
+    tevent_req_done(req);
+    return;
+
+fail:
+    state->dp_error = dp_error;
+    tevent_req_error(req, ret);
+    return;
+}
+
+static int ipa_id_get_account_info_recv(struct tevent_req *req, int *dp_error)
+{
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+
+    if (dp_error) {
+        *dp_error = state->dp_error;
+    }
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+
+    return EOK;
+}
 
 /* Request for netgroups
  * - first start here and then go to ipa_netgroups.c
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index dd1eae1..2f74798 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -881,6 +881,22 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
+    if (ar->filter_type == BE_FILTER_UUID) {
+        ret = sysdb_search_object_by_uuid(mem_ctx, dom, ar->filter_value, attrs,
+                                          &res);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Failed to make request to our cache: [%d]: [%s]\n",
+                   ret, sss_strerror(ret));
+            goto done;
+        }
+
+        *_msg = res->msgs[0];
+
+        ret = EOK;
+        goto done;
+    }
+
     if (ar->filter_type == BE_FILTER_IDNUM) {
         errno = 0;
         id = strtouint32(ar->filter_value, NULL, 10);
diff --git a/src/providers/ipa/ipa_views.c b/src/providers/ipa/ipa_views.c
index ee58689..c768186 100644
--- a/src/providers/ipa/ipa_views.c
+++ b/src/providers/ipa/ipa_views.c
@@ -125,6 +125,21 @@ static errno_t be_acct_req_to_override_filter(TALLOC_CTX *mem_ctx,
         }
         break;
 
+    case BE_FILTER_UUID:
+        if ((ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_BY_UUID) {
+            filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=:IPA:%s:%s))",
+                       ipa_opts->override_map[IPA_OC_OVERRIDE].name,
+                       ipa_opts->override_map[IPA_AT_OVERRIDE_ANCHOR_UUID].name,
+                       dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN),
+                       ar->filter_value);
+        } else {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Unexpected entry type [%d] for UUID filter.\n",
+                  ar->entry_type);
+            return EINVAL;
+        }
+        break;
+
     default:
         DEBUG(SSSDBG_OP_FAILURE, "Invalid sub-domain filter type.\n");
         return EINVAL;
-- 
1.8.3.1

-------------- next part --------------
From d3d3d51a1d49936c9ad1a3733388bfd384fd07c4 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 Nov 2014 21:36:12 +0100
Subject: [PATCH 7/7] Enable views for all domains

Currently views and overrides were only available for sub-domains, this
patch enables the lookup for the configured domains as well.

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/util/util.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/util/util.h b/src/util/util.h
index ffc8a87..7c335b9 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -574,8 +574,7 @@ errno_t sssd_domain_init(TALLOC_CTX *mem_ctx,
 
 #define IS_SUBDOMAIN(dom) ((dom)->parent != NULL)
 
-/* Currently views are only supported for subdomains */
-#define DOM_HAS_VIEWS(dom) ((dom)->has_views && IS_SUBDOMAIN(dom))
+#define DOM_HAS_VIEWS(dom) ((dom)->has_views)
 
 errno_t sss_write_domain_mappings(struct sss_domain_info *domain);
 
-- 
1.8.3.1



More information about the sssd-devel mailing list