[SSSD] [PATCHES] IPA: fixed for initgroups with overrides

Sumit Bose sbose at redhat.com
Wed Apr 29 13:27:31 UTC 2015


On Wed, Apr 29, 2015 at 02:12:48PM +0200, Jakub Hrozek wrote:
> On Wed, Apr 29, 2015 at 11:25:04AM +0200, Sumit Bose wrote:
> > Hi,
> > 
> > while analyzing the test case described in
> > https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
> > the client and server code which are hopefully fixed by the attached
> > patch set.
> > 
> > bye,
> > Sumit
> 
> > From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00 2001
> > From: Sumit Bose <sbose at redhat.com>
> > Date: Tue, 28 Apr 2015 17:18:48 +0200
> > Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
> > 
> > Newer versions of the extdom plugin return the full list of
> > group-memberships during a user lookup request. With these version there
> > is no need to reject a initgroups request for sub/trusted-domain users
> > anymore. This is e.g. useful for callers which call getgrouplist()
> > directly without calling getpwnam() before. Additionally it helps if for
> > some reasons the lifetime of the user entry and the lifetime of the
> > initgroups data is different.
> > 
> > Related to https://fedorahosted.org/sssd/ticket/2633
> 
> ACK
> 
> Makes sense, tested with id from command line and os.initgroups() from
> Python.
> 
> > From 627ebf1782fb5dafa2536f5d451e1d39f46f0012 Mon Sep 17 00:00:00 2001
> > From: Sumit Bose <sbose at redhat.com>
> > Date: Tue, 28 Apr 2015 17:20:05 +0200
> > Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
> > 
> > Newer versions of the extdom plugin return the full list of
> > group-memberships during user lookups. As a result the lifetime of the
> > group-membership data is updates in those cases. But if the user is not
> > looked up directly but is resolved as a group member during a group
> > lookup SSSD does not resolve all group-membership of the user to avoid
> > deep recursion and eventually a complete enumeration of the user and
> > group base. In this case the lifetime of the group-memberships should
> > not be updated because it might be incomplete.
> > 
> > Related to https://fedorahosted.org/sssd/ticket/2633
> 
> ACK, nice catch
> 
> > From 0dcbb088866cbc459379f8c0e23a75585b2036a8 Mon Sep 17 00:00:00 2001
> > From: Sumit Bose <sbose at redhat.com>
> > Date: Tue, 28 Apr 2015 20:58:15 +0200
> > Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
> > 
> > This patch makes ipa_initgr_get_overrides_send() public and add support
> > to search overrides by UUID or by SID.
> 
> Do you think this interface might be used more in the future? If yes,
> then it would be cleaner to also restrict the synopsis of the function
> with some enum or wrap around mini-request that would pass the ar
> directly rather than allowing generic char* and then checking against
> known values.
> 
> But for now I'm fine with letting the code go, if the programmer uses
> the interface, he would get an error with an unsupported value..

so far we only have SID and UUID based anchors, so I do not expect any
additions or increased usage any time soon.

> 
> > From 94f9ab29cd40338e7fa7dee636065cf8d06ec330 Mon Sep 17 00:00:00 2001
> > From: Sumit Bose <sbose at redhat.com>
> > Date: Tue, 28 Apr 2015 20:59:43 +0200
> > Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
> > 
> > After the group memberships of a user from a trusted domain are read it
> > must be checked if there are overrides for the discovered groups to be
> > able to return the right gid or name to the caller.
> > 
> > Related to https://fedorahosted.org/sssd/ticket/2633
> 
> This patch causes a compilation warning:
> src/providers/ipa/ipa_subdomains_id.c: In function 'ipa_id_get_groups_overrides_done':
> src/providers/ipa/ipa_subdomains_id.c:1225:35: warning: unused variable 'state' [-Wunused-variable]
>      struct ipa_get_ad_acct_state *state = tevent_req_data(req,

sorry, must have missed that, new version attached.

bye,
Sumit

> 
> But functionally-wise seems OK.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 659f21eca00085c44233c3c307cd4bf2ad934beb Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Apr 2015 17:18:48 +0200
Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it

Newer versions of the extdom plugin return the full list of
group-memberships during a user lookup request. With these version there
is no need to reject a initgroups request for sub/trusted-domain users
anymore. This is e.g. useful for callers which call getgrouplist()
directly without calling getpwnam() before. Additionally it helps if for
some reasons the lifetime of the user entry and the lifetime of the
initgroups data is different.

Related to https://fedorahosted.org/sssd/ticket/2633
---
 src/providers/ipa/ipa_s2n_exop.c      |  3 ---
 src/providers/ipa/ipa_subdomains.h    |  4 ++++
 src/providers/ipa/ipa_subdomains_id.c | 24 +++++++++++++++++-------
 3 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 688fdefe8eefe29a0cd13010bb3998527f3111f4..7ee2e0f16803a34b0a657ea12b102a8ae4364af8 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -50,9 +50,6 @@ enum response_types {
 };
 
 /* ==Sid2Name Extended Operation============================================= */
-#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
-#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
-
 struct ipa_s2n_exop_state {
     struct sdap_handle *sh;
 
diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
index 5266943f8e34f6e918022ee470f9c8fcc2199a8e..0cece2cc70a81f81ff143259e620be7e3d143244 100644
--- a/src/providers/ipa/ipa_subdomains.h
+++ b/src/providers/ipa/ipa_subdomains.h
@@ -28,6 +28,10 @@
 #include "providers/dp_backend.h"
 #include "providers/ipa/ipa_common.h"
 
+/* ==Sid2Name Extended Operation============================================= */
+#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
+#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
+
 struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx);
 
 int ipa_subdom_init(struct be_ctx *be_ctx,
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 15776d2e13af158058a874f761671a5801cf3d6a..1253510dcb8523c19d879d4351ffa07995f161f7 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -386,15 +386,9 @@ struct tevent_req *ipa_get_subdom_acct_send(TALLOC_CTX *memctx,
         case BE_REQ_GROUP:
         case BE_REQ_BY_SECID:
         case BE_REQ_USER_AND_GROUP:
+        case BE_REQ_INITGROUPS:
             ret = EOK;
             break;
-        case BE_REQ_INITGROUPS:
-            ret = ENOTSUP;
-            DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \
-                                      "by the IPA provider but are resolved " \
-                                      "by the responder directly from the " \
-                                      "cache.\n");
-            break;
         default:
             ret = EINVAL;
             DEBUG(SSSDBG_OP_FAILURE, "Invalid sub-domain request type.\n");
@@ -434,6 +428,22 @@ static void ipa_get_subdom_acct_connected(struct tevent_req *subreq)
         return;
     }
 
+    if (state->entry_type == BE_REQ_INITGROUPS) {
+        /* With V1 of the extdom plugin a user lookup will resolve the full
+         * group membership of the user. */
+        if (sdap_is_extension_supported(sdap_id_op_handle(state->op),
+                                        EXOP_SID2NAME_V1_OID)) {
+            state->entry_type = BE_REQ_USER;
+        } else {
+            DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \
+                                      "by the IPA provider but are resolved " \
+                                      "by the responder directly from the " \
+                                      "cache.\n");
+            tevent_req_error(req, ENOTSUP);
+            return;
+        }
+    }
+
     req_input = talloc(state, struct req_input);
     if (req_input == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "talloc failed.\n");
-- 
2.1.0

-------------- next part --------------
From 6da4f725dc3338fbd666933a03d919c04f0a84c1 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Apr 2015 17:20:05 +0200
Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally

Newer versions of the extdom plugin return the full list of
group-memberships during user lookups. As a result the lifetime of the
group-membership data is updates in those cases. But if the user is not
looked up directly but is resolved as a group member during a group
lookup SSSD does not resolve all group-membership of the user to avoid
deep recursion and eventually a complete enumeration of the user and
group base. In this case the lifetime of the group-memberships should
not be updated because it might be incomplete.

Related to https://fedorahosted.org/sssd/ticket/2633
---
 src/providers/ipa/ipa_s2n_exop.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 7ee2e0f16803a34b0a657ea12b102a8ae4364af8..24d1b6c70c557c5e6d488a14f64e97493b924907 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -685,7 +685,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
                                     struct resp_attrs *attrs,
                                     struct resp_attrs *simple_attrs,
                                     const char *view_name,
-                                    struct sysdb_attrs *override_attrs);
+                                    struct sysdb_attrs *override_attrs,
+                                    bool update_initgr_timeout);
 
 static errno_t s2n_response_to_attrs(TALLOC_CTX *mem_ctx,
                                      char *retoid,
@@ -1118,7 +1119,7 @@ static errno_t ipa_s2n_get_fqlist_save_step(struct tevent_req *req)
 
     ret = ipa_s2n_save_objects(state->dom, &state->req_input, state->attrs,
                                NULL, state->ipa_ctx->view_name,
-                               state->override_attrs);
+                               state->override_attrs, false);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
         return ret;
@@ -1617,7 +1618,7 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
             || strcmp(state->ipa_ctx->view_name,
                       SYSDB_DEFAULT_VIEW_NAME) == 0) {
         ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
-                                   state->simple_attrs, NULL, NULL);
+                                   state->simple_attrs, NULL, NULL, true);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
             goto done;
@@ -1739,7 +1740,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
                                     struct resp_attrs *attrs,
                                     struct resp_attrs *simple_attrs,
                                     const char *view_name,
-                                    struct sysdb_attrs *override_attrs)
+                                    struct sysdb_attrs *override_attrs,
+                                    bool update_initgr_timeout)
 {
     int ret;
     time_t now;
@@ -1938,7 +1940,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
                 }
             }
 
-            if (attrs->response_type == RESP_USER_GROUPLIST) {
+            if (attrs->response_type == RESP_USER_GROUPLIST
+                    && update_initgr_timeout) {
                 /* Since RESP_USER_GROUPLIST contains all group memberships it
                  * is effectively an initgroups request hence
                  * SYSDB_INITGR_EXPIRE will be set.*/
@@ -2209,7 +2212,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req  *subreq)
                                  &sid_str);
     if (ret == ENOENT) {
         ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
-                                   state->simple_attrs, NULL, NULL);
+                                   state->simple_attrs, NULL, NULL, true);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
             goto fail;
@@ -2249,7 +2252,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req  *subreq)
         ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
                                    state->simple_attrs,
                                    state->ipa_ctx->view_name,
-                                   state->override_attrs);
+                                   state->override_attrs, true);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
             tevent_req_error(req, ret);
@@ -2285,7 +2288,7 @@ static void ipa_s2n_get_user_get_override_done(struct tevent_req *subreq)
 
     ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
                                state->simple_attrs, state->ipa_ctx->view_name,
-                               override_attrs);
+                               override_attrs, true);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
         tevent_req_error(req, ret);
-- 
2.1.0

-------------- next part --------------
From 1a6f30051b40910de40fdaa27bc7f93ca94c21ca Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Apr 2015 20:58:15 +0200
Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()

This patch makes ipa_initgr_get_overrides_send() public and add support
to search overrides by UUID or by SID.

Related to https://fedorahosted.org/sssd/ticket/2633
---
 src/providers/ipa/ipa_id.c | 75 ++++++++++++++++++++++++++++++++--------------
 src/providers/ipa/ipa_id.h | 10 +++++++
 2 files changed, 63 insertions(+), 22 deletions(-)

diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
index 125a17ca6f29077cbb93e0444e395d0de8b23d63..bf38987a36e5d3612490cad87bfe4b8914ced58b 100644
--- a/src/providers/ipa/ipa_id.c
+++ b/src/providers/ipa/ipa_id.c
@@ -294,6 +294,7 @@ struct ipa_initgr_get_overrides_state {
 
     struct ldb_message **groups;
     size_t group_count;
+    const char *groups_id_attr;
     size_t group_idx;
     struct be_acct_req *ar;
 
@@ -302,13 +303,14 @@ struct ipa_initgr_get_overrides_state {
 
 static int ipa_initgr_get_overrides_step(struct tevent_req *req);
 
-static struct tevent_req *
+struct tevent_req *
 ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
                              struct tevent_context *ev,
                              struct ipa_id_ctx *ipa_ctx,
                              struct sss_domain_info *user_dom,
                              size_t groups_count,
-                             struct ldb_message **groups)
+                             struct ldb_message **groups,
+                             const char *groups_id_attr)
 {
     int ret;
     struct tevent_req *req;
@@ -334,6 +336,12 @@ ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
         ret = EINVAL;
         goto done;
     }
+    state->groups_id_attr = talloc_strdup(state, groups_id_attr);
+    if (state->groups_id_attr == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
+        ret = ENOMEM;
+        goto done;
+    }
 
     ret = ipa_initgr_get_overrides_step(req);
 done:
@@ -366,7 +374,7 @@ static int ipa_initgr_get_overrides_step(struct tevent_req *req)
     }
 
     ipa_uuid = ldb_msg_find_attr_as_string(state->groups[state->group_idx],
-                                            SYSDB_UUID, NULL);
+                                           state->groups_id_attr, NULL);
     if (ipa_uuid == NULL) {
         /* This should never happen, the search filter used to get the list
          * of groups includes "uuid=*"
@@ -377,11 +385,24 @@ static int ipa_initgr_get_overrides_step(struct tevent_req *req)
 
     talloc_free(state->ar); /* Avoid spiking memory with many groups */
 
-    ret = get_be_acct_req_for_uuid(state, ipa_uuid,
-                                   state->user_dom->name, &state->ar);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
-        return ret;
+    if (strcmp(state->groups_id_attr, SYSDB_UUID) == 0) {
+        ret = get_be_acct_req_for_uuid(state, ipa_uuid,
+                                       state->user_dom->name, &state->ar);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
+            return ret;
+        }
+    } else if (strcmp(state->groups_id_attr, SYSDB_SID_STR) == 0) {
+        ret = get_be_acct_req_for_sid(state, ipa_uuid,
+                                      state->user_dom->name, &state->ar);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
+            return ret;
+        }
+    } else {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported groups ID type [%s].\n",
+                                   state->groups_id_attr);
+        return EINVAL;
     }
 
     DEBUG(SSSDBG_TRACE_LIBS, "Fetching group %s\n", ipa_uuid);
@@ -408,7 +429,7 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
     struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
                                         struct ipa_initgr_get_overrides_state);
     int ret;
-    struct sysdb_attrs *override_attrs;
+    struct sysdb_attrs *override_attrs = NULL;
 
     ret = ipa_get_ad_override_recv(subreq, &state->dp_error, state,
                                    &override_attrs);
@@ -419,15 +440,23 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
         return;
     }
 
-    ret = sysdb_store_override(state->user_dom, state->ipa_ctx->view_name,
-                               SYSDB_MEMBER_GROUP,
-                               override_attrs,
-                               state->groups[state->group_idx]->dn);
-    talloc_free(override_attrs);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
-        tevent_req_error(req, ret);
-        return;
+    if (override_attrs != NULL) {
+        if (strcmp(state->ipa_ctx->view_name, SYSDB_DEFAULT_VIEW_NAME) == 0) {
+            ret = sysdb_apply_default_override(state->user_dom, override_attrs,
+                                           state->groups[state->group_idx]->dn);
+        } else {
+            ret = sysdb_store_override(state->user_dom,
+                                       state->ipa_ctx->view_name,
+                                       SYSDB_MEMBER_GROUP,
+                                       override_attrs,
+                                       state->groups[state->group_idx]->dn);
+        }
+        talloc_free(override_attrs);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
+            tevent_req_error(req, ret);
+            return;
+        }
     }
 
     state->group_idx++;
@@ -443,7 +472,7 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
     tevent_req_done(req);
 }
 
-static int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
+int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
 {
     struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
                                         struct ipa_initgr_get_overrides_state);
@@ -882,7 +911,8 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
     if (state->user_groups != NULL) {
         subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
                                               state->domain, state->group_cnt,
-                                              state->user_groups);
+                                              state->user_groups,
+                                              SYSDB_UUID);
         if (subreq == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
             ret = ENOMEM;
@@ -960,8 +990,9 @@ static void ipa_id_get_account_info_done(struct tevent_req *subreq)
 
     if (state->user_groups != NULL) {
         subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
-                                              state->domain, state->group_cnt,
-                                              state->user_groups);
+                                               state->domain, state->group_cnt,
+                                               state->user_groups,
+                                               SYSDB_UUID);
         if (subreq == NULL) {
             DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
             ret = ENOMEM;
diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index 2bb5e0d38f42d4bbb04854dfb04804fecf6257e8..c03ca037a2850478a8f4933bac4fcf8bd70ada04 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -119,4 +119,14 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
                               struct sss_domain_info *dom,
                               struct be_acct_req *ar,
                               struct ldb_message **_msg);
+
+struct tevent_req *
+ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
+                             struct tevent_context *ev,
+                             struct ipa_id_ctx *ipa_ctx,
+                             struct sss_domain_info *user_dom,
+                             size_t groups_count,
+                             struct ldb_message **groups,
+                             const char *groups_id_attr);
+int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error);
 #endif
-- 
2.1.0

-------------- next part --------------
From 6ca93e48d07f626f81177cc03340c103d0689e33 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 28 Apr 2015 20:59:43 +0200
Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode

After the group memberships of a user from a trusted domain are read it
must be checked if there are overrides for the discovered groups to be
able to return the right gid or name to the caller.

Related to https://fedorahosted.org/sssd/ticket/2633
---
 src/providers/ipa/ipa_subdomains_id.c | 70 +++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 1253510dcb8523c19d879d4351ffa07995f161f7..ed9dcd766292b3ebeb84a659941ee4c1d7b5a62b 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -569,6 +569,8 @@ struct ipa_get_ad_acct_state {
 static void ipa_get_ad_acct_ad_part_done(struct tevent_req *subreq);
 static void ipa_get_ad_override_done(struct tevent_req *subreq);
 static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req);
+static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req);
+static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq);
 static void ipa_get_ad_acct_done(struct tevent_req *subreq);
 static struct ad_id_ctx *ipa_get_ad_id_ctx(struct ipa_id_ctx *ipa_ctx,
                                            struct sss_domain_info *dom);
@@ -1123,6 +1125,9 @@ static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req)
     struct tevent_req *subreq;
     const char *obj_name;
     int entry_type;
+    size_t groups_count = 0;
+    struct ldb_message **groups = NULL;
+    const char *attrs[] = SYSDB_INITGR_ATTRS;
 
     if (state->override_attrs != NULL) {
         /* We are in ipa-server-mode, so the view is the default view by
@@ -1179,6 +1184,71 @@ static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req)
         state->ar->entry_type = BE_REQ_USER;
     }
 
+    /* Lookup all groups the user is a member of which do not have ORIGINALAD
+     * attributes set, i.e. where overrides might not have been applied. */
+    ret = sysdb_asq_search(state, state->obj_dom, state->obj_msg->dn,
+                          "(&("SYSDB_GC")("SYSDB_GIDNUM"=*)" \
+                            "(!("ORIGINALAD_PREFIX SYSDB_GIDNUM"=*))" \
+                            "(!("ORIGINALAD_PREFIX SYSDB_NAME"=*)))",
+                          SYSDB_INITGR_ATTR,
+                          attrs, &groups_count, &groups);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_groups_without_orig failed.\n");
+        return ret;
+    }
+
+    if (groups != NULL) {
+        subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
+                                               state->obj_dom, groups_count,
+                                               groups, SYSDB_SID_STR);
+        if (subreq == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "ipa_initgr_get_overrides_send failed.\n");
+            return ENOMEM;
+        }
+        tevent_req_set_callback(subreq, ipa_id_get_groups_overrides_done, req);
+        return EOK;
+    }
+
+    ret = ipa_get_ad_ipa_membership_step(req);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step failed.\n");
+        return ret;
+    }
+
+    return EOK;
+}
+
+static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    errno_t ret;
+
+    ret = ipa_initgr_get_overrides_recv(subreq, NULL);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "IPA resolve user groups overrides failed [%d].\n", ret);
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    ret = ipa_get_ad_ipa_membership_step(req);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step failed.\n");
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    return;
+}
+
+static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req)
+{
+    struct ipa_get_ad_acct_state *state = tevent_req_data(req,
+                                                struct ipa_get_ad_acct_state);
+    errno_t ret;
+    struct tevent_req *subreq;
 
     /* For initgroups request we have to check IPA group memberships of AD
      * users. This has to be done for other user-request as well to make sure
-- 
2.1.0



More information about the sssd-devel mailing list