[SSSD] IPA: resolve ghost members if a non-default view is applied

Sumit Bose sbose at redhat.com
Tue Jan 13 10:35:32 UTC 2015


On Fri, Jan 09, 2015 at 11:54:27AM +0100, Jakub Hrozek wrote:
> On Wed, Dec 17, 2014 at 11:27:46AM +0100, Sumit Bose wrote:
> > yes, the check was useless because state->obj_msg is always set if
> > get_object_from_cache() returns EOK.
> > 
> > New version attached.
> > 
> > bye,
> > Sumit
> > 
> > > _______________________________________________
> > > sssd-devel mailing list
> > > sssd-devel at lists.fedorahosted.org
> > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > 
> 
> After testing the patches, I can confirm that group resolution of a
> group that contains a user with overriden login attribute:
>     ipa idoverrideuser-mod --login=overriden_tuser
> 
> Now works OK. But getent group still shows the original user name (b/c
> the original user name is set in the memberUid attribute, set by the
> memberof plugin). Is that expected.

no, the new version contains patches 3 and 4 which should fix it.

> 
> There is a compilation warning in the code:
> src/providers/ipa/ipa_id.c: In function 'ipa_resolve_user_list_get_user_step':
> src/providers/ipa/ipa_id.c:218:11: warning: pointer targets in passing argument 2 of 'get_be_acct_req_for_user_name' differ in signedness [-Wpointer-sign]
>      ret = get_be_acct_req_for_user_name(state,
>            ^
> In file included from src/providers/ipa/ipa_id.c:31:0:
> ./src/providers/ipa/ipa_id.h:90:9: note: expected 'const char *' but argument is of type 'uint8_t *'

fixed

> 
> Two nitpicks in the code:
> 
> > +static struct tevent_req *
> > +ipa_resolve_user_list_send(TALLOC_CTX *memctx, struct tevent_context *ev,
> > +                           struct be_req *be_req,
> > +                           struct sdap_id_ctx *sdap_id_ctx,
> > +                           const char *domain_name,
> > +                           struct ldb_message_element *users)
> > +{
> > +    int ret;
> > +    struct tevent_req *req;
> > +    struct ipa_resolve_user_list_state *state;
> > +
> > +    req = tevent_req_create(memctx, &state,
> > +                            struct ipa_resolve_user_list_state);
> > +    if (req == NULL) {
> > +        DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");
> > +        return NULL;
> > +    }
> > +
> > +    state->ev = ev;
> > +    state->sdap_id_ctx = sdap_id_ctx;
> > +    state->be_req = be_req;
> > +    state->domain_name = domain_name;
> > +    state->users = users;
> > +    state->user_idx = 0;
> > +    state->dp_error = DP_ERR_FATAL;
> > +
> > +    ret = ipa_resolve_user_list_get_user_step(req);
> > +    if (ret == EAGAIN) {
> > +        return req;
> > +    }
> 
> Can you add else if into this check:
>   if EAGAIN
>   else if ret != EOK
> 
> To make it more clear that it's one check, not two.

fixed

> 
> > +    if (ret != EOK) {
> > +        DEBUG(SSSDBG_OP_FAILURE,
> > +              "ipa_resolve_user_list_get_user_step failed.\n");
> > +    }
> 
> [...]
> 
> > @@ -166,6 +315,7 @@ static errno_t ipa_id_get_account_info_get_original_step(struct tevent_req *req,
> >                                                          struct be_acct_req *ar);
> >  static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq);
> >  static void ipa_id_get_account_info_done(struct tevent_req *subreq);
> > +static void ipa_id_get_user_list_done(struct tevent_req *subreq);
> >  
> >  static struct tevent_req *
> >  ipa_id_get_account_info_send(TALLOC_CTX *memctx, struct tevent_context *ev,
> > @@ -405,6 +555,16 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
> >          goto fail;
> >      }
> >  
> > +    if ((state->ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_GROUP
> > +            && state->ipa_ctx->view_name != NULL
> > +            && strcmp(state->ipa_ctx->view_name,
> > +                      SYSDB_DEFAULT_VIEW_NAME) != 0) {
> > +        /* check for ghost members because shost members are not allowed if a
> 
> typo: s/shost/ghost/

fixed

New version attached.

Thank you for the review.

bye,
Sumit

> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From c88f86f2854bb735c411b59b4638c2fa3dd29928 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 10 Dec 2014 15:02:15 +0100
Subject: [PATCH 1/4] IPA: add get_be_acct_req_for_user_name()

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ipa/ipa_id.h    |  5 +++++
 src/providers/ipa/ipa_views.c | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index 9d219f281847df0ba4ac24061e598eb6915f9c38..2bb5e0d38f42d4bbb04854dfb04804fecf6257e8 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -87,6 +87,11 @@ errno_t get_be_acct_req_for_uuid(TALLOC_CTX *mem_ctx, const char *uuid,
                                  const char *domain_name,
                                  struct be_acct_req **_ar);
 
+errno_t get_be_acct_req_for_user_name(TALLOC_CTX *mem_ctx,
+                                      const char *user_name,
+                                      const char *domain_name,
+                                      struct be_acct_req **_ar);
+
 struct tevent_req *ipa_get_ad_override_send(TALLOC_CTX *mem_ctx,
                                             struct tevent_context *ev,
                                             struct sdap_id_ctx *sdap_id_ctx,
diff --git a/src/providers/ipa/ipa_views.c b/src/providers/ipa/ipa_views.c
index c768186d7cf5e5a997e2ca27a167b62c8dc99b3f..ccaea69563728a5cecc202709da5dab51747c040 100644
--- a/src/providers/ipa/ipa_views.c
+++ b/src/providers/ipa/ipa_views.c
@@ -177,6 +177,10 @@ static errno_t get_be_acct_req_for_xyz(TALLOC_CTX *mem_ctx, const char *val,
         ar->entry_type = BE_REQ_BY_UUID;
         ar->filter_type = BE_FILTER_UUID;
         break;
+    case BE_REQ_USER:
+        ar->entry_type = BE_REQ_USER;
+        ar->filter_type = BE_FILTER_NAME;
+        break;
     default:
         DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported request type [%d].\n", type);
         talloc_free(ar);
@@ -213,6 +217,15 @@ errno_t get_be_acct_req_for_uuid(TALLOC_CTX *mem_ctx, const char *uuid,
                                    _ar);
 }
 
+errno_t get_be_acct_req_for_user_name(TALLOC_CTX *mem_ctx,
+                                      const char *user_name,
+                                      const char *domain_name,
+                                      struct be_acct_req **_ar)
+{
+    return get_be_acct_req_for_xyz(mem_ctx, user_name, domain_name, BE_REQ_USER,
+                                   _ar);
+}
+
 struct ipa_get_ad_override_state {
     struct tevent_context *ev;
     struct sdap_id_ctx *sdap_id_ctx;
-- 
2.1.0

-------------- next part --------------
From 93514fe4ac86ad6587bab593575f41a25ba07082 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 10 Dec 2014 15:03:18 +0100
Subject: [PATCH 2/4] IPA: resolve ghost members if a non-default view is
 applied

Related to https://fedorahosted.org/sssd/ticket/2481
---
 src/providers/ipa/ipa_id.c            | 212 ++++++++++++++++++++++++++++++++++
 src/providers/ipa/ipa_subdomains_id.c |   1 +
 2 files changed, 213 insertions(+)

diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
index 5665a1835e8b0ab18325bfc68a8d8b5650730943..4df6ed0e8ee1e9886151703f424b4580db8799a4 100644
--- a/src/providers/ipa/ipa_id.c
+++ b/src/providers/ipa/ipa_id.c
@@ -144,6 +144,150 @@ static void ipa_account_info_done(struct tevent_req *req)
     sdap_handler_done(breq, dp_error, ret, error_text);
 }
 
+struct ipa_resolve_user_list_state {
+    struct tevent_context *ev;
+    struct sdap_id_ctx *sdap_id_ctx;
+    struct be_req *be_req;
+    struct ldb_message_element *users;
+    const char *domain_name;
+    size_t user_idx;
+
+    int dp_error;
+};
+
+static errno_t ipa_resolve_user_list_get_user_step(struct tevent_req *req);
+static void ipa_resolve_user_list_get_user_done(struct tevent_req *subreq);
+
+static struct tevent_req *
+ipa_resolve_user_list_send(TALLOC_CTX *memctx, struct tevent_context *ev,
+                           struct be_req *be_req,
+                           struct sdap_id_ctx *sdap_id_ctx,
+                           const char *domain_name,
+                           struct ldb_message_element *users)
+{
+    int ret;
+    struct tevent_req *req;
+    struct ipa_resolve_user_list_state *state;
+
+    req = tevent_req_create(memctx, &state,
+                            struct ipa_resolve_user_list_state);
+    if (req == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");
+        return NULL;
+    }
+
+    state->ev = ev;
+    state->sdap_id_ctx = sdap_id_ctx;
+    state->be_req = be_req;
+    state->domain_name = domain_name;
+    state->users = users;
+    state->user_idx = 0;
+    state->dp_error = DP_ERR_FATAL;
+
+    ret = ipa_resolve_user_list_get_user_step(req);
+    if (ret == EAGAIN) {
+        return req;
+    } else if (ret == EOK) {
+        state->dp_error = DP_ERR_OK;
+        tevent_req_done(req);
+    } else {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "ipa_resolve_user_list_get_user_step failed.\n");
+        tevent_req_error(req, ret);
+    }
+    tevent_req_post(req, ev);
+    return req;
+}
+
+static errno_t ipa_resolve_user_list_get_user_step(struct tevent_req *req)
+{
+    int ret;
+    struct tevent_req *subreq;
+    struct be_acct_req *ar;
+    struct ipa_resolve_user_list_state *state = tevent_req_data(req,
+                                            struct ipa_resolve_user_list_state);
+
+    if (state->user_idx >= state->users->num_values) {
+        return EOK;
+    }
+
+    ret = get_be_acct_req_for_user_name(state,
+                            (char *) state->users->values[state->user_idx].data,
+                            state->domain_name, &ar);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_user_name failed.\n");
+        return ret;
+    }
+
+    DEBUG(SSSDBG_TRACE_ALL, "Trying to resolve user [%s].\n", ar->filter_value);
+
+    subreq = sdap_handle_acct_req_send(state, state->be_req, ar,
+                                       state->sdap_id_ctx,
+                                       state->sdap_id_ctx->opts->sdom,
+                                       state->sdap_id_ctx->conn, true);
+    if (subreq == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct_req_send failed.\n");
+        return ENOMEM;
+    }
+
+    tevent_req_set_callback(subreq, ipa_resolve_user_list_get_user_done, req);
+
+    return EAGAIN;
+}
+
+static void ipa_resolve_user_list_get_user_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_resolve_user_list_state *state = tevent_req_data(req,
+                                            struct ipa_resolve_user_list_state);
+    int ret;
+
+    ret = sdap_handle_acct_req_recv(subreq, &state->dp_error, NULL, NULL);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct request failed: %d\n", ret);
+        goto done;
+    }
+
+    state->user_idx++;
+
+    ret = ipa_resolve_user_list_get_user_step(req);
+    if (ret == EAGAIN) {
+        return;
+    }
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "ipa_resolve_user_list_get_user_step failed.\n");
+    }
+
+done:
+    if (ret == EOK) {
+        state->dp_error = DP_ERR_OK;
+        tevent_req_done(req);
+    } else {
+        if (state->dp_error == DP_ERR_OK) {
+            state->dp_error = DP_ERR_FATAL;
+        }
+        tevent_req_error(req, ret);
+    }
+    return;
+}
+
+static int ipa_resolve_user_list_recv(struct tevent_req *req, int *dp_error)
+{
+    struct ipa_resolve_user_list_state *state = tevent_req_data(req,
+                                            struct ipa_resolve_user_list_state);
+
+    if (dp_error) {
+        *dp_error = state->dp_error;
+    }
+
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+
+    return EOK;
+}
+
 struct ipa_id_get_account_info_state {
     struct tevent_context *ev;
     struct ipa_id_ctx *ipa_ctx;
@@ -157,6 +301,7 @@ struct ipa_id_get_account_info_state {
 
     struct sysdb_attrs *override_attrs;
     struct ldb_message *obj_msg;
+    struct ldb_message_element *ghosts;
     int dp_error;
 };
 
@@ -166,6 +311,7 @@ static errno_t ipa_id_get_account_info_get_original_step(struct tevent_req *req,
                                                         struct be_acct_req *ar);
 static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq);
 static void ipa_id_get_account_info_done(struct tevent_req *subreq);
+static void ipa_id_get_user_list_done(struct tevent_req *subreq);
 
 static struct tevent_req *
 ipa_id_get_account_info_send(TALLOC_CTX *memctx, struct tevent_context *ev,
@@ -405,6 +551,16 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
         goto fail;
     }
 
+    if ((state->ar->entry_type & BE_REQ_TYPE_MASK) == BE_REQ_GROUP
+            && state->ipa_ctx->view_name != NULL
+            && strcmp(state->ipa_ctx->view_name,
+                      SYSDB_DEFAULT_VIEW_NAME) != 0) {
+        /* check for ghost members because ghost members are not allowed if a
+         * view other than the default view is applied.*/
+
+        state->ghosts = ldb_msg_find_element(state->obj_msg, SYSDB_GHOST);
+    }
+
     if (state->override_attrs == NULL) {
         uuid = ldb_msg_find_attr_as_string(state->obj_msg, SYSDB_UUID, NULL);
         if (uuid == NULL) {
@@ -457,6 +613,21 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
         }
     }
 
+    if (state->ghosts != NULL) {
+        /* Resolve ghost members */
+        subreq = ipa_resolve_user_list_send(state, state->ev, state->be_req,
+                                            state->ipa_ctx->sdap_id_ctx,
+                                            state->domain->name,
+                                            state->ghosts);
+        if (subreq == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
+            ret = ENOMEM;
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, ipa_id_get_user_list_done, req);
+        return;
+    }
+
     state->dp_error = DP_ERR_OK;
     tevent_req_done(req);
     return;
@@ -508,6 +679,47 @@ static void ipa_id_get_account_info_done(struct tevent_req *subreq)
         goto fail;
     }
 
+    if (state->ghosts != NULL) {
+        /* Resolve ghost members */
+        subreq = ipa_resolve_user_list_send(state, state->ev, state->be_req,
+                                            state->ipa_ctx->sdap_id_ctx,
+                                            state->domain->name,
+                                            state->ghosts);
+        if (subreq == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "ipa_resolve_user_list_send failed.\n");
+            ret = ENOMEM;
+            goto fail;
+        }
+        tevent_req_set_callback(subreq, ipa_id_get_user_list_done, req);
+        return;
+    }
+
+    state->dp_error = DP_ERR_OK;
+    tevent_req_done(req);
+    return;
+
+fail:
+    state->dp_error = dp_error;
+    tevent_req_error(req, ret);
+    return;
+}
+
+static void ipa_id_get_user_list_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                struct tevent_req);
+    struct ipa_id_get_account_info_state *state = tevent_req_data(req,
+                                          struct ipa_id_get_account_info_state);
+    int dp_error = DP_ERR_FATAL;
+    int ret;
+
+    ret = ipa_resolve_user_list_recv(subreq, &dp_error);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "IPA resolve user list %d\n", ret);
+        goto fail;
+    }
+
     state->dp_error = DP_ERR_OK;
     tevent_req_done(req);
     return;
diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 5c53876dc9a7080c3b361d9cc72f0eedecff8600..79285548d9470b34d66b366367fb69ef57710f83 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -862,6 +862,7 @@ errno_t get_object_from_cache(TALLOC_CTX *mem_ctx,
                             SYSDB_SID_STR,
                             SYSDB_OBJECTCLASS,
                             SYSDB_UUID,
+                            SYSDB_GHOST,
                             NULL };
     char *name;
 
-- 
2.1.0

-------------- next part --------------
From f0e658bf310f0af25c9ee0498b75436cba726744 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 12 Jan 2015 18:36:42 +0100
Subject: [PATCH 3/4] nss: fix group members with overridden names

---
 src/db/sysdb.h       |  1 +
 src/db/sysdb_views.c | 73 ++++++++++++++++++++++++++++++++++++++++++++--------
 2 files changed, 63 insertions(+), 11 deletions(-)

diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index b1e057107cc6e3d4ce7b7bb8e821a2414c3424a7..9e33fee37a352498ed0c987dc2ae0da3500d63d5 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -210,6 +210,7 @@
 
 #define SYSDB_GRSRC_ATTRS {SYSDB_NAME, SYSDB_GIDNUM, \
                            SYSDB_MEMBERUID, \
+                           SYSDB_MEMBER, \
                            SYSDB_GHOST, \
                            SYSDB_DEFAULT_ATTRS, \
                            SYSDB_SID_STR, \
diff --git a/src/db/sysdb_views.c b/src/db/sysdb_views.c
index c735a7bd8588a80743d40438d010db5912f47bb5..717edf20a447003568060cf4d32bf8d47bd93e63 100644
--- a/src/db/sysdb_views.c
+++ b/src/db/sysdb_views.c
@@ -1268,6 +1268,10 @@ errno_t sysdb_add_group_member_overrides(struct sss_domain_info *domain,
     const char *override_dn_str;
     struct ldb_dn *override_dn;
     const char *memberuid;
+    const char *orig_name;
+    char *orig_domain;
+    char *val;
+    struct sss_domain_info *orig_dom;
 
     members = ldb_msg_find_element(obj, SYSDB_MEMBER);
     if (members == NULL || members->num_values == 0) {
@@ -1306,6 +1310,12 @@ errno_t sysdb_add_group_member_overrides(struct sss_domain_info *domain,
             goto done;
         }
 
+        if (ldb_msg_find_attr_as_uint64(member_obj->msgs[0],
+                                        SYSDB_UIDNUM, 0) == 0) {
+            /* Skip non-POSIX-user members i.e. groups and non-POSIX users */
+            continue;
+        }
+
         override_dn_str = ldb_msg_find_attr_as_string(member_obj->msgs[0],
                                                       SYSDB_OVERRIDE_DN, NULL);
         if (override_dn_str == NULL) {
@@ -1324,6 +1334,16 @@ errno_t sysdb_add_group_member_overrides(struct sss_domain_info *domain,
             goto done;
         }
 
+        orig_name = ldb_msg_find_attr_as_string(member_obj->msgs[0],
+                                                SYSDB_NAME,
+                                                NULL);
+        if (orig_name == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Object [%s] has no name.\n",
+                  ldb_dn_get_linearized(member_obj->msgs[0]->dn));
+            ret = EINVAL;
+            goto done;
+        }
+
         memberuid = NULL;
         if (ldb_dn_compare(member_obj->msgs[0]->dn, override_dn) != 0) {
             DEBUG(SSSDBG_TRACE_ALL, "Checking override for object [%s].\n",
@@ -1347,29 +1367,60 @@ errno_t sysdb_add_group_member_overrides(struct sss_domain_info *domain,
             memberuid = ldb_msg_find_attr_as_string(override_obj->msgs[0],
                                                     SYSDB_NAME,
                                                     NULL);
+
+            if (memberuid != NULL) {
+                ret = sss_parse_name(tmp_ctx, domain->names, orig_name,
+                                     &orig_domain, NULL);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_OP_FAILURE,
+                         "sss_parse_name failed to split original name [%s].\n",
+                         orig_name);
+                    goto done;
+                }
+
+                if (orig_domain != NULL) {
+                    orig_dom = find_domain_by_name(get_domains_head(domain),
+                                                   orig_domain, true);
+                    if (orig_dom == NULL) {
+                        DEBUG(SSSDBG_CRIT_FAILURE,
+                              "Cannot find domain with name [%s].\n",
+                              orig_domain);
+                        ret = EINVAL;
+                        goto done;
+                    }
+                    memberuid = sss_get_domain_name(tmp_ctx, memberuid,
+                                                    orig_dom);
+                    if (memberuid == NULL) {
+                        DEBUG(SSSDBG_OP_FAILURE,
+                              "sss_get_domain_name failed.\n");
+                        ret = ENOMEM;
+                        goto done;
+                    }
+                }
+            }
         }
 
         if (memberuid == NULL) {
             DEBUG(SSSDBG_TRACE_ALL, "No override name available.\n");
 
-            memberuid = ldb_msg_find_attr_as_string(member_obj->msgs[0],
-                                                    SYSDB_NAME,
-                                                    NULL);
-            if (memberuid == NULL) {
-                DEBUG(SSSDBG_CRIT_FAILURE, "Object [%s] has no name.\n",
-                      ldb_dn_get_linearized(member_obj->msgs[0]->dn));
-                ret = EINVAL;
-                goto done;
-            }
+            memberuid = orig_name;
         }
 
-        ret = ldb_msg_add_string(obj, OVERRIDE_PREFIX SYSDB_MEMBERUID,
-                                 memberuid);
+        val = talloc_strdup(obj, memberuid);
+        if (val == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
+            ret = ENOMEM;
+            goto done;
+        }
+
+        ret = ldb_msg_add_string(obj, OVERRIDE_PREFIX SYSDB_MEMBERUID, val);
         if (ret != LDB_SUCCESS) {
             DEBUG(SSSDBG_OP_FAILURE, "ldb_msg_add_string failed.\n");
             ret = sysdb_error_to_errno(ret);
             goto done;
         }
+        DEBUG(SSSDBG_TRACE_ALL, "Added [%s] to [%s].\n", memberuid,
+                                OVERRIDE_PREFIX SYSDB_MEMBERUID);
 
         /* Free all temporary data of the current member to avoid memory usage
          * spikes. All temporary data should be allocated below member_dn. */
-- 
2.1.0

-------------- next part --------------
From 1c240e4991050028ccc31c63178de2cd5bdd5637 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 13 Jan 2015 11:03:37 +0100
Subject: [PATCH 4/4] IPA: ipa_resolve_user_list_send() take care of overrides

Currently ipa_resolve_user_list_send() only looks up the related user
objects but do not check for overrides. This patch tries to fix this.
---
 src/providers/ipa/ipa_id.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c
index 4df6ed0e8ee1e9886151703f424b4580db8799a4..3d6861eeb562683518d425616b0e5c413cddba0b 100644
--- a/src/providers/ipa/ipa_id.c
+++ b/src/providers/ipa/ipa_id.c
@@ -146,7 +146,7 @@ static void ipa_account_info_done(struct tevent_req *req)
 
 struct ipa_resolve_user_list_state {
     struct tevent_context *ev;
-    struct sdap_id_ctx *sdap_id_ctx;
+    struct ipa_id_ctx *ipa_ctx;
     struct be_req *be_req;
     struct ldb_message_element *users;
     const char *domain_name;
@@ -161,7 +161,7 @@ static void ipa_resolve_user_list_get_user_done(struct tevent_req *subreq);
 static struct tevent_req *
 ipa_resolve_user_list_send(TALLOC_CTX *memctx, struct tevent_context *ev,
                            struct be_req *be_req,
-                           struct sdap_id_ctx *sdap_id_ctx,
+                           struct ipa_id_ctx *ipa_ctx,
                            const char *domain_name,
                            struct ldb_message_element *users)
 {
@@ -177,7 +177,7 @@ ipa_resolve_user_list_send(TALLOC_CTX *memctx, struct tevent_context *ev,
     }
 
     state->ev = ev;
-    state->sdap_id_ctx = sdap_id_ctx;
+    state->ipa_ctx = ipa_ctx;
     state->be_req = be_req;
     state->domain_name = domain_name;
     state->users = users;
@@ -221,10 +221,8 @@ static errno_t ipa_resolve_user_list_get_user_step(struct tevent_req *req)
 
     DEBUG(SSSDBG_TRACE_ALL, "Trying to resolve user [%s].\n", ar->filter_value);
 
-    subreq = sdap_handle_acct_req_send(state, state->be_req, ar,
-                                       state->sdap_id_ctx,
-                                       state->sdap_id_ctx->opts->sdom,
-                                       state->sdap_id_ctx->conn, true);
+    subreq = ipa_id_get_account_info_send(state, state->ev, state->ipa_ctx,
+                                          state->be_req, ar);
     if (subreq == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct_req_send failed.\n");
         return ENOMEM;
@@ -243,7 +241,7 @@ static void ipa_resolve_user_list_get_user_done(struct tevent_req *subreq)
                                             struct ipa_resolve_user_list_state);
     int ret;
 
-    ret = sdap_handle_acct_req_recv(subreq, &state->dp_error, NULL, NULL);
+    ret = ipa_id_get_account_info_recv(subreq, &state->dp_error);
     talloc_zfree(subreq);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "sdap_handle_acct request failed: %d\n", ret);
@@ -616,7 +614,7 @@ static void ipa_id_get_account_info_orig_done(struct tevent_req *subreq)
     if (state->ghosts != NULL) {
         /* Resolve ghost members */
         subreq = ipa_resolve_user_list_send(state, state->ev, state->be_req,
-                                            state->ipa_ctx->sdap_id_ctx,
+                                            state->ipa_ctx,
                                             state->domain->name,
                                             state->ghosts);
         if (subreq == NULL) {
@@ -682,7 +680,7 @@ static void ipa_id_get_account_info_done(struct tevent_req *subreq)
     if (state->ghosts != NULL) {
         /* Resolve ghost members */
         subreq = ipa_resolve_user_list_send(state, state->ev, state->be_req,
-                                            state->ipa_ctx->sdap_id_ctx,
+                                            state->ipa_ctx,
                                             state->domain->name,
                                             state->ghosts);
         if (subreq == NULL) {
-- 
2.1.0



More information about the sssd-devel mailing list