[SSSD] [PATCH] nss: return ldap_user_extra_attrs attributes in origbyname request

Sumit Bose sbose at redhat.com
Wed Oct 29 12:01:43 UTC 2014


On Tue, Oct 28, 2014 at 05:37:25AM +0100, Jakub Hrozek wrote:
> On Fri, Oct 24, 2014 at 09:46:12PM +0200, Sumit Bose wrote:
> > Hi,
> > 
> > this two patches allow to have extra user attributes, like e.g. a
> > telephone number, for AD users of trusted domains on the IPA clients.
> > 
> > This first makes it possible that the attributes given in
> > ldap_user_extra_attrs can be read from AD in ipa-server-mode. The second
> > extends the list of attributes returned by sss_nss_getorigbyname().
> > 
> > bye,
> > Sumit
> > 
> > P.S. in the first patch I used sdap_extend_map_with_list() as it is used
> > in other places as well where the maps in the 4th and 6th argument are
> > the same. If I see it correctly we are leaking the old version of the
> > map this way. Since this currently happen only once during init it does
> > not do much harm, but maybe a ticket to fix this might be useful.
> 
> Ah, nice catch. Feel free to file the ticket, we should unit test that
> function anyway and might as well include check_leaks_call to the test.

https://fedorahosted.org/freeipa/ticket/4667

> 

...

> 
> > ---
> >  src/responder/nss/nsssrv_cmd.c  | 170 ++++++++++++++++++++++++++++++++++------
> >  src/tests/cmocka/test_nss_srv.c | 130 ++++++++++++++++++++++++++++++
> >  2 files changed, 278 insertions(+), 22 deletions(-)
> > 
> > diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
> > index 9fca644..7481d49 100644
> > --- a/src/responder/nss/nsssrv_cmd.c
> > +++ b/src/responder/nss/nsssrv_cmd.c
> > @@ -4131,6 +4131,7 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
> >                             SYSDB_AD_ACCOUNT_EXPIRES,
> >                             SYSDB_AD_USER_ACCOUNT_CONTROL,
> >                             SYSDB_DEFAULT_ATTRS, NULL};
> > +    const char *all_attrs[] = { "*", NULL};
> 
> Allowing the responder the retrieve /all/ attributes seems quite
> dangerous to me, this allows to leak cachedPassword etc..
> 
> What is the use-case?

My laziness :-). I changed this by using add_strings_lists() which I
send with the SSH pubkey patches.

> 
> >      bool user_found = false;
> >      bool group_found = false;
> >      struct ldb_message *msg = NULL;
> > @@ -4281,8 +4282,9 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
> >              }
> >          } else {
> >              ret = sysdb_search_user_by_name(cmdctx, dom,
> > -                                            sysdb_name ? sysdb_name : name,
> > -                                            attrs, &msg);
> > +                        sysdb_name ? sysdb_name : name,
> > +                        cmdctx->cmd == SSS_NSS_GETORIGBYNAME ? all_attrs :attrs,
> > +                        &msg);
> >              if (ret != EOK && ret != ENOENT) {
> >                  DEBUG(SSSDBG_CRIT_FAILURE,
> >                        "Failed to make request to our cache!\n");
> > @@ -4295,8 +4297,9 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
> >              } else {
> >                  talloc_free(msg);
> >                  ret = sysdb_search_group_by_name(cmdctx, dom,
> > -                                                 sysdb_name ? sysdb_name : name,
> > -                                                 attrs, &msg);
> > +                       sysdb_name ? sysdb_name : name,
> > +                       cmdctx->cmd == SSS_NSS_GETORIGBYNAME ? all_attrs : attrs,
> > +                       &msg);
> >                  if (ret != EOK && ret != ENOENT) {
> >                      DEBUG(SSSDBG_CRIT_FAILURE,
> >                            "Failed to make request to our cache!\n");
> > @@ -4563,17 +4566,100 @@ static errno_t fill_sid(struct sss_packet *packet,
> >      return EOK;
> >  }
> >  
> > +static errno_t get_extra_attribute_list(TALLOC_CTX *mem_ctx,
> > +                                        struct confdb_ctx *cdb,
> > +                                        struct sss_domain_info *domain,
> > +                                        size_t *new_attrs_count,
> > +                                        char ***new_attrs_list)
> > +{
> > +    int ret;
> > +    TALLOC_CTX *tmp_ctx;
> > +    char *confdb_path;
> > +    char *extra_attrs;
> > +    char **extra_attrs_list;
> > +    size_t c;
> > +    int count;
> > +    char *sep;
> > +    struct sss_domain_info *domain_head;
> > +
> > +    tmp_ctx = talloc_new(NULL);
> > +    if (tmp_ctx == NULL) {
> > +        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
> > +        return ENOMEM;
> > +    }
> > +
> > +    domain_head = get_domains_head(domain);
> > +    confdb_path = talloc_asprintf(tmp_ctx, CONFDB_DOMAIN_PATH_TMPL,
> > +                                  domain_head->name);
> > +    if (confdb_path == NULL) {
> > +        DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
> > +        ret = ENOMEM;
> > +        goto done;
> > +    }
> > +
> > +    ret = confdb_get_string(cdb, tmp_ctx, confdb_path, "ldap_user_extra_attrs",
> > +                            NULL, &extra_attrs);
> 
> I don't like that we're leaking the knowledge about an LDAP attribute to
> the responder. Can we use the 'user_attributes' parameter InfoPipe uses?
> I know there would be one more step for the admin to configure, but I
> would prefer that and keep the separated responder/backend architecture.

I agree, I allowed user_attributes for the nss responder as well with a
fallback to the InfoPipe value so the admin gets it for free if InfoPipe
is already configured but does not have to configure InfoPipe if not
needed. See man page change for details.

Thank you for the review, new version attached.

bye,
Sumit
-------------- next part --------------
From f33b958d8507d31d1f93a196c9e25bd479637863 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 24 Oct 2014 15:41:04 +0200
Subject: [PATCH 1/4] IPA: inherit ldap_user_extra_attrs to AD subdomains

Currently the component of the IPA provider which reads the AD user and
group attributes in ipa-server-mode uses  default settings for the LDAP
related attributes. As a result even if ldap_user_extra_attrs is defined
in sssd.conf no extra attributes are read from AD.

With the patch the value if ldap_user_extra_attrs is inherited to the AD
subdomains to allow them to read extra attributes as well.

Related to https://fedorahosted.org/sssd/ticket/2464
---
 src/providers/ipa/ipa_subdomains.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index c61c1c6..9281aab 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -109,6 +109,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
     char *ad_domain;
     struct sdap_domain *sdom;
     errno_t ret;
+    const char *extra_attrs;
 
     ad_options = ad_create_default_options(id_ctx, id_ctx->server_mode->realm,
                                            id_ctx->server_mode->hostname);
@@ -135,6 +136,36 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
         return ret;
     }
 
+    extra_attrs = dp_opt_get_string(id_ctx->sdap_id_ctx->opts->basic,
+                            SDAP_USER_EXTRA_ATTRS);
+    if (extra_attrs != NULL) {
+        DEBUG(SSSDBG_TRACE_ALL,
+              "Setting extra attrs for subdomain [%s] to [%s].\n", ad_domain,
+                                                                   extra_attrs);
+
+        ret = dp_opt_set_string(ad_options->id->basic, SDAP_USER_EXTRA_ATTRS,
+                                extra_attrs);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "dp_opt_get_string failed.\n");
+            talloc_free(ad_options);
+            return ret;
+        }
+
+        ret = sdap_extend_map_with_list(ad_options->id, ad_options->id,
+                                        SDAP_USER_EXTRA_ATTRS,
+                                        ad_options->id->user_map,
+                                        SDAP_OPTS_USER,
+                                        &ad_options->id->user_map,
+                                        &ad_options->id->user_map_cnt);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sdap_extend_map_with_list failed.\n");
+            talloc_free(ad_options);
+            return ret;
+        }
+    } else {
+        DEBUG(SSSDBG_TRACE_ALL, "No extra attrs set.\n");
+    }
+
     gc_service_name = talloc_asprintf(ad_options, "%s%s", "gc_", subdom->name);
     if (gc_service_name == NULL) {
         talloc_free(ad_options);
-- 
1.8.3.1

-------------- next part --------------
From 79ab3be319aea6e6bee9a1ee78d1b255db0e947e Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Oct 2014 19:40:02 +0100
Subject: [PATCH 2/4] Add ifp_parse_attr_list_ex() helper function

---
 src/responder/ifp/ifp_private.h |  3 +++
 src/responder/ifp/ifpsrv_util.c | 46 +++++++++++++++++++++++--------------
 src/tests/cmocka/test_ifp.c     | 51 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/src/responder/ifp/ifp_private.h b/src/responder/ifp/ifp_private.h
index bf2015a..fb1639c 100644
--- a/src/responder/ifp/ifp_private.h
+++ b/src/responder/ifp/ifp_private.h
@@ -82,5 +82,8 @@ char *_ifp_reply_objpath(TALLOC_CTX *mem_ctx, const char *base,
 errno_t ifp_add_ldb_el_to_dict(DBusMessageIter *iter_dict,
                                struct ldb_message_element *el);
 const char **ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str);
+const char **
+ifp_parse_attr_list_ex(TALLOC_CTX *mem_ctx, const char *conf_str,
+                       const char **defaults);
 bool ifp_attr_allowed(const char *whitelist[], const char *attr);
 #endif /* _IFPSRV_PRIVATE_H_ */
diff --git a/src/responder/ifp/ifpsrv_util.c b/src/responder/ifp/ifpsrv_util.c
index c0ab686..f55b8ec 100644
--- a/src/responder/ifp/ifpsrv_util.c
+++ b/src/responder/ifp/ifpsrv_util.c
@@ -371,7 +371,8 @@ attr_in_list(const char **list, size_t nlist, const char *str)
 }
 
 const char **
-ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
+ifp_parse_attr_list_ex(TALLOC_CTX *mem_ctx, const char *conf_str,
+                       const char **defaults)
 {
     TALLOC_CTX *tmp_ctx;
     errno_t ret;
@@ -384,7 +385,6 @@ ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
     const char **deny = NULL;
     int ai = 0, di = 0, li = 0;
     int i;
-    const char *defaults[] = IFP_DEFAULT_ATTRS;
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
@@ -425,12 +425,14 @@ ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
         }
     }
 
-    /* Assume the output will have to hold defauls and all the configured,
+    /* Assume the output will have to hold defaults and all the configured,
      * values, resize later
      */
     list_size = 0;
-    while (defaults[list_size]) {
-        list_size++;
+    if (defaults != NULL) {
+        while (defaults[list_size]) {
+            list_size++;
+        }
     }
     list_size += conf_list_size;
 
@@ -457,20 +459,22 @@ ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
     }
 
     /* Add defaults */
-    for (i = 0; defaults[i]; i++) {
-        /* if the attribute is explicitly denied, skip it */
-        if (attr_in_list(deny, di, defaults[i])) {
-            continue;
-        }
+    if (defaults != NULL) {
+        for (i = 0; defaults[i]; i++) {
+            /* if the attribute is explicitly denied, skip it */
+            if (attr_in_list(deny, di, defaults[i])) {
+                continue;
+            }
 
-        list[li] = talloc_strdup(list, defaults[i]);
-        if (list[li] == NULL) {
-            goto done;
-        }
-        li++;
+            list[li] = talloc_strdup(list, defaults[i]);
+            if (list[li] == NULL) {
+                goto done;
+            }
+            li++;
 
-        DEBUG(SSSDBG_TRACE_INTERNAL,
-              "Added default attr %s to whitelist\n", defaults[i]);
+            DEBUG(SSSDBG_TRACE_INTERNAL,
+                  "Added default attr %s to whitelist\n", defaults[i]);
+        }
     }
 
     res = talloc_steal(mem_ctx, list);
@@ -479,6 +483,14 @@ done:
     return res;
 }
 
+const char **
+ifp_parse_attr_list(TALLOC_CTX *mem_ctx, const char *conf_str)
+{
+    const char *defaults[] = IFP_DEFAULT_ATTRS;
+
+    return ifp_parse_attr_list_ex(mem_ctx, conf_str, defaults);
+}
+
 bool
 ifp_attr_allowed(const char *whitelist[], const char *attr)
 {
diff --git a/src/tests/cmocka/test_ifp.c b/src/tests/cmocka/test_ifp.c
index b0f6e09..d22bc34 100644
--- a/src/tests/cmocka/test_ifp.c
+++ b/src/tests/cmocka/test_ifp.c
@@ -246,6 +246,29 @@ static void attr_parse_test(const char *expected[], const char *input)
     talloc_free(test_ctx);
 }
 
+static void attr_parse_test_ex(const char *expected[], const char *input,
+                               const char **defaults)
+{
+    const char **res;
+    TALLOC_CTX *test_ctx;
+
+    test_ctx = talloc_new(NULL);
+    assert_non_null(test_ctx);
+
+    res = ifp_parse_attr_list_ex(test_ctx, input, defaults);
+
+    if (expected) {
+        /* Positive test */
+        assert_non_null(res);
+        assert_string_list_equal(res, expected);
+    } else {
+        /* Negative test */
+        assert_null(res);
+    }
+
+    talloc_free(test_ctx);
+}
+
 void test_attr_acl(void **state)
 {
     /* Test defaults */
@@ -296,6 +319,33 @@ void test_attr_acl(void **state)
     attr_parse_test(NULL,  "missing_plus_or_minus");
 }
 
+void test_attr_acl_ex(void **state)
+{
+    /* Test defaults */
+    const char *exp_defaults[] = { "abc", "123", "xyz", NULL };
+    attr_parse_test_ex(exp_defaults, NULL, exp_defaults);
+
+    /* Test adding some attributes to the defaults */
+    const char *exp_add[] = { "telephoneNumber", "streetAddress",
+                              "abc", "123", "xyz",
+                              NULL };
+    attr_parse_test_ex(exp_add, "+telephoneNumber, +streetAddress",
+                       exp_defaults);
+
+    /* Test removing some attributes to the defaults */
+    const char *exp_rm[] = { "123", NULL };
+    attr_parse_test_ex(exp_rm, "-abc, -xyz", exp_defaults);
+
+    /* Test adding with empty defaults */
+    const char *exp_add_empty[] = { "telephoneNumber", "streetAddress",
+                                    NULL };
+    attr_parse_test_ex(exp_add_empty, "+telephoneNumber, +streetAddress", NULL);
+
+    /* Test removing with empty defaults */
+    const char *rm_all[] = { NULL };
+    attr_parse_test_ex(rm_all, "-telephoneNumber, -streetAddress", NULL);
+}
+
 void test_attr_allowed(void **state)
 {
     const char *whitelist[] = { "name", "gecos", NULL };
@@ -452,6 +502,7 @@ int main(int argc, const char *argv[])
         unit_test(test_path_prefix),
         unit_test(test_el_to_dict),
         unit_test(test_attr_acl),
+        unit_test(test_attr_acl_ex),
         unit_test(test_attr_allowed),
         unit_test(test_path_escape_unescape),
         unit_test_setup_teardown(test_reply_path,
-- 
1.8.3.1

-------------- next part --------------
From b5f10b7d45b7e4310cfde4ca7848312b0712e5d7 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Oct 2014 19:42:47 +0100
Subject: [PATCH 3/4] nss: parse IPF user_attributes option

---
 Makefile.am                |  1 +
 src/man/sssd.conf.5.xml    | 26 ++++++++++++++++++++++++++
 src/responder/nss/nsssrv.c | 18 ++++++++++++++++++
 src/responder/nss/nsssrv.h |  2 ++
 4 files changed, 47 insertions(+)

diff --git a/Makefile.am b/Makefile.am
index 61bf5cf..3c81295 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -940,6 +940,7 @@ sssd_nss_SOURCES = \
     src/responder/nss/nsssrv_netgroup.c \
     src/responder/nss/nsssrv_services.c \
     src/responder/nss/nsssrv_mmap_cache.c \
+    src/responder/ifp/ifpsrv_util.c \
     $(SSSD_RESPONDER_OBJ)
 sssd_nss_LDADD = \
     $(TDB_LIBS) \
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index e2cb0b8..fbaca66 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -711,6 +711,32 @@ fallback_homedir = /home/%u
                         </para>
                     </listitem>
                 </varlistentry>
+                <varlistentry>
+                    <term>user_attributes (string)</term>
+                    <listitem>
+                        <para>
+                            Some of the additional NSS responder requests can
+                            return more attributes than just the POSIX ones
+                            defined by the NSS interface. The list of attributes
+                            is controlled by this option. It is handle the same
+                            way as the <quote>user_attributes</quote> option of
+                            the InfoPipe responder (see
+                            <citerefentry>
+                                <refentrytitle>sssd-ifp</refentrytitle>
+                                <manvolnum>5</manvolnum>
+                            </citerefentry>
+                            for details) but with no default values.
+                        </para>
+                        <para>
+                            To make configuration more easy the NSS responder
+                            will check the InfoPipe option if it is not set for
+                            the NSS responder.
+                        </para>
+                        <para>
+                            Default: not set, fallback to InfoPipe option
+                        </para>
+                    </listitem>
+                </varlistentry>
             </variablelist>
         </refsect2>
         <refsect2 id='PAM'>
diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c
index 1bbeaa1..601ffc2 100644
--- a/src/responder/nss/nsssrv.c
+++ b/src/responder/nss/nsssrv.c
@@ -48,6 +48,7 @@
 #include "monitor/monitor_interfaces.h"
 #include "sbus/sbus_client.h"
 #include "util/util_sss_idmap.h"
+#include "responder/ifp/ifp_private.h"
 
 #define DEFAULT_PWFIELD "*"
 #define DEFAULT_NSS_FD_LIMIT 8192
@@ -214,6 +215,7 @@ static int nss_get_config(struct nss_ctx *nctx,
                           struct confdb_ctx *cdb)
 {
     int ret;
+    char *tmp_str;
 
     ret = confdb_get_int(cdb, CONFDB_NSS_CONF_ENTRY,
                          CONFDB_NSS_ENUM_CACHE_TIMEOUT, 120,
@@ -298,6 +300,22 @@ static int nss_get_config(struct nss_ctx *nctx,
                             &nctx->homedir_substr);
     if (ret != EOK) goto done;
 
+
+    ret = confdb_get_string(cdb, nctx, CONFDB_NSS_CONF_ENTRY,
+                            CONFDB_IFP_USER_ATTR_LIST, NULL, &tmp_str);
+    if (ret != EOK) goto done;
+
+    if (tmp_str == NULL) {
+        ret = confdb_get_string(cdb, nctx, CONFDB_IFP_CONF_ENTRY,
+                                CONFDB_IFP_USER_ATTR_LIST, NULL, &tmp_str);
+        if (ret != EOK) goto done;
+    }
+
+    if (tmp_str != NULL) {
+        nctx->extra_attributes = ifp_parse_attr_list_ex(nctx, tmp_str, NULL);
+        if (ret != EOK) goto done;
+    }
+
     ret = 0;
 done:
     return ret;
diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h
index a5b946b..784eba2 100644
--- a/src/responder/nss/nsssrv.h
+++ b/src/responder/nss/nsssrv.h
@@ -75,6 +75,8 @@ struct nss_ctx {
 
     struct sss_idmap_ctx *idmap_ctx;
     struct sss_names_ctx *global_names;
+
+    const char **extra_attributes;
 };
 
 struct nss_packet;
-- 
1.8.3.1

-------------- next part --------------
From c0f65bad00a893b736ec7b3f4e417e5ccf4dad26 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 24 Oct 2014 11:30:33 +0200
Subject: [PATCH 4/4] nss: return user_attributes in origbyname request

To allow IPA clients to offer special attributes of AD users form
trusted domain the extdom plugin on the IPA server must send them to the
clients. The extdom plugin already uses sss_nss_getorigbyname() to get
attributes like the SID and the user principal name. This patch adds the
attributes given by the NSS/IFP user_attributes option to the list of
attributes returned by sss_nss_getorigbyname().

Fixes https://fedorahosted.org/sssd/ticket/2464
---
 src/responder/nss/nsssrv_cmd.c  | 120 +++++++++++++++++++++++++++---------
 src/tests/cmocka/test_nss_srv.c | 133 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 223 insertions(+), 30 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 9fca644..28275ac 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -4119,18 +4119,19 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
     struct nss_ctx *nctx;
     int ret;
     int err;
-    const char *attrs[] = {SYSDB_NAME, SYSDB_OBJECTCLASS, SYSDB_SID_STR,
-                           ORIGINALAD_PREFIX SYSDB_NAME,
-                           ORIGINALAD_PREFIX SYSDB_UIDNUM,
-                           ORIGINALAD_PREFIX SYSDB_GIDNUM,
-                           ORIGINALAD_PREFIX SYSDB_GECOS,
-                           ORIGINALAD_PREFIX SYSDB_HOMEDIR,
-                           ORIGINALAD_PREFIX SYSDB_SHELL,
-                           SYSDB_UPN,
-                           SYSDB_DEFAULT_OVERRIDE_NAME,
-                           SYSDB_AD_ACCOUNT_EXPIRES,
-                           SYSDB_AD_USER_ACCOUNT_CONTROL,
-                           SYSDB_DEFAULT_ATTRS, NULL};
+    const char *default_attrs[] = {SYSDB_NAME, SYSDB_OBJECTCLASS, SYSDB_SID_STR,
+                                   ORIGINALAD_PREFIX SYSDB_NAME,
+                                   ORIGINALAD_PREFIX SYSDB_UIDNUM,
+                                   ORIGINALAD_PREFIX SYSDB_GIDNUM,
+                                   ORIGINALAD_PREFIX SYSDB_GECOS,
+                                   ORIGINALAD_PREFIX SYSDB_HOMEDIR,
+                                   ORIGINALAD_PREFIX SYSDB_SHELL,
+                                   SYSDB_UPN,
+                                   SYSDB_DEFAULT_OVERRIDE_NAME,
+                                   SYSDB_AD_ACCOUNT_EXPIRES,
+                                   SYSDB_AD_USER_ACCOUNT_CONTROL,
+                                   SYSDB_DEFAULT_ATTRS, NULL};
+    const char **attrs;
     bool user_found = false;
     bool group_found = false;
     struct ldb_message *msg = NULL;
@@ -4252,6 +4253,18 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
             goto done;
         }
 
+        attrs = default_attrs;
+        if (cmdctx->cmd == SSS_NSS_GETORIGBYNAME
+                && nctx->extra_attributes != NULL) {
+            ret = add_strings_lists(cmdctx, default_attrs,
+                                    nctx->extra_attributes, false,
+                                    discard_const(&attrs));
+            if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE, "add_strings_lists failed.\n");
+                goto done;
+            }
+        }
+
         if (cmdctx->cmd == SSS_NSS_GETSIDBYID) {
             ret = sysdb_search_user_by_uid(cmdctx, dom, cmdctx->id, attrs,
                                            &msg);
@@ -4564,16 +4577,21 @@ static errno_t fill_sid(struct sss_packet *packet,
 }
 
 static errno_t fill_orig(struct sss_packet *packet,
+                         struct resp_ctx *rctx,
                          enum sss_id_type id_type,
                          struct ldb_message *msg)
 {
     int ret;
+    TALLOC_CTX *tmp_ctx;
     const char *tmp_str;
     uint8_t *body;
     size_t blen;
     size_t pctr = 0;
     size_t c;
     size_t sum;
+    size_t found;
+    size_t extra_attrs_count = 0;
+    const char **extra_attrs_list = NULL;
     const char *orig_attr_list[] = {SYSDB_SID_STR,
                                     ORIGINALAD_PREFIX SYSDB_NAME,
                                     ORIGINALAD_PREFIX SYSDB_UIDNUM,
@@ -4586,42 +4604,83 @@ static errno_t fill_orig(struct sss_packet *packet,
                                     SYSDB_AD_ACCOUNT_EXPIRES,
                                     SYSDB_AD_USER_ACCOUNT_CONTROL,
                                     NULL};
-    struct sized_string keys[sizeof(orig_attr_list)];
-    struct sized_string vals[sizeof(orig_attr_list)];
+    struct sized_string *keys;
+    struct sized_string *vals;
+    struct nss_ctx *nctx;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
+        return ENOMEM;
+    }
+
+    nctx = talloc_get_type(rctx->pvt_ctx, struct nss_ctx);
+    if (nctx->extra_attributes != NULL) {
+        extra_attrs_list = nctx->extra_attributes;
+            for(extra_attrs_count = 0;
+                extra_attrs_list[extra_attrs_count] != NULL;
+                extra_attrs_count++);
+    }
+
+    keys = talloc_array(tmp_ctx, struct sized_string,
+                        sizeof(orig_attr_list) + extra_attrs_count);
+    vals = talloc_array(tmp_ctx, struct sized_string,
+                        sizeof(orig_attr_list) + extra_attrs_count);
+    if (keys == NULL || vals == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");
+        ret = ENOMEM;
+        goto done;
+    }
 
     sum = 0;
+    found = 0;
     for (c = 0; orig_attr_list[c] != NULL; c++) {
         tmp_str = ldb_msg_find_attr_as_string(msg, orig_attr_list[c], NULL);
         if (tmp_str != NULL) {
-            to_sized_string(&keys[c], orig_attr_list[c]);
-            sum += keys[c].len;
-            to_sized_string(&vals[c], tmp_str);
-            sum += vals[c].len;
-        } else {
-            vals[c].len = 0;
+            to_sized_string(&keys[found], orig_attr_list[c]);
+            sum += keys[found].len;
+            to_sized_string(&vals[found], tmp_str);
+            sum += vals[found].len;
+
+            found++;
+        }
+    }
+
+    for (c = 0; c < extra_attrs_count; c++) {
+        tmp_str = ldb_msg_find_attr_as_string(msg, extra_attrs_list[c], NULL);
+        if (tmp_str != NULL) {
+            to_sized_string(&keys[found], extra_attrs_list[c]);
+            sum += keys[found].len;
+            to_sized_string(&vals[found], tmp_str);
+            sum += vals[found].len;
+
+            found++;
         }
     }
 
     ret = sss_packet_grow(packet, sum +  3 * sizeof(uint32_t));
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "sss_packet_grow failed.\n");
-        return ret;
+        goto done;
     }
 
     sss_packet_get_body(packet, &body, &blen);
     SAFEALIGN_SETMEM_UINT32(body, 1, &pctr); /* Num results */
     SAFEALIGN_SETMEM_UINT32(body + pctr, 0, &pctr); /* reserved */
     SAFEALIGN_COPY_UINT32(body + pctr, &id_type, &pctr);
-    for (c = 0; orig_attr_list[c] != NULL; c++) {
-        if (vals[c].len != 0) {
-            memcpy(&body[pctr], keys[c].str, keys[c].len);
-            pctr+= keys[c].len;
-            memcpy(&body[pctr], vals[c].str, vals[c].len);
-            pctr+= vals[c].len;
-        }
+    for (c = 0; c < found; c++) {
+        memcpy(&body[pctr], keys[c].str, keys[c].len);
+        pctr+= keys[c].len;
+        memcpy(&body[pctr], vals[c].str, vals[c].len);
+        pctr+= vals[c].len;
     }
 
-    return EOK;
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+
+    return ret;
 }
 
 static errno_t fill_name(struct sss_packet *packet,
@@ -4789,7 +4848,8 @@ static errno_t nss_cmd_getbysid_send_reply(struct nss_dom_ctx *dctx)
         ret = fill_sid(cctx->creq->out, id_type, dctx->res->msgs[0]);
         break;
     case SSS_NSS_GETORIGBYNAME:
-        ret = fill_orig(cctx->creq->out, id_type, dctx->res->msgs[0]);
+        ret = fill_orig(cctx->creq->out, cctx->rctx, id_type,
+                        dctx->res->msgs[0]);
         break;
     default:
         DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported request type.\n");
diff --git a/src/tests/cmocka/test_nss_srv.c b/src/tests/cmocka/test_nss_srv.c
index 65298cd..c318d94 100644
--- a/src/tests/cmocka/test_nss_srv.c
+++ b/src/tests/cmocka/test_nss_srv.c
@@ -52,6 +52,8 @@ struct nss_test_ctx {
     bool ncache_hit;
 };
 
+const char *global_extra_attrs[] = {"phone", "mobile", NULL};
+
 struct nss_test_ctx *nss_test_ctx;
 
 /* Mock NSS structure */
@@ -1000,6 +1002,7 @@ void test_nss_setup(struct sss_test_conf_param params[],
     nss_test_ctx->rctx = mock_rctx(nss_test_ctx, nss_test_ctx->tctx->ev,
                                    nss_test_ctx->tctx->dom, nss_test_ctx->nctx);
     assert_non_null(nss_test_ctx->rctx);
+    nss_test_ctx->rctx->cdb = nss_test_ctx->tctx->confdb;
     nss_test_ctx->nctx->rctx = nss_test_ctx->rctx;
 
     /* Create client context */
@@ -1827,6 +1830,122 @@ void test_nss_getorigbyname(void **state)
     assert_int_equal(ret, EOK);
 }
 
+static int test_nss_getorigbyname_extra_check(uint32_t status, uint8_t *body,
+                                              size_t blen)
+{
+    const char *s;
+    enum sss_id_type id_type;
+    size_t rp = 2 * sizeof(uint32_t);
+
+    assert_int_equal(status, EOK);
+
+    SAFEALIGN_COPY_UINT32(&id_type, body+rp, &rp);
+    assert_int_equal(id_type, SSS_ID_TYPE_UID);
+
+    /* Sequence of null terminated strings */
+    s = (char *) body+rp;
+    assert_string_equal(s, SYSDB_SID_STR);
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "S-1-2-3-4");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, ORIGINALAD_PREFIX SYSDB_NAME);
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "orig_name");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, ORIGINALAD_PREFIX SYSDB_UIDNUM);
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "1234");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "phone");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "+12-34 56 78");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "mobile");
+    rp += strlen(s) + 1;
+    assert_true(rp < blen);
+
+    s = (char *) body+rp;
+    assert_string_equal(s, "+98-76 54 32");
+    rp += strlen(s) + 1;
+    assert_int_equal(rp, blen);
+
+    return EOK;
+}
+
+void test_nss_getorigbyname_extra_attrs(void **state)
+{
+    errno_t ret;
+    struct sysdb_attrs *attrs;
+
+    attrs = sysdb_new_attrs(nss_test_ctx);
+    assert_non_null(attrs);
+
+    ret = sysdb_attrs_add_string(attrs, SYSDB_SID_STR, "S-1-2-3-4");
+    assert_int_equal(ret, EOK);
+
+    ret = sysdb_attrs_add_string(attrs, ORIGINALAD_PREFIX SYSDB_NAME,
+                                 "orig_name");
+    assert_int_equal(ret, EOK);
+
+    ret = sysdb_attrs_add_uint32(attrs, ORIGINALAD_PREFIX SYSDB_UIDNUM, 1234);
+    assert_int_equal(ret, EOK);
+
+    ret = sysdb_attrs_add_string(attrs, "phone", "+12-34 56 78");
+    assert_int_equal(ret, EOK);
+
+    ret = sysdb_attrs_add_string(attrs, "mobile", "+98-76 54 32");
+    assert_int_equal(ret, EOK);
+
+    ret = sysdb_attrs_add_string(attrs, "not_extra", "abc");
+    assert_int_equal(ret, EOK);
+
+    /* Prime the cache with a valid user */
+    ret = sysdb_add_user(nss_test_ctx->tctx->dom,
+                         "testuserorigextra", 2345, 6789,
+                         "test user orig extra",
+                         "/home/testuserorigextra", "/bin/sh", NULL,
+                         attrs, 300, 0);
+    assert_int_equal(ret, EOK);
+
+    mock_input_user_or_group("testuserorigextra");
+    will_return(__wrap_sss_packet_get_cmd, SSS_NSS_GETORIGBYNAME);
+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);
+
+    /* Query for that user, call a callback when command finishes */
+    set_cmd_cb(test_nss_getorigbyname_extra_check);
+    ret = sss_cmd_execute(nss_test_ctx->cctx, SSS_NSS_GETORIGBYNAME,
+                          nss_test_ctx->nss_cmds);
+    assert_int_equal(ret, EOK);
+
+    /* Wait until the test finishes with EOK */
+    ret = test_ev_loop(nss_test_ctx->tctx);
+    assert_int_equal(ret, EOK);
+}
+
 void nss_test_setup(void **state)
 {
     struct sss_test_conf_param params[] = {
@@ -1848,6 +1967,18 @@ void nss_fqdn_test_setup(void **state)
     test_nss_setup(params, state);
 }
 
+void nss_test_setup_extra_attr(void **state)
+{
+    struct sss_test_conf_param params[] = {
+        { "enumerate", "false" },
+        { NULL, NULL },             /* Sentinel */
+    };
+
+    test_nss_setup(params, state);
+
+    nss_test_ctx->nctx->extra_attributes = global_extra_attrs;
+}
+
 void nss_subdom_test_setup(void **state)
 {
     const char *const testdom[4] = { TEST_SUBDOM_NAME, "TEST.SUB", "test", "S-3" };
@@ -1963,6 +2094,8 @@ int main(int argc, const char *argv[])
                                  nss_test_setup, nss_test_teardown),
         unit_test_setup_teardown(test_nss_getorigbyname,
                                  nss_test_setup, nss_test_teardown),
+        unit_test_setup_teardown(test_nss_getorigbyname_extra_attrs,
+                                 nss_test_setup_extra_attr, nss_test_teardown),
     };
 
     /* Set debug level to invalid value so we can deside if -d 0 was used. */
-- 
1.8.3.1



More information about the sssd-devel mailing list