[SSSD] [PATCHES] krb5: make krb5 provider view aware

Sumit Bose sbose at redhat.com
Thu Nov 27 16:41:57 UTC 2014


Hi,

this patchset makes the krb5 provider view-aware. All needed
functionality is in the 1st patch. 2nd makes sure the view data is only
update when there is a change and the 3rd makes a check in the
krb5_child more relaxed. This needed when the client gets a different
view and the UID of a user changes. In this case and old ccache cannot
be read by the user anymore and we should not fail in this case.

bye,
Sumit
-------------- next part --------------
From c286c4e040b0ffaf30e348d4ccd0c4fd50c959d6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 10:01:40 +0100
Subject: [PATCH 1/3] krb5: make krb5 provider view aware

---
 src/providers/ipa/ipa_subdomains.c | 13 +++++++++++++
 src/providers/krb5/krb5_auth.c     | 18 ++++++++++++------
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 6fdb0be..d053d46 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1174,6 +1174,19 @@ static void ipa_get_view_name_done(struct tevent_req *req)
                 DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
             }
         }
+
+        /* TODO: only needed if view changed */
+        ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_master_domain_update failed.\n");
+            goto done;
+        }
+
+        ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
+            goto done;
+        }
     }
 
     ret = ipa_check_master(ctx);
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index e791aee..e43b365 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -462,8 +462,8 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
     }
     kr = state->kr;
 
-    ret = sysdb_get_user_attr(state, state->domain, state->pd->user, attrs,
-                              &res);
+    ret = sysdb_get_user_attr_with_views(state, state->domain, state->pd->user,
+                                         attrs, &res);
     if (ret) {
         DEBUG(SSSDBG_FUNC_DATA,
               "sysdb search for upn of user [%s] failed.\n", pd->user);
@@ -503,14 +503,18 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
             goto done;
         }
 
-        kr->homedir = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_HOMEDIR,
-                                                  NULL);
+        kr->homedir = sss_view_ldb_msg_find_attr_as_string(state->domain,
+                                                           res->msgs[0],
+                                                           SYSDB_HOMEDIR,
+                                                           NULL);
         if (kr->homedir == NULL) {
             DEBUG(SSSDBG_CONF_SETTINGS,
                   "Home directory for user [%s] not known.\n", pd->user);
         }
 
-        kr->uid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_UIDNUM, 0);
+        kr->uid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
+                                                       res->msgs[0],
+                                                       SYSDB_UIDNUM, 0);
         if (kr->uid == 0) {
             DEBUG(SSSDBG_CONF_SETTINGS,
                   "UID for user [%s] not known.\n", pd->user);
@@ -518,7 +522,9 @@ struct tevent_req *krb5_auth_send(TALLOC_CTX *mem_ctx,
             goto done;
         }
 
-        kr->gid = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_GIDNUM, 0);
+        kr->gid = sss_view_ldb_msg_find_attr_as_uint64(state->domain,
+                                                       res->msgs[0],
+                                                       SYSDB_GIDNUM, 0);
         if (kr->gid == 0) {
             DEBUG(SSSDBG_CONF_SETTINGS,
                   "GID for user [%s] not known.\n", pd->user);
-- 
1.8.3.1

-------------- next part --------------
From 8d16df2271fb0b10287c8fdbfd72cdbb86d8443b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 13:41:37 +0100
Subject: [PATCH 2/3] IPA: only update view data if it really changed

---
 src/providers/ipa/ipa_subdomains.c | 116 +++++++++++++++++++++----------------
 1 file changed, 66 insertions(+), 50 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index d053d46..3148389 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1110,23 +1110,44 @@ static void ipa_get_view_name_done(struct tevent_req *req)
               "View name changed, this is not supported at runtime. " \
               "Please restart SSSD to get the new view applied.\n");
     } else {
-        ctx->sd_ctx->view_read_at_init = true;
-        /* View name changed */
-        if (ctx->sd_ctx->id_ctx->view_name != NULL) {
-            ret = sysdb_transaction_start(ctx->sd_ctx->be_ctx->domain->sysdb);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_start failed.\n");
-                goto done;
-            }
+        if (ctx->sd_ctx->id_ctx->view_name == NULL
+            || strcmp(ctx->sd_ctx->id_ctx->view_name, view_name) != 0) {
+            /* View name changed */
+
+            if (ctx->sd_ctx->id_ctx->view_name != NULL) {
+                ret = sysdb_transaction_start(
+                                            ctx->sd_ctx->be_ctx->domain->sysdb);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_OP_FAILURE,
+                          "sysdb_transaction_start failed.\n");
+                    goto done;
+                }
 
-            if (strcmp(ctx->sd_ctx->id_ctx->view_name,
-                       SYSDB_DEFAULT_VIEW_NAME) != 0) {
-                /* Old view was not the default view, delete view tree */
-                ret = sysdb_delete_view_tree(ctx->sd_ctx->be_ctx->domain->sysdb,
+                if (strcmp(ctx->sd_ctx->id_ctx->view_name,
+                           SYSDB_DEFAULT_VIEW_NAME) != 0) {
+                    /* Old view was not the default view, delete view tree */
+                    ret = sysdb_delete_view_tree(
+                                             ctx->sd_ctx->be_ctx->domain->sysdb,
                                              ctx->sd_ctx->id_ctx->view_name);
+                    if (ret != EOK) {
+                        DEBUG(SSSDBG_OP_FAILURE,
+                              "sysdb_delete_view_tree failed.\n");
+                        sret = sysdb_transaction_cancel(
+                                            ctx->sd_ctx->be_ctx->domain->sysdb);
+                        if (sret != EOK) {
+                            DEBUG(SSSDBG_OP_FAILURE,
+                                  "sysdb_transaction_cancel failed.\n");
+                            goto done;
+                        }
+                        goto done;
+                    }
+                }
+
+                ret = sysdb_invalidate_overrides(
+                                            ctx->sd_ctx->be_ctx->domain->sysdb);
                 if (ret != EOK) {
                     DEBUG(SSSDBG_OP_FAILURE,
-                          "sysdb_delete_view_tree failed.\n");
+                          "sysdb_invalidate_overrides failed.\n");
                     sret = sysdb_transaction_cancel(
                                             ctx->sd_ctx->be_ctx->domain->sysdb);
                     if (sret != EOK) {
@@ -1136,57 +1157,52 @@ static void ipa_get_view_name_done(struct tevent_req *req)
                     }
                     goto done;
                 }
-            }
 
-            ret = sysdb_invalidate_overrides(
+                ret = sysdb_transaction_commit(
                                             ctx->sd_ctx->be_ctx->domain->sysdb);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_OP_FAILURE,
-                      "sysdb_invalidate_overrides failed.\n");
-                sret = sysdb_transaction_cancel(
-                                            ctx->sd_ctx->be_ctx->domain->sysdb);
-                if (sret != EOK) {
-                    DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_cancel failed.\n");
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_OP_FAILURE,
+                                          "sysdb_transaction_commit failed.\n");
                     goto done;
                 }
-                goto done;
+
+                /* TODO: start referesh task */
             }
 
-            ret = sysdb_transaction_commit(ctx->sd_ctx->be_ctx->domain->sysdb);
+            ret = sysdb_update_view_name(ctx->sd_ctx->be_ctx->domain->sysdb,
+                                         view_name);
             if (ret != EOK) {
-                DEBUG(SSSDBG_OP_FAILURE, "sysdb_transaction_commit failed.\n");
-                goto done;
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      "Cannot add/update view name to sysdb.\n");
+            } else {
+                talloc_free(ctx->sd_ctx->id_ctx->view_name);
+                ctx->sd_ctx->id_ctx->view_name = talloc_strdup(
+                                                            ctx->sd_ctx->id_ctx,
+                                                            view_name);
+                if (ctx->sd_ctx->id_ctx->view_name == NULL) {
+                    DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
+                }
             }
-
-            /* TODO: start referesh task */
         }
 
-        ret = sysdb_update_view_name(ctx->sd_ctx->be_ctx->domain->sysdb,
-                                     view_name);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_CRIT_FAILURE,
-                  "Cannot add/update view name to sysdb.\n");
-        } else {
-            talloc_free(ctx->sd_ctx->id_ctx->view_name);
-            ctx->sd_ctx->id_ctx->view_name = talloc_strdup(ctx->sd_ctx->id_ctx,
-                                                           view_name);
-            if (ctx->sd_ctx->id_ctx->view_name == NULL) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "Cannot copy view name.\n");
+        if (!ctx->sd_ctx->view_read_at_init) {
+            /* refresh view data of all domains at startup */
+            ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE,
+                      "sysdb_master_domain_update failed.\n");
+                goto done;
             }
-        }
 
-        /* TODO: only needed if view changed */
-        ret = sysdb_master_domain_update(ctx->sd_ctx->be_ctx->domain);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, "sysdb_master_domain_update failed.\n");
-            goto done;
+            ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
+                goto done;
+            }
         }
 
-        ret = sysdb_update_subdomains(ctx->sd_ctx->be_ctx->domain);
-        if (ret != EOK) {
-            DEBUG(SSSDBG_OP_FAILURE, "sysdb_update_subdomains failed.\n");
-            goto done;
-        }
+        ctx->sd_ctx->view_read_at_init = true;
+
     }
 
     ret = ipa_check_master(ctx);
-- 
1.8.3.1

-------------- next part --------------
From ad3ce954c086ca8882c20d4fe22b5202efcbff72 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 27 Nov 2014 13:42:19 +0100
Subject: [PATCH 3/3] krb5: do not fail if checking the old ccache failed

---
 Makefile.am                     | 1 +
 src/providers/krb5/krb5_child.c | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 56a562c..130c647 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2505,6 +2505,7 @@ krb5_child_SOURCES = \
     src/util/signal.c \
     src/util/strtonum.c \
     src/util/become_user.c \
+    src/util/util_errors.c \
     src/sss_client/common.c \
     $(NULL)
 krb5_child_CFLAGS = \
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 94cd34e..d828dd5 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -34,6 +34,7 @@
 #include "util/user_info_msg.h"
 #include "util/child_common.h"
 #include "util/find_uid.h"
+#include "src/util/util_errors.h"
 #include "providers/dp_backend.h"
 #include "providers/krb5/krb5_auth.h"
 #include "providers/krb5/krb5_utils.h"
@@ -2039,8 +2040,10 @@ static int k5c_ccache_setup(struct krb5_req *kr, uint32_t offline)
 
     ret = k5c_check_old_ccache(kr);
     if (ret != 0) {
-        DEBUG(SSSDBG_OP_FAILURE, "Cannot check old ccache\n");
-        return ret;
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot check old ccache [%s]: [%d][%s]. " \
+                                   "Assuming old cache is invalid " \
+                                   "and not used.\n",
+                                   kr->old_ccname, ret, sss_strerror(ret));
     }
 
     /* Pre-creating the ccache must be done as root, otherwise we can't mkdir
-- 
1.8.3.1



More information about the sssd-devel mailing list