[SSSD] [PATCH] UTIL: Always write capath

Jakub Hrozek jhrozek at redhat.com
Mon Sep 29 11:15:34 UTC 2014


I had this patch in my branch for a couple of days already so why not
send it out..

In a remote session with a customer we discovered that it's beneficial
for some scenarios to generate the capaths even on clients. The attached
patch does exactly this.
-------------- next part --------------
>From dfd0c40db796db05d72bb94acd5fb2cf1eafe723 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 24 Sep 2014 16:10:41 +0200
Subject: [PATCH 1/3] UTIL: Always write capaths

We used to only generate the [capaths] section on the IPA server itself,
when running in a trusted setup. But we also found out that the capaths
are often required to make SSO fully work, so it's better to always
generate them.
---
 src/providers/ad/ad_subdomains.c   |  2 +-
 src/providers/ipa/ipa_subdomains.c |  4 +--
 src/util/domain_info_utils.c       | 69 ++++++++++++++++++--------------------
 src/util/util.h                    |  3 +-
 4 files changed, 36 insertions(+), 42 deletions(-)

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
index f7574d05d236ac89d401daae1f049531b56786cc..bc5bc8914ce84ecfbff69ff837250b5bf3a3515b 100644
--- a/src/providers/ad/ad_subdomains.c
+++ b/src/providers/ad/ad_subdomains.c
@@ -467,7 +467,7 @@ static errno_t ad_subdom_reinit(struct ad_subdomains_ctx *ctx)
         return ret;
     }
 
-    ret = sss_write_domain_mappings(ctx->be_ctx->domain, false);
+    ret = sss_write_domain_mappings(ctx->be_ctx->domain);
     if (ret != EOK) {
         DEBUG(SSSDBG_MINOR_FAILURE, "sss_krb5_write_mappings failed.\n");
         /* Just continue */
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 5245048466548475e48a619be52785bdb12295a0..d37f48e2be75a5b4a39e173f8c5e6b4892d6c8c4 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -282,9 +282,7 @@ ipa_subdom_reinit(struct ipa_subdomains_ctx *ctx)
         return ret;
     }
 
-    ret = sss_write_domain_mappings(ctx->be_ctx->domain,
-                    dp_opt_get_bool(ctx->id_ctx->ipa_options->basic,
-                    IPA_SERVER_MODE));
+    ret = sss_write_domain_mappings(ctx->be_ctx->domain);
     if (ret != EOK) {
         DEBUG(SSSDBG_MINOR_FAILURE,
                 "sss_krb5_write_mappings failed.\n");
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index 8933f52353abd63ce825e80b1cde2aad03ed7797..c5691b7efa963a452f6fc5ffa8308e1a297010bf 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -364,7 +364,7 @@ sss_krb5_touch_config(void)
 }
 
 errno_t
-sss_write_domain_mappings(struct sss_domain_info *domain, bool add_capaths)
+sss_write_domain_mappings(struct sss_domain_info *domain)
 {
     struct sss_domain_info *dom;
     struct sss_domain_info *parent_dom;
@@ -378,7 +378,7 @@ sss_write_domain_mappings(struct sss_domain_info *domain, bool add_capaths)
     mode_t old_mode;
     FILE *fstream = NULL;
     int i;
-    bool capaths_started;
+    bool capaths_started = false;
     char *uc_forest;
     char *uc_parent;
 
@@ -466,48 +466,45 @@ sss_write_domain_mappings(struct sss_domain_info *domain, bool add_capaths)
         }
     }
 
-    if (add_capaths) {
-        capaths_started = false;
-        parent_dom = domain;
-        uc_parent = get_uppercase_realm(tmp_ctx, parent_dom->name);
-        if (uc_parent == NULL) {
+    parent_dom = domain;
+    uc_parent = get_uppercase_realm(tmp_ctx, parent_dom->name);
+    if (uc_parent == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "get_uppercase_realm failed.\n");
+        ret = ENOMEM;
+        goto done;
+    }
+
+    for (dom = get_next_domain(domain, true);
+            dom && IS_SUBDOMAIN(dom); /* if we get back to a parent, stop */
+            dom = get_next_domain(dom, false)) {
+
+        if (dom->forest == NULL) {
+            continue;
+        }
+
+        uc_forest = get_uppercase_realm(tmp_ctx, dom->forest);
+        if (uc_forest == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, "get_uppercase_realm failed.\n");
             ret = ENOMEM;
             goto done;
         }
 
-        for (dom = get_next_domain(domain, true);
-             dom && IS_SUBDOMAIN(dom); /* if we get back to a parent, stop */
-             dom = get_next_domain(dom, false)) {
-
-            if (dom->forest == NULL) {
-                continue;
-            }
-
-            uc_forest = get_uppercase_realm(tmp_ctx, dom->forest);
-            if (uc_forest == NULL) {
-                DEBUG(SSSDBG_OP_FAILURE, "get_uppercase_realm failed.\n");
-                ret = ENOMEM;
-                goto done;
-            }
-
-            if (!capaths_started) {
-                ret = fprintf(fstream, "[capaths]\n");
-                if (ret < 0) {
-                    DEBUG(SSSDBG_OP_FAILURE, "fprintf failed\n");
-                    ret = EIO;
-                    goto done;
-                }
-                capaths_started = true;
-            }
-
-            ret = fprintf(fstream, "%s = {\n  %s = %s\n}\n%s = {\n  %s = %s\n}\n",
-                                   dom->realm, uc_parent, uc_forest,
-                                   uc_parent, dom->realm, uc_forest);
+        if (!capaths_started) {
+            ret = fprintf(fstream, "[capaths]\n");
             if (ret < 0) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "fprintf failed\n");
+                DEBUG(SSSDBG_OP_FAILURE, "fprintf failed\n");
+                ret = EIO;
                 goto done;
             }
+            capaths_started = true;
+        }
+
+        ret = fprintf(fstream, "%s = {\n  %s = %s\n}\n%s = {\n  %s = %s\n}\n",
+                                dom->realm, uc_parent, uc_forest,
+                                uc_parent, dom->realm, uc_forest);
+        if (ret < 0) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "fprintf failed\n");
+            goto done;
         }
     }
 
diff --git a/src/util/util.h b/src/util/util.h
index d3b746be3cac7cc4051a218b8ae40c3784251d82..bd691a2138f2efa34487e9738f471cb014a33083 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -544,8 +544,7 @@ errno_t sssd_domain_init(TALLOC_CTX *mem_ctx,
 
 #define IS_SUBDOMAIN(dom) ((dom)->parent != NULL)
 
-errno_t sss_write_domain_mappings(struct sss_domain_info *domain,
-                                  bool add_capaths);
+errno_t sss_write_domain_mappings(struct sss_domain_info *domain);
 
 /* from util_lock.c */
 errno_t sss_br_lock_file(int fd, size_t start, size_t len,
-- 
1.9.3



More information about the sssd-devel mailing list