[SSSD] [PATCHES] IPA: fixed for initgroups with overrides

Sumit Bose sbose at redhat.com
Wed Apr 29 14:45:53 UTC 2015


On Wed, Apr 29, 2015 at 03:27:31PM +0200, Sumit Bose wrote:
> On Wed, Apr 29, 2015 at 02:12:48PM +0200, Jakub Hrozek wrote:
> > On Wed, Apr 29, 2015 at 11:25:04AM +0200, Sumit Bose wrote:
> > > Hi,
> > > 
> > > while analyzing the test case described in
> > > https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
> > > the client and server code which are hopefully fixed by the attached
> > > patch set.
> > > 
> > > bye,
> > > Sumit
> > 
> > > From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose at redhat.com>
> > > Date: Tue, 28 Apr 2015 17:18:48 +0200
> > > Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
> > > 
> > > Newer versions of the extdom plugin return the full list of
> > > group-memberships during a user lookup request. With these version there
> > > is no need to reject a initgroups request for sub/trusted-domain users
> > > anymore. This is e.g. useful for callers which call getgrouplist()
> > > directly without calling getpwnam() before. Additionally it helps if for
> > > some reasons the lifetime of the user entry and the lifetime of the
> > > initgroups data is different.
> > > 
> > > Related to https://fedorahosted.org/sssd/ticket/2633
> > 
> > ACK
> > 
> > Makes sense, tested with id from command line and os.initgroups() from
> > Python.
> > 
> > > From 627ebf1782fb5dafa2536f5d451e1d39f46f0012 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose at redhat.com>
> > > Date: Tue, 28 Apr 2015 17:20:05 +0200
> > > Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
> > > 
> > > Newer versions of the extdom plugin return the full list of
> > > group-memberships during user lookups. As a result the lifetime of the
> > > group-membership data is updates in those cases. But if the user is not
> > > looked up directly but is resolved as a group member during a group
> > > lookup SSSD does not resolve all group-membership of the user to avoid
> > > deep recursion and eventually a complete enumeration of the user and
> > > group base. In this case the lifetime of the group-memberships should
> > > not be updated because it might be incomplete.
> > > 
> > > Related to https://fedorahosted.org/sssd/ticket/2633
> > 
> > ACK, nice catch
> > 
> > > From 0dcbb088866cbc459379f8c0e23a75585b2036a8 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose at redhat.com>
> > > Date: Tue, 28 Apr 2015 20:58:15 +0200
> > > Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
> > > 
> > > This patch makes ipa_initgr_get_overrides_send() public and add support
> > > to search overrides by UUID or by SID.
> > 
> > Do you think this interface might be used more in the future? If yes,
> > then it would be cleaner to also restrict the synopsis of the function
> > with some enum or wrap around mini-request that would pass the ar
> > directly rather than allowing generic char* and then checking against
> > known values.
> > 
> > But for now I'm fine with letting the code go, if the programmer uses
> > the interface, he would get an error with an unsupported value..
> 
> so far we only have SID and UUID based anchors, so I do not expect any
> additions or increased usage any time soon.

sorry, I found a bug in this patch, will send a new version, soon.

bye,
Sumit

> 
> > 
> > > From 94f9ab29cd40338e7fa7dee636065cf8d06ec330 Mon Sep 17 00:00:00 2001
> > > From: Sumit Bose <sbose at redhat.com>
> > > Date: Tue, 28 Apr 2015 20:59:43 +0200
> > > Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
> > > 
> > > After the group memberships of a user from a trusted domain are read it
> > > must be checked if there are overrides for the discovered groups to be
> > > able to return the right gid or name to the caller.
> > > 
> > > Related to https://fedorahosted.org/sssd/ticket/2633
> > 
> > This patch causes a compilation warning:
> > src/providers/ipa/ipa_subdomains_id.c: In function 'ipa_id_get_groups_overrides_done':
> > src/providers/ipa/ipa_subdomains_id.c:1225:35: warning: unused variable 'state' [-Wunused-variable]
> >      struct ipa_get_ad_acct_state *state = tevent_req_data(req,
> 
> sorry, must have missed that, new version attached.
> 
> bye,
> Sumit
> 
> > 
> > But functionally-wise seems OK.
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

> From 659f21eca00085c44233c3c307cd4bf2ad934beb Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 17:18:48 +0200
> Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
> 
> Newer versions of the extdom plugin return the full list of
> group-memberships during a user lookup request. With these version there
> is no need to reject a initgroups request for sub/trusted-domain users
> anymore. This is e.g. useful for callers which call getgrouplist()
> directly without calling getpwnam() before. Additionally it helps if for
> some reasons the lifetime of the user entry and the lifetime of the
> initgroups data is different.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633
> ---
>  src/providers/ipa/ipa_s2n_exop.c      |  3 ---
>  src/providers/ipa/ipa_subdomains.h    |  4 ++++
>  src/providers/ipa/ipa_subdomains_id.c | 24 +++++++++++++++++-------
>  3 files changed, 21 insertions(+), 10 deletions(-)
> 
> diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
> index 688fdefe8eefe29a0cd13010bb3998527f3111f4..7ee2e0f16803a34b0a657ea12b102a8ae4364af8 100644
> --- a/src/providers/ipa/ipa_s2n_exop.c
> +++ b/src/providers/ipa/ipa_s2n_exop.c
> @@ -50,9 +50,6 @@ enum response_types {
>  };
>  
>  /* ==Sid2Name Extended Operation============================================= */
> -#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
> -#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
> -
>  struct ipa_s2n_exop_state {
>      struct sdap_handle *sh;
>  
> diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
> index 5266943f8e34f6e918022ee470f9c8fcc2199a8e..0cece2cc70a81f81ff143259e620be7e3d143244 100644
> --- a/src/providers/ipa/ipa_subdomains.h
> +++ b/src/providers/ipa/ipa_subdomains.h
> @@ -28,6 +28,10 @@
>  #include "providers/dp_backend.h"
>  #include "providers/ipa/ipa_common.h"
>  
> +/* ==Sid2Name Extended Operation============================================= */
> +#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
> +#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
> +
>  struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx);
>  
>  int ipa_subdom_init(struct be_ctx *be_ctx,
> diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
> index 15776d2e13af158058a874f761671a5801cf3d6a..1253510dcb8523c19d879d4351ffa07995f161f7 100644
> --- a/src/providers/ipa/ipa_subdomains_id.c
> +++ b/src/providers/ipa/ipa_subdomains_id.c
> @@ -386,15 +386,9 @@ struct tevent_req *ipa_get_subdom_acct_send(TALLOC_CTX *memctx,
>          case BE_REQ_GROUP:
>          case BE_REQ_BY_SECID:
>          case BE_REQ_USER_AND_GROUP:
> +        case BE_REQ_INITGROUPS:
>              ret = EOK;
>              break;
> -        case BE_REQ_INITGROUPS:
> -            ret = ENOTSUP;
> -            DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \
> -                                      "by the IPA provider but are resolved " \
> -                                      "by the responder directly from the " \
> -                                      "cache.\n");
> -            break;
>          default:
>              ret = EINVAL;
>              DEBUG(SSSDBG_OP_FAILURE, "Invalid sub-domain request type.\n");
> @@ -434,6 +428,22 @@ static void ipa_get_subdom_acct_connected(struct tevent_req *subreq)
>          return;
>      }
>  
> +    if (state->entry_type == BE_REQ_INITGROUPS) {
> +        /* With V1 of the extdom plugin a user lookup will resolve the full
> +         * group membership of the user. */
> +        if (sdap_is_extension_supported(sdap_id_op_handle(state->op),
> +                                        EXOP_SID2NAME_V1_OID)) {
> +            state->entry_type = BE_REQ_USER;
> +        } else {
> +            DEBUG(SSSDBG_TRACE_FUNC, "Initgroups requests are not handled " \
> +                                      "by the IPA provider but are resolved " \
> +                                      "by the responder directly from the " \
> +                                      "cache.\n");
> +            tevent_req_error(req, ENOTSUP);
> +            return;
> +        }
> +    }
> +
>      req_input = talloc(state, struct req_input);
>      if (req_input == NULL) {
>          DEBUG(SSSDBG_OP_FAILURE, "talloc failed.\n");
> -- 
> 2.1.0
> 

> From 6da4f725dc3338fbd666933a03d919c04f0a84c1 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 17:20:05 +0200
> Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
> 
> Newer versions of the extdom plugin return the full list of
> group-memberships during user lookups. As a result the lifetime of the
> group-membership data is updates in those cases. But if the user is not
> looked up directly but is resolved as a group member during a group
> lookup SSSD does not resolve all group-membership of the user to avoid
> deep recursion and eventually a complete enumeration of the user and
> group base. In this case the lifetime of the group-memberships should
> not be updated because it might be incomplete.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633
> ---
>  src/providers/ipa/ipa_s2n_exop.c | 19 +++++++++++--------
>  1 file changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
> index 7ee2e0f16803a34b0a657ea12b102a8ae4364af8..24d1b6c70c557c5e6d488a14f64e97493b924907 100644
> --- a/src/providers/ipa/ipa_s2n_exop.c
> +++ b/src/providers/ipa/ipa_s2n_exop.c
> @@ -685,7 +685,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
>                                      struct resp_attrs *attrs,
>                                      struct resp_attrs *simple_attrs,
>                                      const char *view_name,
> -                                    struct sysdb_attrs *override_attrs);
> +                                    struct sysdb_attrs *override_attrs,
> +                                    bool update_initgr_timeout);
>  
>  static errno_t s2n_response_to_attrs(TALLOC_CTX *mem_ctx,
>                                       char *retoid,
> @@ -1118,7 +1119,7 @@ static errno_t ipa_s2n_get_fqlist_save_step(struct tevent_req *req)
>  
>      ret = ipa_s2n_save_objects(state->dom, &state->req_input, state->attrs,
>                                 NULL, state->ipa_ctx->view_name,
> -                               state->override_attrs);
> +                               state->override_attrs, false);
>      if (ret != EOK) {
>          DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
>          return ret;
> @@ -1617,7 +1618,7 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
>              || strcmp(state->ipa_ctx->view_name,
>                        SYSDB_DEFAULT_VIEW_NAME) == 0) {
>          ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
> -                                   state->simple_attrs, NULL, NULL);
> +                                   state->simple_attrs, NULL, NULL, true);
>          if (ret != EOK) {
>              DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
>              goto done;
> @@ -1739,7 +1740,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
>                                      struct resp_attrs *attrs,
>                                      struct resp_attrs *simple_attrs,
>                                      const char *view_name,
> -                                    struct sysdb_attrs *override_attrs)
> +                                    struct sysdb_attrs *override_attrs,
> +                                    bool update_initgr_timeout)
>  {
>      int ret;
>      time_t now;
> @@ -1938,7 +1940,8 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
>                  }
>              }
>  
> -            if (attrs->response_type == RESP_USER_GROUPLIST) {
> +            if (attrs->response_type == RESP_USER_GROUPLIST
> +                    && update_initgr_timeout) {
>                  /* Since RESP_USER_GROUPLIST contains all group memberships it
>                   * is effectively an initgroups request hence
>                   * SYSDB_INITGR_EXPIRE will be set.*/
> @@ -2209,7 +2212,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req  *subreq)
>                                   &sid_str);
>      if (ret == ENOENT) {
>          ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
> -                                   state->simple_attrs, NULL, NULL);
> +                                   state->simple_attrs, NULL, NULL, true);
>          if (ret != EOK) {
>              DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
>              goto fail;
> @@ -2249,7 +2252,7 @@ static void ipa_s2n_get_fqlist_done(struct tevent_req  *subreq)
>          ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
>                                     state->simple_attrs,
>                                     state->ipa_ctx->view_name,
> -                                   state->override_attrs);
> +                                   state->override_attrs, true);
>          if (ret != EOK) {
>              DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
>              tevent_req_error(req, ret);
> @@ -2285,7 +2288,7 @@ static void ipa_s2n_get_user_get_override_done(struct tevent_req *subreq)
>  
>      ret = ipa_s2n_save_objects(state->dom, state->req_input, state->attrs,
>                                 state->simple_attrs, state->ipa_ctx->view_name,
> -                               override_attrs);
> +                               override_attrs, true);
>      if (ret != EOK) {
>          DEBUG(SSSDBG_OP_FAILURE, "ipa_s2n_save_objects failed.\n");
>          tevent_req_error(req, ret);
> -- 
> 2.1.0
> 

> From 1a6f30051b40910de40fdaa27bc7f93ca94c21ca Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 20:58:15 +0200
> Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
> 
> This patch makes ipa_initgr_get_overrides_send() public and add support
> to search overrides by UUID or by SID.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633
> ---
>  src/providers/ipa/ipa_id.c | 75 ++++++++++++++++++++++++++++++++--------------
>  src/providers/ipa/ipa_id.h | 10 +++++++
>  2 files changed, 63 insertions(+), 22 deletions(-)
> 
> diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
> index 125a17ca6f29077cbb93e0444e395d0de8b23d63..bf38987a36e5d3612490cad87bfe4b8914ced58b 100644
> --- a/src/providers/ipa/ipa_id.c
> +++ b/src/providers/ipa/ipa_id.c
> @@ -294,6 +294,7 @@ struct ipa_initgr_get_overrides_state {
>  
>      struct ldb_message **groups;
>      size_t group_count;
> +    const char *groups_id_attr;
>      size_t group_idx;
>      struct be_acct_req *ar;
>  
> @@ -302,13 +303,14 @@ struct ipa_initgr_get_overrides_state {
>  
>  static int ipa_initgr_get_overrides_step(struct tevent_req *req);
>  
> -static struct tevent_req *
> +struct tevent_req *
>  ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
>                               struct tevent_context *ev,
>                               struct ipa_id_ctx *ipa_ctx,
>                               struct sss_domain_info *user_dom,
>                               size_t groups_count,
> -                             struct ldb_message **groups)
> +                             struct ldb_message **groups,
> +                             const char *groups_id_attr)
>  {
>      int ret;
>      struct tevent_req *req;
> @@ -334,6 +336,12 @@ ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
>          ret = EINVAL;
>          goto done;
>      }
> +    state->groups_id_attr = talloc_strdup(state, groups_id_attr);
> +    if (state->groups_id_attr == NULL) {
> +        DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
> +        ret = ENOMEM;
> +        goto done;
> +    }
>  
>      ret = ipa_initgr_get_overrides_step(req);
>  done:
> @@ -366,7 +374,7 @@ static int ipa_initgr_get_overrides_step(struct tevent_req *req)
>      }
>  
>      ipa_uuid = ldb_msg_find_attr_as_string(state->groups[state->group_idx],
> -                                            SYSDB_UUID, NULL);
> +                                           state->groups_id_attr, NULL);
>      if (ipa_uuid == NULL) {
>          /* This should never happen, the search filter used to get the list
>           * of groups includes "uuid=*"
> @@ -377,11 +385,24 @@ static int ipa_initgr_get_overrides_step(struct tevent_req *req)
>  
>      talloc_free(state->ar); /* Avoid spiking memory with many groups */
>  
> -    ret = get_be_acct_req_for_uuid(state, ipa_uuid,
> -                                   state->user_dom->name, &state->ar);
> -    if (ret != EOK) {
> -        DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
> -        return ret;
> +    if (strcmp(state->groups_id_attr, SYSDB_UUID) == 0) {
> +        ret = get_be_acct_req_for_uuid(state, ipa_uuid,
> +                                       state->user_dom->name, &state->ar);
> +        if (ret != EOK) {
> +            DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
> +            return ret;
> +        }
> +    } else if (strcmp(state->groups_id_attr, SYSDB_SID_STR) == 0) {
> +        ret = get_be_acct_req_for_sid(state, ipa_uuid,
> +                                      state->user_dom->name, &state->ar);
> +        if (ret != EOK) {
> +            DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n");
> +            return ret;
> +        }
> +    } else {
> +        DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported groups ID type [%s].\n",
> +                                   state->groups_id_attr);
> +        return EINVAL;
>      }
>  
>      DEBUG(SSSDBG_TRACE_LIBS, "Fetching group %s\n", ipa_uuid);
> @@ -408,7 +429,7 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
>      struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
>                                          struct ipa_initgr_get_overrides_state);
>      int ret;
> -    struct sysdb_attrs *override_attrs;
> +    struct sysdb_attrs *override_attrs = NULL;
>  
>      ret = ipa_get_ad_override_recv(subreq, &state->dp_error, state,
>                                     &override_attrs);
> @@ -419,15 +440,23 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
>          return;
>      }
>  
> -    ret = sysdb_store_override(state->user_dom, state->ipa_ctx->view_name,
> -                               SYSDB_MEMBER_GROUP,
> -                               override_attrs,
> -                               state->groups[state->group_idx]->dn);
> -    talloc_free(override_attrs);
> -    if (ret != EOK) {
> -        DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
> -        tevent_req_error(req, ret);
> -        return;
> +    if (override_attrs != NULL) {
> +        if (strcmp(state->ipa_ctx->view_name, SYSDB_DEFAULT_VIEW_NAME) == 0) {
> +            ret = sysdb_apply_default_override(state->user_dom, override_attrs,
> +                                           state->groups[state->group_idx]->dn);
> +        } else {
> +            ret = sysdb_store_override(state->user_dom,
> +                                       state->ipa_ctx->view_name,
> +                                       SYSDB_MEMBER_GROUP,
> +                                       override_attrs,
> +                                       state->groups[state->group_idx]->dn);
> +        }
> +        talloc_free(override_attrs);
> +        if (ret != EOK) {
> +            DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_override failed.\n");
> +            tevent_req_error(req, ret);
> +            return;
> +        }
>      }
>  
>      state->group_idx++;
> @@ -443,7 +472,7 @@ static void ipa_initgr_get_overrides_override_done(struct tevent_req *subreq)
>      tevent_req_done(req);
>  }
>  
> -static int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
> +int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error)
>  {
>      struct ipa_initgr_get_overrides_state *state = tevent_req_data(req,
>                                          struct ipa_initgr_get_overrides_state);
> @@ -882,7 +911,8 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
>      if (state->user_groups != NULL) {
>          subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
>                                                state->domain, state->group_cnt,
> -                                              state->user_groups);
> +                                              state->user_groups,
> +                                              SYSDB_UUID);
>          if (subreq == NULL) {
>              DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
>              ret = ENOMEM;
> @@ -960,8 +990,9 @@ static void ipa_id_get_account_info_done(struct tevent_req *subreq)
>  
>      if (state->user_groups != NULL) {
>          subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
> -                                              state->domain, state->group_cnt,
> -                                              state->user_groups);
> +                                               state->domain, state->group_cnt,
> +                                               state->user_groups,
> +                                               SYSDB_UUID);
>          if (subreq == NULL) {
>              DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
>              ret = ENOMEM;
> diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
> index 2bb5e0d38f42d4bbb04854dfb04804fecf6257e8..c03ca037a2850478a8f4933bac4fcf8bd70ada04 100644
> --- a/src/providers/ipa/ipa_id.h
> +++ b/src/providers/ipa/ipa_id.h
> @@ -119,4 +119,14 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
>                                struct sss_domain_info *dom,
>                                struct be_acct_req *ar,
>                                struct ldb_message **_msg);
> +
> +struct tevent_req *
> +ipa_initgr_get_overrides_send(TALLOC_CTX *memctx,
> +                             struct tevent_context *ev,
> +                             struct ipa_id_ctx *ipa_ctx,
> +                             struct sss_domain_info *user_dom,
> +                             size_t groups_count,
> +                             struct ldb_message **groups,
> +                             const char *groups_id_attr);
> +int ipa_initgr_get_overrides_recv(struct tevent_req *req, int *dp_error);
>  #endif
> -- 
> 2.1.0
> 

> From 6ca93e48d07f626f81177cc03340c103d0689e33 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 20:59:43 +0200
> Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
> 
> After the group memberships of a user from a trusted domain are read it
> must be checked if there are overrides for the discovered groups to be
> able to return the right gid or name to the caller.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633
> ---
>  src/providers/ipa/ipa_subdomains_id.c | 70 +++++++++++++++++++++++++++++++++++
>  1 file changed, 70 insertions(+)
> 
> diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
> index 1253510dcb8523c19d879d4351ffa07995f161f7..ed9dcd766292b3ebeb84a659941ee4c1d7b5a62b 100644
> --- a/src/providers/ipa/ipa_subdomains_id.c
> +++ b/src/providers/ipa/ipa_subdomains_id.c
> @@ -569,6 +569,8 @@ struct ipa_get_ad_acct_state {
>  static void ipa_get_ad_acct_ad_part_done(struct tevent_req *subreq);
>  static void ipa_get_ad_override_done(struct tevent_req *subreq);
>  static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req);
> +static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req);
> +static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq);
>  static void ipa_get_ad_acct_done(struct tevent_req *subreq);
>  static struct ad_id_ctx *ipa_get_ad_id_ctx(struct ipa_id_ctx *ipa_ctx,
>                                             struct sss_domain_info *dom);
> @@ -1123,6 +1125,9 @@ static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req)
>      struct tevent_req *subreq;
>      const char *obj_name;
>      int entry_type;
> +    size_t groups_count = 0;
> +    struct ldb_message **groups = NULL;
> +    const char *attrs[] = SYSDB_INITGR_ATTRS;
>  
>      if (state->override_attrs != NULL) {
>          /* We are in ipa-server-mode, so the view is the default view by
> @@ -1179,6 +1184,71 @@ static errno_t ipa_get_ad_apply_override_step(struct tevent_req *req)
>          state->ar->entry_type = BE_REQ_USER;
>      }
>  
> +    /* Lookup all groups the user is a member of which do not have ORIGINALAD
> +     * attributes set, i.e. where overrides might not have been applied. */
> +    ret = sysdb_asq_search(state, state->obj_dom, state->obj_msg->dn,
> +                          "(&("SYSDB_GC")("SYSDB_GIDNUM"=*)" \
> +                            "(!("ORIGINALAD_PREFIX SYSDB_GIDNUM"=*))" \
> +                            "(!("ORIGINALAD_PREFIX SYSDB_NAME"=*)))",
> +                          SYSDB_INITGR_ATTR,
> +                          attrs, &groups_count, &groups);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_groups_without_orig failed.\n");
> +        return ret;
> +    }
> +
> +    if (groups != NULL) {
> +        subreq = ipa_initgr_get_overrides_send(state, state->ev, state->ipa_ctx,
> +                                               state->obj_dom, groups_count,
> +                                               groups, SYSDB_SID_STR);
> +        if (subreq == NULL) {
> +            DEBUG(SSSDBG_OP_FAILURE, "ipa_initgr_get_overrides_send failed.\n");
> +            return ENOMEM;
> +        }
> +        tevent_req_set_callback(subreq, ipa_id_get_groups_overrides_done, req);
> +        return EOK;
> +    }
> +
> +    ret = ipa_get_ad_ipa_membership_step(req);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step failed.\n");
> +        return ret;
> +    }
> +
> +    return EOK;
> +}
> +
> +static void ipa_id_get_groups_overrides_done(struct tevent_req *subreq)
> +{
> +    struct tevent_req *req = tevent_req_callback_data(subreq,
> +                                                struct tevent_req);
> +    errno_t ret;
> +
> +    ret = ipa_initgr_get_overrides_recv(subreq, NULL);
> +    talloc_zfree(subreq);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_OP_FAILURE,
> +              "IPA resolve user groups overrides failed [%d].\n", ret);
> +        tevent_req_error(req, ret);
> +        return;
> +    }
> +
> +    ret = ipa_get_ad_ipa_membership_step(req);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ad_ipa_membership_step failed.\n");
> +        tevent_req_error(req, ret);
> +        return;
> +    }
> +
> +    return;
> +}
> +
> +static errno_t ipa_get_ad_ipa_membership_step(struct tevent_req *req)
> +{
> +    struct ipa_get_ad_acct_state *state = tevent_req_data(req,
> +                                                struct ipa_get_ad_acct_state);
> +    errno_t ret;
> +    struct tevent_req *subreq;
>  
>      /* For initgroups request we have to check IPA group memberships of AD
>       * users. This has to be done for other user-request as well to make sure
> -- 
> 2.1.0
> 

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list