[SSSD] [PATCH] IPA: Use GC for group lookups in server mode

Jakub Hrozek jhrozek at redhat.com
Tue Sep 9 20:41:49 UTC 2014


Hi,

the attached patch enables cross-domain group lookups.

Even though AD trusts often work with POSIX attributes which are
normally not replicated to GC, our group lookups are smart since commit
008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
the LDAP connection and only use the GC connection to look up the members.

I tested the patch with trusts that use ID-mapping, there the
cross-domain memberships are resolved fine. 

For setups that use POSIX mapping, only the members from the domain that
the group belongs to is visible -- that is because the AD back end
currently tests if POSIX attributes are in use and if they are, GC
support is completely disabled. Perhaps this is something to work on in
1.13 when we refactor the group membership, but for now I'd like to keep
the patch (and associated risk) minimal.
-------------- next part --------------
>From 63fa4e5ad3f75d5f43da5577ad9c9dead5fd62ab Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 9 Sep 2014 22:13:52 +0200
Subject: [PATCH] IPA: Use GC for group lookups in server mode

https://fedorahosted.org/sssd/ticket/2412

Even though AD trusts often work with POSIX attributes which are
normally not replicated to GC, our group lookups are smart since commit
008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
the LDAP connection and only use the GC connection to look up the members.
---
 src/providers/ipa/ipa_subdomains_id.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 659bc7c2cba4fd9e4d8b07d79efaa6feede35cb9..83f913cb9ee4121fee603ae56d3d09d817720152 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -304,17 +304,21 @@ ipa_get_ad_acct_send(TALLOC_CTX *mem_ctx,
     }
     sdap_id_ctx = ad_id_ctx->sdap_id_ctx;
 
-    /* Currently only LDAP port for AD is used because POSIX
-     * attributes are not replicated to GC by default
+    /* We read users and groups from GC. From groups, we may switch to
+     * using LDAP connection in the group request itself, but in order
+     * to resolve Universal group memberships, we also need the GC
+     * connection
      */
-
-    if ((state->ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_INITGROUPS) {
+    switch (state->ar->entry_type & BE_REQ_TYPE_MASK) {
+    case BE_REQ_INITGROUPS:
+    case BE_REQ_GROUP:
         clist = ad_gc_conn_list(req, ad_id_ctx, state->user_dom);
         if (clist == NULL) {
             ret = ENOMEM;
             goto fail;
         }
-    } else {
+        break;
+    default:
         clist = talloc_zero_array(req, struct sdap_id_conn_ctx *, 2);
         if (clist == NULL) {
             ret = ENOMEM;
-- 
1.9.3



More information about the sssd-devel mailing list