[SSSD] [PATCH] ipa: fix issues with older servers not supporting views

Sumit Bose sbose at redhat.com
Wed Oct 22 08:53:06 UTC 2014


On Wed, Oct 22, 2014 at 10:44:56AM +0200, Pavel Reichl wrote:
> 
> On 10/22/2014 10:42 AM, Sumit Bose wrote:
> >Hi,
> >
> >this patch fixes issues in the view/override lookup code with older
> >FreeIPA servers which do not support views yet.
> >
> >bye,
> >Sumit
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> Sorry, but I can't see any patch.

me neither, second try ...

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 28c2940188193c94ff366fee2932bc843a955a1b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 22 Oct 2014 10:03:09 +0200
Subject: [PATCH] ipa: fix issues with older servers not supporting views

Older FreeIPA servers which do not know about the ipaAssignedIDView
attribute will return an error during the LDAP dereference request
because SSSD marks LDAP extensions as critical. In this case we keep the
view name empty and skip override lookups.
---
 src/providers/ipa/ipa_subdomains.c    | 14 +++++++++++++-
 src/providers/ipa/ipa_subdomains_id.c |  4 +++-
 src/providers/ipa/ipa_views.c         | 15 +++++++++++----
 3 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 559b904..c61c1c6 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1002,7 +1002,19 @@ static void ipa_get_view_name_done(struct tevent_req *req)
     ret = sdap_deref_search_with_filter_recv(req, ctx, &reply_count, &reply);
     talloc_zfree(req);
     if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "get_view_name request failed.\n");
+        if (ret == EOPNOTSUPP) {
+            DEBUG(SSSDBG_TRACE_FUNC, "get_view_name request failed, looks " \
+                                     "like server does not support views.\n");
+            ret = ipa_check_master(ctx);
+            if (ret == EAGAIN) {
+                return;
+            } else if (ret != EOK) {
+                goto done;
+            }
+
+        } else {
+            DEBUG(SSSDBG_OP_FAILURE, "get_view_name request failed.\n");
+        }
         goto done;
     }
 
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 36f8b23..b67006c 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -106,11 +106,13 @@ struct tevent_req *ipa_subdomain_account_send(TALLOC_CTX *memctx,
      * have to check first if the request matches an override in the given
      * view. But there are cases where this can be skipped and the AD object
      * can be searched directly:
+     * - if no view is defined, i.e. the server does not supprt views yet
      * - searches by SID: because we do not override the SID
      * - if the responder does not send the EXTRA_INPUT_MAYBE_WITH_VIEW flags,
      *   because in this case the entry was found in the cache and the
      *   original value is used for the search (e.g. during cache updates) */
-    if (state->ar->filter_type == BE_FILTER_SECID
+    if (state->ipa_ctx->view_name == NULL
+            || state->ar->filter_type == BE_FILTER_SECID
             || (!state->ipa_server_mode
                 && state->ar->extra_value != NULL
                 && strcmp(state->ar->extra_value,
diff --git a/src/providers/ipa/ipa_views.c b/src/providers/ipa/ipa_views.c
index 33dbf7b..2eb7721 100644
--- a/src/providers/ipa/ipa_views.c
+++ b/src/providers/ipa/ipa_views.c
@@ -208,15 +208,22 @@ struct tevent_req *ipa_get_ad_override_send(TALLOC_CTX *mem_ctx,
     state->sdap_id_ctx = sdap_id_ctx;
     state->ipa_options = ipa_options;
     state->ipa_realm = ipa_realm;
+    state->ar = ar;
+    state->dp_error = -1;
+    state->override_attrs = NULL;
+    state->filter = NULL;
+
+    if (view_name == NULL) {
+        DEBUG(SSSDBG_TRACE_ALL, "View not defined, nothing to do.\n");
+        ret = EOK;
+        goto done;
+    }
+
     if (strcmp(view_name, SYSDB_DEFAULT_VIEW_NAME) == 0) {
         state->ipa_view_name = IPA_DEFAULT_VIEW_NAME;
     } else {
         state->ipa_view_name = view_name;
     }
-    state->ar = ar;
-    state->dp_error = -1;
-    state->override_attrs = NULL;
-    state->filter = NULL;
 
     state->sdap_op = sdap_id_op_create(state,
                                        state->sdap_id_ctx->conn->conn_cache);
-- 
1.8.3.1



More information about the sssd-devel mailing list