[SSSD] [PATCH] IPA: Handle IPA groups returned from extop plugin

Jakub Hrozek jhrozek at redhat.com
Mon Nov 24 15:50:01 UTC 2014


Hi,

I was testing with a subdomain user who was a member of IPA group and
found out the extdom plugin didn't handle the IPA group well, because
the group name wasn't qualified.

Is handling this situation on the client (as opposed to changing the
server so that all group names are qualified) the right approach?
-------------- next part --------------
>From eaa1e18469232fab5583872d5aecfebef4e616c1 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 23 Nov 2014 20:47:59 +0100
Subject: [PATCH] IPA: Handle IPA groups returned from extop plugin

---
 src/providers/ipa/ipa_s2n_exop.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 2c31120b196353df52c87ef5b924a80bda134a17..0eab1afc36e4d2c1d770c596c512a641fd276425 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -960,10 +960,15 @@ static errno_t ipa_s2n_get_groups_step(struct tevent_req *req)
         return ret;
     }
 
-    state->obj_domain = find_domain_by_name(parent_domain, domain_name, true);
-    if (state->obj_domain == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, "find_domain_by_name failed.\n");
-        return ENOMEM;
+    if (domain_name) {
+        state->obj_domain = find_domain_by_name(parent_domain,
+                                                domain_name, true);
+        if (state->obj_domain == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "find_domain_by_name failed.\n");
+            return ENOMEM;
+        }
+    } else {
+        state->obj_domain = parent_domain;
     }
 
     state->req_input.inp.name = group_name;
-- 
1.9.3



More information about the sssd-devel mailing list