[SSSD] [PATCH] IPA: Use attr's dom for users, too

Jakub Hrozek jhrozek at redhat.com
Mon Jan 26 19:36:16 UTC 2015


Hi,

I found one bug while testing Sumit's patches. To reproduce, request a
universal group on an IPA client. The group must have members from two
different trusted AD domains.
-------------- next part --------------
>From 607c5a5453c6f4aff9f67d2f7be158fc15921602 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 26 Jan 2015 20:29:37 +0100
Subject: [PATCH] IPA: Use attr's dom for users, too

The 'dom' pointer points to domain of the main object being saved. In
case of group, dom points to the domain where the group resides. But
when saving users, each user might be from a different domain, so we
need to find every member's domain based on the attributes.

Also don't use Yoda style in conditions.
---
 src/providers/ipa/ipa_s2n_exop.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 6f8d5687d66717ba62e83da27dd6b23bc12151fb..35bd303d4aa3651e80c70297507bdc85d05bfbde 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -1819,6 +1819,17 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
         }
     }
 
+    if (strcmp(dom->name, attrs->domain_name) != 0) {
+        dom = find_domain_by_name(get_domains_head(dom),
+                                  attrs->domain_name, true);
+        if (dom == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                    "Cannot find domain: [%s]\n", attrs->domain_name);
+            ret = EINVAL;
+            goto done;
+        }
+    }
+
     switch (attrs->response_type) {
         case RESP_USER:
         case RESP_USER_GROUPLIST:
@@ -2057,17 +2068,6 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
         case RESP_GROUP_MEMBERS:
             type = SYSDB_MEMBER_GROUP;
 
-            if (0 != strcmp(dom->name, attrs->domain_name)) {
-                dom = find_domain_by_name(get_domains_head(dom),
-                                          attrs->domain_name, true);
-                if (dom == NULL) {
-                    DEBUG(SSSDBG_OP_FAILURE,
-                          "Cannot find domain: [%s]\n", attrs->domain_name);
-                    ret = EINVAL;
-                    goto done;
-                }
-            }
-
             if (name == NULL) {
                 name = attrs->a.group.gr_name;
             }
-- 
2.1.0



More information about the sssd-devel mailing list