[SSSD] [PATCHES] [sssd-1.11] Fixes suitable for latest release

Lukas Slebodnik lslebodn at redhat.com
Tue Jun 16 21:49:10 UTC 2015


ehlo,

We have 19 patches in 1.11 branch on top of latest release (1.11.7)
I went through bugs filed against 1.11 branch and filter
crashes and the most important bugs.
Attached are cherrry-picked patches from 1.12/master
So we can release the latest 1.11 version. It will be just a bug-fix release.
So some conservative distribution can use it or in another words.
we don't want have 1.11 branch neither in unreleased not in unclosed state :-)

BTW I test packages with LDAP KRB5 and AD test. Of course there are any
regressions because it is a bug fix only release.

LS
-------------- next part --------------
>From 739e565264fd7090a74d463325174484eba740fa Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Sat, 17 May 2014 16:18:32 +0200
Subject: [PATCH 01/24] TEST: Test empty results from functions sysdb_search_*

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
(cherry picked from commit 4b0c83e022c396e984d862ced5b6219e4ef04429)
---
 src/tests/sysdb-tests.c | 148 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 148 insertions(+)

diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
index 34ed4696b60c5abff947d5d21c0e023a2637347c..7dd695dbf3a8720a3c1f3028eecf93a4562f1a66 100644
--- a/src/tests/sysdb-tests.c
+++ b/src/tests/sysdb-tests.c
@@ -4501,6 +4501,151 @@ START_TEST(test_sysdb_attrs_get_string_array)
 }
 END_TEST
 
+START_TEST (test_sysdb_search_return_ENOENT)
+{
+    struct sysdb_test_ctx *test_ctx;
+    int ret;
+    struct ldb_dn *user_dn = NULL;
+    struct ldb_message *msg = NULL;
+    struct ldb_message **msgs = NULL;
+    struct ldb_result *res = NULL;
+    size_t count;
+
+    /* Setup */
+    ret = setup_sysdb_tests(&test_ctx);
+    fail_if(ret != EOK, "Could not set up the test");
+
+    /* Search user */
+    ret = sysdb_search_user_by_name(test_ctx, test_ctx->domain->sysdb,
+                                    test_ctx->domain, "nonexisting_user", NULL,
+                                    &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_user_by_name error [%d][%s].",
+                               ret, strerror(ret));
+    talloc_zfree(msg);
+
+    ret = sysdb_search_user_by_uid(test_ctx, test_ctx->domain->sysdb,
+                                   test_ctx->domain, 1234, NULL, &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_user_by_uid error [%d][%s].",
+                               ret, strerror(ret));
+    talloc_zfree(msg);
+
+    ret = sysdb_search_user_by_sid_str(test_ctx, test_ctx->domain->sysdb,
+                                       test_ctx->domain, "S-5-4-3-2-1", NULL,
+                                       &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_user_by_sid_str failed with "
+                               "[%d][%s].", ret, strerror(ret));
+
+    /* Search group */
+    ret = sysdb_search_group_by_name(test_ctx, test_ctx->domain->sysdb,
+                                     test_ctx->domain, "nonexisting_group",
+                                     NULL, &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_group_by_name error [%d][%s].",
+                               ret, strerror(ret));
+    talloc_zfree(msg);
+
+    ret = sysdb_search_group_by_gid(test_ctx, test_ctx->domain->sysdb,
+                                    test_ctx->domain, 1234, NULL, &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_group_by_gid error [%d][%s].",
+                               ret, strerror(ret));
+    talloc_zfree(msg);
+
+    ret = sysdb_search_group_by_sid_str(test_ctx, test_ctx->domain->sysdb,
+                                        test_ctx->domain, "S-5-4-3-2-1", NULL,
+                                        &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_group_by_sid_str failed with "
+                               "[%d][%s].", ret, strerror(ret));
+    talloc_zfree(msg);
+
+    /* Search netgroup */
+    ret = sysdb_search_netgroup_by_name(test_ctx, test_ctx->domain->sysdb,
+                                        test_ctx->domain,
+                                        "nonexisting_netgroup", NULL, &msg);
+    fail_unless(ret == ENOENT, "sysdb_search_netgroup_by_name error [%d][%s].",
+                               ret, strerror(ret));
+    talloc_zfree(msg);
+
+    /* Search object */
+    /* TODO: Should return ENOENT */
+    ret = sysdb_search_object_by_sid(test_ctx, test_ctx->domain->sysdb,
+                                     test_ctx->domain, "S-5-4-3-2-1", NULL,
+                                     &res);
+    fail_unless(ret == EOK, "sysdb_search_object_by_sid_str failed with "
+                             "[%d][%s].", ret, strerror(ret));
+    fail_unless(res->count == 0, "sysdb_search_object_by_sid_str should not "
+                                 "return anything.");
+    talloc_zfree(res);
+
+    /* Search can return more results */
+    ret = sysdb_search_users(test_ctx, test_ctx->domain->sysdb,
+                             test_ctx->domain,
+                             "("SYSDB_SHELL"=/bin/nologin)", NULL,
+                             &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_users failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    ret = sysdb_search_groups(test_ctx, test_ctx->domain->sysdb,
+                              test_ctx->domain,
+                              "("SYSDB_GIDNUM"=1234)", NULL,
+                              &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_groups failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    ret = sysdb_search_netgroups(test_ctx, test_ctx->domain->sysdb,
+                                 test_ctx->domain,
+                                 "("SYSDB_NAME"=nonexisting)", NULL,
+                                 &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_netgroups failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    /* Search custom */
+    ret = sysdb_search_custom(test_ctx, test_ctx->domain->sysdb,
+                              test_ctx->domain,
+                              "(distinguishedName=nonexisting)",
+                              CUSTOM_TEST_CONTAINER, NULL,
+                              &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_custom failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    ret = sysdb_search_custom_by_name(test_ctx, test_ctx->domain->sysdb,
+                                      test_ctx->domain,
+                                      "nonexisting",
+                                      CUSTOM_TEST_CONTAINER, NULL,
+                                      &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_custom_by_name failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    /* General search */
+    user_dn = sysdb_user_dn(test_ctx->domain->sysdb, test_ctx,
+                            test_ctx->domain, "nonexisting_user");
+    fail_if(user_dn == NULL, "sysdb_user_dn failed");
+
+    ret = sysdb_asq_search(test_ctx, test_ctx->domain->sysdb,
+                           user_dn, NULL, "memberof", NULL,
+                           &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_asq_search failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+
+    ret = sysdb_search_entry(test_ctx, test_ctx->sysdb,
+                             user_dn, LDB_SCOPE_SUBTREE,
+                             "objectClass=user", NULL,
+                             &count, &msgs);
+    fail_unless(ret == ENOENT, "sysdb_search_entry failed: %d, %s",
+                               ret, strerror(ret));
+    talloc_zfree(msgs);
+    talloc_zfree(user_dn);
+
+    /* TODO: test sysdb_search_selinux_config */
+
+    talloc_free(test_ctx);
+}
+END_TEST
+
 START_TEST(test_sysdb_has_enumerated)
 {
     errno_t ret;
@@ -5272,6 +5417,9 @@ Suite *create_sysdb_suite(void)
 /* ===== UTIL TESTS ===== */
     tcase_add_test(tc_sysdb, test_sysdb_attrs_get_string_array);
 
+/* ===== Test search return empty result ===== */
+    tcase_add_test(tc_sysdb, test_sysdb_search_return_ENOENT);
+
 /* Add all test cases to the test suite */
     suite_add_tcase(s, tc_sysdb);
 
-- 
2.4.3

-------------- next part --------------
>From 6d557a4493fda53197396d52a072cffa13a00123 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl at redhat.com>
Date: Thu, 19 Jun 2014 12:09:06 +0100
Subject: [PATCH 02/24] SYSDB: sysdb_search_entry fix memory leak

Allocate res on tmp_ctx instead of on mem_ctx.
Also use '_' prefix convention for output parameters.

Reviewed-by: Stephen Gallagher <sgallagh at redhat.com>
(cherry picked from commit 09579ae252c181c7884defc0612c36108f6cf509)
---
 src/db/sysdb.h     |  4 ++--
 src/db/sysdb_ops.c | 29 ++++++++++++++++++++---------
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index 510687495c26d8b560c1616dee231ec9e5c99785..1bb5fb86115be00577a4c5d07a9b28a518f1974e 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -516,8 +516,8 @@ int sysdb_search_entry(TALLOC_CTX *mem_ctx,
                        int scope,
                        const char *filter,
                        const char **attrs,
-                       size_t *msgs_count,
-                       struct ldb_message ***msgs);
+                       size_t *_msgs_count,
+                       struct ldb_message ***_msgs);
 
 /* Search User (by uid, sid or name) */
 int sysdb_search_user_by_name(TALLOC_CTX *mem_ctx,
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index 355967311c7a54e9f86bd3cae0b34a9e42b8023f..3a41f514aef1f1cd5612180963df397127b85188 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -211,27 +211,38 @@ int sysdb_search_entry(TALLOC_CTX *mem_ctx,
                        int scope,
                        const char *filter,
                        const char **attrs,
-                       size_t *msgs_count,
-                       struct ldb_message ***msgs)
+                       size_t *_msgs_count,
+                       struct ldb_message ***_msgs)
 {
+    TALLOC_CTX *tmp_ctx;
     struct ldb_result *res;
     int ret;
 
-    ret = ldb_search(sysdb->ldb, mem_ctx, &res,
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = ldb_search(sysdb->ldb, tmp_ctx, &res,
                      base_dn, scope, attrs,
                      filter?"%s":NULL, filter);
-    if (ret) {
-        return sysdb_error_to_errno(ret);
+    if (ret != EOK) {
+        ret = sysdb_error_to_errno(ret);
+        goto done;
     }
 
-    *msgs_count = res->count;
-    *msgs = talloc_steal(mem_ctx, res->msgs);
+    *_msgs_count = res->count;
+    *_msgs = talloc_steal(mem_ctx, res->msgs);
 
     if (res->count == 0) {
-        return ENOENT;
+        ret = ENOENT;
+        goto done;
     }
 
-    return EOK;
+done:
+    talloc_zfree(tmp_ctx);
+    return ret;
 }
 
 /* =Search-Entry-by-SID-string============================================ */
-- 
2.4.3

-------------- next part --------------
>From 6160d9efbac4fb166400d790360795039f470ebb Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl at redhat.com>
Date: Thu, 19 Jun 2014 12:23:26 +0100
Subject: [PATCH 03/24] SYSDB: sysdb_search_custom fix memory leak

Add temporally talloc context to allocate basedn on.

Reviewed-by: Stephen Gallagher <sgallagh at redhat.com>
(cherry picked from commit a4caef931a245fb3c44b70ea65a58bd0c1ff8dc4)
---
 src/db/sysdb_ops.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index 3a41f514aef1f1cd5612180963df397127b85188..379d0f8eb91a1fe0199e1128d553cd67562daf00 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -2235,26 +2235,38 @@ int sysdb_search_custom(TALLOC_CTX *mem_ctx,
                         size_t *msgs_count,
                         struct ldb_message ***msgs)
 {
-    struct ldb_dn *basedn;
+    TALLOC_CTX *tmp_ctx;
+    struct ldb_dn *basedn = NULL;
     int ret;
 
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
     if (filter == NULL || subtree_name == NULL) {
-        return EINVAL;
+        ret = EINVAL;
+        goto done;
     }
 
-    basedn = sysdb_custom_subtree_dn(sysdb, mem_ctx, domain, subtree_name);
+    basedn = sysdb_custom_subtree_dn(sysdb, tmp_ctx, domain, subtree_name);
     if (basedn == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_custom_subtree_dn failed.\n");
-        return ENOMEM;
+        ret = ENOMEM;
+        goto done;
     }
     if (!ldb_dn_validate(basedn)) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create DN.\n");
-        return EINVAL;
+        ret = EINVAL;
+        goto done;
     }
 
     ret = sysdb_search_entry(mem_ctx, sysdb, basedn,
                              LDB_SCOPE_SUBTREE, filter, attrs,
                              msgs_count, msgs);
+done:
+    talloc_free(tmp_ctx);
     return ret;
 }
 
-- 
2.4.3

-------------- next part --------------
>From 126ce0bac425e8ec9b776565be9dd7546bdb31ce Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl at redhat.com>
Date: Thu, 19 Jun 2014 12:27:41 +0100
Subject: [PATCH 04/24] TESTS: sysdb_search_return_ENOENT - check mem leaks

Reviewed-by: Stephen Gallagher <sgallagh at redhat.com>
(cherry picked from commit af63cdbfe0c917e0dc921232f67295fdc48d1e32)
---
 src/tests/sysdb-tests.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
index 7dd695dbf3a8720a3c1f3028eecf93a4562f1a66..4e3eef5c8837391f1587e2a643b7c5cfdf8fad62 100644
--- a/src/tests/sysdb-tests.c
+++ b/src/tests/sysdb-tests.c
@@ -4514,6 +4514,7 @@ START_TEST (test_sysdb_search_return_ENOENT)
     /* Setup */
     ret = setup_sysdb_tests(&test_ctx);
     fail_if(ret != EOK, "Could not set up the test");
+    check_leaks_push(test_ctx);
 
     /* Search user */
     ret = sysdb_search_user_by_name(test_ctx, test_ctx->domain->sysdb,
@@ -4642,6 +4643,7 @@ START_TEST (test_sysdb_search_return_ENOENT)
 
     /* TODO: test sysdb_search_selinux_config */
 
+    fail_unless(check_leaks_pop(test_ctx) == true, "Memory leak");
     talloc_free(test_ctx);
 }
 END_TEST
-- 
2.4.3

-------------- next part --------------
>From cd3b359fef97ef9988712bc60b6e46937a28284a Mon Sep 17 00:00:00 2001
From: Nikolai Kondrashov <Nikolai.Kondrashov at redhat.com>
Date: Wed, 30 Jul 2014 21:18:35 +0300
Subject: [PATCH 05/24] build: Don't install ad and ipa man pages unnecessarily
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don't install sssd-ipa and sssd-ad man pages if corresponding providers
weren't built (i.e. --without-samba was specified to configure).

Reviewed-by: Lukáš Slebodník <lslebodn at redhat.com>
(cherry picked from commit 4b9c236008b35d2155b94635a236ce7770db4728)
---
 src/man/Makefile.am | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/man/Makefile.am b/src/man/Makefile.am
index 03caef2ee55689b82769e6b624e3dda619c50a93..546e0ade2b706f82458d778a3609dcc9fe59d58c 100644
--- a/src/man/Makefile.am
+++ b/src/man/Makefile.am
@@ -43,10 +43,14 @@ man_MANS = \
     sss_useradd.8 sss_userdel.8 sss_usermod.8 \
     sss_groupadd.8 sss_groupdel.8 sss_groupmod.8 \
     sssd.8 sssd.conf.5 sssd-ldap.5 \
-    sssd-krb5.5 sssd-ipa.5 sssd-simple.5 sssd-ad.5 \
+    sssd-krb5.5 sssd-simple.5 \
     sssd_krb5_locator_plugin.8 sss_groupshow.8 \
     pam_sss.8 sss_obfuscate.8 sss_cache.8 sss_debuglevel.8 sss_seed.8
 
+if BUILD_SAMBA
+man_MANS += sssd-ipa.5 sssd-ad.5
+endif
+
 if BUILD_SSH
 man_MANS += sss_ssh_authorizedkeys.1 sss_ssh_knownhostsproxy.1
 endif
-- 
2.4.3

-------------- next part --------------
>From 56d571b2d7794d76c6c921ff8d41fa279043308a Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin at redhat.com>
Date: Thu, 28 Aug 2014 09:27:01 -0400
Subject: [PATCH 06/24] Accept krb5 1.13 for building the PAC plugin

Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit 9e1f638683cc5c229e8c0ea040c46d2cec58bd7c)
---
 src/external/pac_responder.m4 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/external/pac_responder.m4 b/src/external/pac_responder.m4
index 6e294527da5f8ac945958bd326bbb2daade178e3..b57305c1d7b90b59e023b1645188f20b9be88677 100644
--- a/src/external/pac_responder.m4
+++ b/src/external/pac_responder.m4
@@ -21,7 +21,8 @@ then
         Kerberos\ 5\ release\ 1.9* | \
         Kerberos\ 5\ release\ 1.10* | \
         Kerberos\ 5\ release\ 1.11* | \
-        Kerberos\ 5\ release\ 1.12*)
+        Kerberos\ 5\ release\ 1.12* | \
+        Kerberos\ 5\ release\ 1.13*)
             krb5_version_ok=yes
             AC_MSG_RESULT([yes])
             ;;
-- 
2.4.3

-------------- next part --------------
>From c9cdc0a300b7f64e62e70e3e282bbf4e7f59fa72 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh at redhat.com>
Date: Wed, 24 Sep 2014 11:00:44 -0400
Subject: [PATCH 07/24] UTIL: Do not change SSSD domains in get_domains_head

When there was more than one SSSD domain configured, actions performed
against domains later in the list would be incorrectly told to use the
first domain as the base for locating subdomains. This was because we
were rewinding the ->prev list on the sss_domain_info object, which is
only intended to be used by confdb code. The correct approach was to
use only the parent linkage, which would take us up to the top-level
domain in this SSSD domain.

(cherry picked from commit a2147c6c13c36c0ec056581b08a7ed7352ff9861)
---
 src/util/domain_info_utils.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index ff36d2e17fc66f5af3fdf2ce0ddbd8edad24ec6f..9ab6e4503a3ee0f8712c929e6cbfccdc6e46e6fb 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -34,9 +34,6 @@ struct sss_domain_info *get_domains_head(struct sss_domain_info *domain)
     /* get to the top level domain */
     for (dom = domain; dom->parent != NULL; dom = dom->parent);
 
-    /* proceed to the list head */
-    for (; dom->prev != NULL; dom = dom->prev);
-
     return dom;
 }
 
-- 
2.4.3

-------------- next part --------------
>From c0d57f83ff631e426c9ae15075d7b25a1c339750 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 29 Oct 2014 15:20:12 +0100
Subject: [PATCH 08/24] memberof: check for empty arrays to avoid segfaults

The arrays with members to add or delete may be empty, i.e. have 0
entries. In this case further processing should be skipped to avoid
segfaults later on.

Fixes (hopefully) https://fedorahosted.org/sssd/ticket/2430

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
(cherry picked from commit a1bd8bc666df7fa696523ec8ec1dfe3d79780588)
---
 src/ldb_modules/memberof.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
index c26a13bb94bafe62299572565cab4b53c77f3d94..c49be5d5fca593d69ba6dacc3460454080058100 100644
--- a/src/ldb_modules/memberof.c
+++ b/src/ldb_modules/memberof.c
@@ -3655,7 +3655,7 @@ static int mbof_mod_add(struct mbof_mod_ctx *mod_ctx,
         }
     }
 
-    if (ael != NULL) {
+    if (ael != NULL && ael->num > 0) {
         /* Add itself to the list of the parents to also get the memberuid */
         parents->dns = talloc_realloc(parents, parents->dns,
                                     struct ldb_dn *, parents->num + 1);
@@ -3725,7 +3725,7 @@ static int mbof_mod_delete(struct mbof_mod_ctx *mod_ctx,
     }
 
     /* prepare del sets */
-    if (del != NULL) {
+    if (del != NULL && del->num > 0) {
         for (i = 0; i < del->num; i++) {
             ret = mbof_append_delop(first, del->dns[i]);
             if (ret != LDB_SUCCESS) {
-- 
2.4.3

-------------- next part --------------
>From ce1bea2be82c1f71fe910de0448ff007d1641ca9 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Thu, 28 Nov 2013 16:00:59 +0100
Subject: [PATCH 09/24] KRB5: Go offline in case of clock skew

https://fedorahosted.org/sssd/ticket/1096

In case the KDC has skewed time, we can retry with the next one and
eventually go offline if no KDC has time in sync with the client.
Previously, authentication with wrong time resulted in System Error.

(cherry picked from commit 83011d97d17bd00e99ccf1e0302167a6bc0db84e)
---
 src/providers/krb5/krb5_child.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 34652014e6a99632aa01114c003bf878c73740be..b9cc94f7913f3ea9c04034b98808738b554ab260 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1050,6 +1050,7 @@ static errno_t map_krb5_error(krb5_error_code kerr)
     case KRB5_LIBOS_CANTREADPWD:
         return ERR_NO_CREDS;
 
+    case KRB5KRB_AP_ERR_SKEW:
     case KRB5_KDC_UNREACH:
     case KRB5_REALM_CANT_RESOLVE:
         return ERR_NETWORK_IO;
-- 
2.4.3

-------------- next part --------------
>From 4d9988b2ffd3caafc056f3b590a0514ea84d142a Mon Sep 17 00:00:00 2001
From: Daniel Hjorth <dh at dhjorth.com>
Date: Wed, 25 Feb 2015 13:07:35 -0700
Subject: [PATCH 10/24] LDAP: unlink ccname_file_dummy if there is an error

https://fedorahosted.org/sssd/ticket/2592

If there is an error after ccname_file_dummy is created but before it is
renamed then the file isn't removed.  This can cause a lot of files to be
created and take up inodes in a filesystem.

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit 2b20ff2e33ad3993a9cad910c4b4b828513613df)
(cherry picked from commit 0b5036e4c652e6983a3352c045c8701d6573587b)
---
 src/providers/ldap/ldap_child.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c
index fbdf89a26030944967dad595dd5ae7f50fcac319..8fd9b20f8277459a8736a9e9fbf9036290dbd50e 100644
--- a/src/providers/ldap/ldap_child.c
+++ b/src/providers/ldap/ldap_child.c
@@ -187,7 +187,7 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
     int kdc_time_offset_usec;
     int ret;
     TALLOC_CTX *tmp_ctx;
-    char *ccname_file_dummy;
+    char *ccname_file_dummy = NULL;
     char *ccname_file;
 
     krberr = krb5_init_context(&context);
@@ -401,16 +401,26 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx,
               "rename failed [%d][%s].\n", ret, strerror(ret));
         goto done;
     }
+    ccname_file_dummy = NULL;
 
     krberr = 0;
     *ccname_out = talloc_steal(memctx, ccname);
     *expire_time_out = my_creds.times.endtime - kdc_time_offset;
 
 done:
-    talloc_free(tmp_ctx);
     if (krberr != 0) KRB5_SYSLOG(krberr);
     if (keytab) krb5_kt_close(context, keytab);
     if (context) krb5_free_context(context);
+    if (ccname_file_dummy) {
+        DEBUG(SSSDBG_TRACE_INTERNAL, "Unlinking [%s]\n", ccname_file_dummy);
+        ret = unlink(ccname_file_dummy);
+        if (ret == -1) {
+            ret = errno;
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  "Unlink failed [%d][%s].\n", ret, strerror(ret));
+        }
+    }
+    talloc_free(tmp_ctx);
     return krberr;
 }
 
-- 
2.4.3

-------------- next part --------------
>From 60f7207d75d6314e75c8d5ef5d615ffe1bd83fbf Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 10 Apr 2015 14:33:35 +0200
Subject: [PATCH 11/24] SDAP: Do not set gid 0 twice

The gid o was added to sysdb attrs directly in sdap_save_group for 1st time
and for second time in the function sdap_store_group_with_gid,
which was called every time from function sdap_save_group

[sysdb_set_entry_attr] (0x0080): ldb_modify failed:
    [Attribute or value exists](20)[attribute 'gidNumber': value #1
    on 'name=domainlocalgroup1_dom2-493341 at sssdad_tree.com,cn=groups,cn=sssdad_tree.com,cn=sysdb' provided more than once]
[sysdb_set_entry_attr] (0x0040): Error: 17 (File exists)
[sysdb_store_group] (0x1000): sysdb_set_group_attr failed.
[sysdb_store_group] (0x0400): Error: 17 (File exists)
[sdap_store_group_with_gid] (0x0040):
    Could not store group domainlocalgroup1_dom2-493341 at sssdad_tree.com
[sdap_save_group] (0x0080): Could not store group with GID: [File exists]
[sdap_save_group] (0x0080):
    Failed to save group [domainlocalgroup1_dom2-493341 at sssdad_tree.com]: [File exists]
[sdap_save_groups] (0x0040): Failed to store group 0. Ignoring.

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
(cherry picked from commit 5d864e7a9d0e1e6fb7dd8158c5b8bfb71040b908)
(cherry picked from commit cf7047634308c431f4cfbff1d88564668d2a33c7)
---
 src/providers/ldap/sdap_async_groups.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index 91124bc82103c044258a76170a71657409b39d66..440c26d1dd335c550195b230b728feab477b2b9b 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -590,13 +590,6 @@ static int sdap_save_group(TALLOC_CTX *memctx,
             gid = 0;
             DEBUG(SSSDBG_TRACE_FUNC, "Filtering AD group [%s].\n",
                                       group_name);
-            ret = sysdb_attrs_add_uint32(group_attrs,
-                                         opts->group_map[SDAP_AT_GROUP_GID].sys_name, 0);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE,
-                      "Failed to add a GID to non-posix group!\n");
-                return ret;
-            }
             ret = sysdb_attrs_add_bool(group_attrs, SYSDB_POSIX, false);
             if (ret != EOK) {
                 DEBUG(SSSDBG_OP_FAILURE,
-- 
2.4.3

-------------- next part --------------
>From 74a914ede65f7dcc0921ebcea0dbe3156a9c4189 Mon Sep 17 00:00:00 2001
From: Adam Tkac <vonsch at gmail.com>
Date: Mon, 13 Apr 2015 15:00:18 +0200
Subject: [PATCH 12/24] Option filter_users had no effect for retrieving sudo
 rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously sssd_sudo always obtained sudo rules for user from LDAP even
when user was enlisted in filter_users.

Resolves https://fedorahosted.org/sssd/ticket/2625

Reviewed-by: Pavel Březina <pbrezina at redhat.com>
---
 src/responder/sudo/sudosrv.c         | 24 ++++++++++++++++++++++++
 src/responder/sudo/sudosrv_cmd.c     | 12 ++++++++++++
 src/responder/sudo/sudosrv_private.h |  3 +++
 3 files changed, 39 insertions(+)

diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c
index 8a197159b23abde45953b65121ff2e3fc3f2f67a..25c9d585b8780f3a1d0dd7d246481a9d2455f8f0 100644
--- a/src/responder/sudo/sudosrv.c
+++ b/src/responder/sudo/sudosrv.c
@@ -27,6 +27,7 @@
 #include "responder/common/responder_sbus.h"
 #include "responder/sudo/sudosrv_private.h"
 #include "providers/data_provider.h"
+#include "responder/common/negcache.h"
 
 struct mon_cli_iface monitor_sudo_methods = {
     { &mon_cli_iface_meta, 0 },
@@ -113,9 +114,32 @@ int sudo_process_init(TALLOC_CTX *mem_ctx,
         goto fail;
     }
 
+    ret = sss_ncache_init(rctx, &sudo_ctx->ncache);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "fatal error initializing ncache\n");
+        goto fail;
+    }
+
     sudo_ctx->rctx = rctx;
     sudo_ctx->rctx->pvt_ctx = sudo_ctx;
 
+    ret = confdb_get_int(cdb, CONFDB_NSS_CONF_ENTRY,
+                         CONFDB_NSS_ENTRY_NEG_TIMEOUT, 15,
+                         &sudo_ctx->neg_timeout);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "fatal error getting ncache timeout\n");
+        goto fail;
+    }
+
+    sss_ncache_prepopulate(sudo_ctx->ncache, sudo_ctx->rctx->cdb, rctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "failed to set ncache for sudo's filter_users\n");
+        goto fail;
+    }
+
     /* Enable automatic reconnection to the Data Provider */
     ret = confdb_get_int(sudo_ctx->rctx->cdb,
                          CONFDB_SUDO_CONF_ENTRY,
diff --git a/src/responder/sudo/sudosrv_cmd.c b/src/responder/sudo/sudosrv_cmd.c
index fd8c46d638ecbd0275b44511dbc6d31e0e316581..dd636e949200dd49c1422a5789e9328dc4b25fb0 100644
--- a/src/responder/sudo/sudosrv_cmd.c
+++ b/src/responder/sudo/sudosrv_cmd.c
@@ -28,6 +28,7 @@
 #include "responder/sudo/sudosrv_private.h"
 #include "db/sysdb_sudo.h"
 #include "sss_client/sss_cli.h"
+#include "responder/common/negcache.h"
 
 static errno_t sudosrv_cmd_send_reply(struct sudo_cmd_ctx *cmd_ctx,
                                       uint8_t *response_body,
@@ -239,6 +240,7 @@ static void sudosrv_cmd_parse_query_done(struct tevent_req *req)
 {
     struct sudo_cmd_ctx *cmd_ctx = NULL;
     struct sudo_dom_ctx *dom_ctx = NULL;
+    struct sudo_ctx *sudo_ctx = NULL;
     errno_t ret;
 
     cmd_ctx = tevent_req_callback_data(req, struct sudo_cmd_ctx);
@@ -278,6 +280,16 @@ static void sudosrv_cmd_parse_query_done(struct tevent_req *req)
     dom_ctx->domain = cmd_ctx->domain != NULL ? cmd_ctx->domain
                                               : cmd_ctx->cli_ctx->rctx->domains;
 
+    sudo_ctx = talloc_get_type(cmd_ctx->cli_ctx->rctx->pvt_ctx, struct sudo_ctx);
+    ret = sss_ncache_check_user(sudo_ctx->ncache, sudo_ctx->neg_timeout,
+                                dom_ctx->domain, cmd_ctx->username);
+    if (ret == EEXIST) {
+        DEBUG(SSSDBG_TRACE_FUNC, "User [%s@%s] filtered out (ncache)\n",
+              cmd_ctx->username, dom_ctx->domain->name);
+        ret = ENOENT;
+        goto done;
+    }
+
     ret = sudosrv_get_sudorules(dom_ctx);
 
 done:
diff --git a/src/responder/sudo/sudosrv_private.h b/src/responder/sudo/sudosrv_private.h
index 71a272ab4b06864738ac86b31e89a0c45658665b..3c53755f9e8ec56f3dea52021d14b50f715a54e7 100644
--- a/src/responder/sudo/sudosrv_private.h
+++ b/src/responder/sudo/sudosrv_private.h
@@ -43,6 +43,9 @@ enum sss_sudo_type {
 struct sudo_ctx {
     struct resp_ctx *rctx;
 
+    int neg_timeout;
+    struct sss_nc_ctx *ncache;
+
     /*
      * options
      */
-- 
2.4.3

-------------- next part --------------
>From 8cddc720303adc57139eee897c353d5dbf4f382e Mon Sep 17 00:00:00 2001
From: Aron Parsons <parsonsa at bit-sys.com>
Date: Wed, 29 Apr 2015 02:44:18 +0000
Subject: [PATCH 13/24] autofs: fix 'Cannot allocate memory' with FQDNs

https://fedorahosted.org/sssd/ticket/2643

Reviewed-by: Jakub Hrozek <jhrozek at redhat.com>
(cherry picked from commit 4df706219e64527209f12ad0c7814ee1be979c07)
(cherry picked from commit 8f57c6765b10de36582ef1dbee32d75452451a94)
---
 src/responder/autofs/autofssrv_cmd.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/src/responder/autofs/autofssrv_cmd.c b/src/responder/autofs/autofssrv_cmd.c
index 8cae9b48170242c833182f337bc1a929419e1626..f96a6a63ac0aa0ab5f0ba75b78a30c30aa0ce862 100644
--- a/src/responder/autofs/autofssrv_cmd.c
+++ b/src/responder/autofs/autofssrv_cmd.c
@@ -624,15 +624,6 @@ lookup_automntmap_step(struct setautomntent_lookup_ctx *lookup_ctx)
 
     /* Check each domain for this map name */
     while (dom) {
-        /* if it is a domainless search, skip domains that require fully
-         * qualified names instead */
-        while (dom && dctx->cmd_ctx->check_next && dom->fqnames) {
-            dom = get_next_domain(dom, false);
-        }
-
-        /* No domains left to search */
-        if (!dom) break;
-
         if (dom != dctx->domain) {
             /* make sure we reset the check_provider flag when we check
              * a new domain */
-- 
2.4.3

-------------- next part --------------
>From 905d628582c66c46b9a63f8bb84675b41fa80246 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 15 May 2015 14:11:56 +0200
Subject: [PATCH 14/24] nss: Do not ignore default vaue of SYSDB_INITGR_EXPIRE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When SYSDB_INITGR_EXPIRE had default value (0) then value of
SYSDB_CACHE_EXPIRE was used as initgroups expire attribute.
The right apoach is already used in responder_cache_req.c

Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit fd60528321fd52720222ec35b895ade54cccb48d)
(cherry picked from commit 521eb7ca65040c009bc4885ba8d6c8ad257bc0f1)
---
 src/responder/nss/nsssrv_cmd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 2745c27d164ee86bfd9df69397e624870d5972ac..a05dc89379f26a5d7c43c5da4b9335ac931af2b1 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -562,9 +562,8 @@ errno_t check_cache(struct nss_dom_ctx *dctx,
     if (res->count > 0) {
         if (req_type == SSS_DP_INITGROUPS) {
             cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0],
-                                                      SYSDB_INITGR_EXPIRE, 1);
-        }
-        if (cacheExpire == 0) {
+                                                      SYSDB_INITGR_EXPIRE, 0);
+        } else {
             cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0],
                                                       SYSDB_CACHE_EXPIRE, 0);
         }
-- 
2.4.3

-------------- next part --------------
>From fd76c885e9e6e7b3dc8cd9552937fae1f80dbf5d Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 15 May 2015 15:05:28 +0200
Subject: [PATCH 15/24] SDAP: Set initgroups expire attribute at the end
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initgrups consisted of two main steps:
1. store user to cache
2. store all user groups to cache.

Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step.
So in case of epmty cache and parallel initgroups request in responders
there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were
not cached. Therefore sometime responder could return zero supplementary
groups.

This patch moves the setting of initgroups expire attribute from 1st step
to the end of 2nd step.

In case of parallel initgroups requests in responder there are two
other ways how we could get correct results even thought there was a bug.
 a) Time between two request was too small. User was not stored in cache
    yet and 2nd request waited for response from DP.
 b) Time between two request was big enough. All users groups were
    successfully stored in cache and 2nd request returned correct results.

Resolves:
https://fedorahosted.org/sssd/ticket/2634

Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit d0cc678d20d8bde829450eb50bec1b7397cea3e1)
(cherry picked from commit 9ae6567a573c05ba59d1138cfda94b44732019e8)
---
 src/providers/ldap/ldap_id.c          | 43 +++++++++++++++++++++++++++++++++++
 src/providers/ldap/sdap_async_users.c |  9 --------
 2 files changed, 43 insertions(+), 9 deletions(-)

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index 8423815170c3de38e91d8bb2045c5be7adda3cd6..bf4a344be64ff6c9d5c076810f98fda27dc006dd 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -943,6 +943,41 @@ static int groups_by_user_retry(struct tevent_req *req);
 static void groups_by_user_connect_done(struct tevent_req *subreq);
 static void groups_by_user_done(struct tevent_req *subreq);
 
+static errno_t set_initgroups_expire_attribute(struct sss_domain_info *domain,
+                                               const char *name)
+{
+    errno_t ret;
+    time_t cache_timeout;
+    struct sysdb_attrs *attrs;
+
+    attrs = sysdb_new_attrs(NULL);
+    if (attrs == NULL) {
+        return ENOMEM;
+    }
+
+    cache_timeout = domain->user_timeout
+                        ? time(NULL) + domain->user_timeout
+                        : 0;
+
+    ret = sysdb_attrs_add_time_t(attrs, SYSDB_INITGR_EXPIRE, cache_timeout);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not set up attrs\n");
+        goto done;
+    }
+
+    ret = sysdb_set_user_attr(domain->sysdb, domain, name, attrs,
+                              SYSDB_MOD_REP);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Failed to set initgroups expire attribute\n");
+        goto done;
+    }
+
+done:
+    talloc_zfree(attrs);
+    return ret;
+}
+
 static struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                               struct tevent_context *ev,
                                               struct sdap_id_ctx *ctx,
@@ -1082,6 +1117,14 @@ static void groups_by_user_done(struct tevent_req *subreq)
         }
     }
 
+    ret = set_initgroups_expire_attribute(state->ctx->be->domain,
+                                          state->name);
+    if (ret != EOK) {
+        state->dp_error = DP_ERR_FATAL;
+        tevent_req_error(req, ret);
+        return;
+    }
+
     state->dp_error = DP_ERR_OK;
     tevent_req_done(req);
 }
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index 1ef082ed0873a9685c462da8757cc3622873b373..0b4414d8fd0bf98b050abfe5a37260cbb5ef8b99 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -441,15 +441,6 @@ int sdap_save_user(TALLOC_CTX *memctx,
 
     cache_timeout = dom->user_timeout;
 
-    if (is_initgr) {
-        ret = sysdb_attrs_add_time_t(user_attrs, SYSDB_INITGR_EXPIRE,
-                                     (cache_timeout ?
-                                      (time(NULL) + cache_timeout) : 0));
-        if (ret) {
-            goto done;
-        }
-    }
-
     ret = sdap_save_all_names(user_name, attrs, dom, user_attrs);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Failed to save user names\n");
-- 
2.4.3

-------------- next part --------------
>From 3b9f8f2e49878330939cd474071d6ed313efcf27 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 22 May 2015 15:19:31 +0200
Subject: [PATCH 16/24] Download complete groups if ignore_group_members is set
 with tokengroups

Resolves:
    https://fedorahosted.org/sssd/ticket/2644

When tokenGroups are enabled, we save groups using their SID as the RDN
attribute during initgroups() and later, if the groups is requested and saved
again with the full name, remove the original and save the new group entry.

Saving the new group entry would break if ignore_group_members is also
set, because the new group entry would lack the "member" attribute, so the
member/memberof links between the new group and the user entry wouldn't
be established again.

This patch changes the initgroups processing so that the full group
object is fetched when initgroups is enabled but together with
ignore_group_members. This solution imposes some performance impact,
because instead of one search for tokenGroups we also need to resolve the
groups. The more systematic solution would be to get rid of removing the
group entry as described in https://fedorahosted.org/sssd/ticket/2656

To reproduce the bug, set: ignore_group_members = True with a
backend that uses:
    id_provider = ad
Then run:
    $ id aduser at ad_domain.com
    $ id aduser at ad_domain.com

Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit ee44aac95e42c3cb634876286a2aa4960ac69a2b)
(cherry picked from commit 44f35a0f32785bf460b5d05424f5e9a15f4f4028)
---
 src/providers/ldap/sdap_async_initgroups_ad.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/providers/ldap/sdap_async_initgroups_ad.c b/src/providers/ldap/sdap_async_initgroups_ad.c
index 15855b4e32c1d71e22699bd5baf46926a8b95ea4..1de851807df3a65683b3a2e622e467855ae8c126 100644
--- a/src/providers/ldap/sdap_async_initgroups_ad.c
+++ b/src/providers/ldap/sdap_async_initgroups_ad.c
@@ -1451,7 +1451,18 @@ sdap_ad_tokengroups_initgroups_send(TALLOC_CTX *mem_ctx,
     state->use_id_mapping = use_id_mapping;
     state->domain = domain;
 
-    if (state->use_id_mapping && !IS_SUBDOMAIN(state->domain)) {
+    /* We can compute the the gidNumber attribute from SIDs obtained from
+     * the tokenGroups lookup in case ID mapping is used for a user from the
+     * parent domain. For trusted domains, we need to know the group type
+     * to be able to filter out domain-local groups. Additionally, as a
+     * temporary workaround until https://fedorahosted.org/sssd/ticket/2656
+     * is fixed, we also fetch the group object if group members are ignored
+     * to avoid having to transfer and retain members when the fake
+     * tokengroups object without name is replaced by the full group object
+     */
+    if (state->use_id_mapping
+            && !IS_SUBDOMAIN(state->domain)
+            && state->domain->ignore_group_members == false) {
         subreq = sdap_ad_tokengroups_initgr_mapping_send(state, ev, opts,
                                                          sysdb, domain, sh,
                                                          name, orig_dn,
@@ -1491,7 +1502,9 @@ static void sdap_ad_tokengroups_initgroups_done(struct tevent_req *subreq)
     req = tevent_req_callback_data(subreq, struct tevent_req);
     state = tevent_req_data(req, struct sdap_ad_tokengroups_initgroups_state);
 
-    if (state->use_id_mapping && !IS_SUBDOMAIN(state->domain)) {
+    if (state->use_id_mapping
+            && !IS_SUBDOMAIN(state->domain)
+            && state->domain->ignore_group_members == false) {
         ret = sdap_ad_tokengroups_initgr_mapping_recv(subreq);
     } else {
         ret = sdap_ad_tokengroups_initgr_posix_recv(subreq);
-- 
2.4.3

-------------- next part --------------
>From 1217739310235ad640c7e9fecfbbb50e43a5220b Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 25 May 2015 10:20:39 +0200
Subject: [PATCH 17/24] DP: Set extra_value to NULL for enum requests

Some providers, notably IPA, rely on extra_value to be either a useful
value or NULL. In enumeration, however, extra_value was random. Set
the extra_value pointer explicitly to NULL to make it clear that it's
not used for enumeration and also use talloc_zero as future-proof.

Resolves:
https://fedorahosted.org/sssd/ticket/2659

Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit d9296ba018228ac6a19f710b8bb9044c4ea9ab5b)
(cherry picked from commit 2dfb4ed5a36a7be6bcde60e042811b81e83c4850)
---
 src/providers/data_provider_be.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
index 3dd635f28ef85b3dcbc09bd51cea86963982a6c8..b9bdc0a8270af428277ed09e134d7d615f403a27 100644
--- a/src/providers/data_provider_be.c
+++ b/src/providers/data_provider_be.c
@@ -1138,7 +1138,7 @@ static int be_get_account_info(struct sbus_request *dbus_req, void *user_data)
         goto done;
     }
 
-    req = talloc(be_req, struct be_acct_req);
+    req = talloc_zero(be_req, struct be_acct_req);
     if (!req) {
         err_maj = DP_ERR_FATAL;
         err_min = ENOMEM;
@@ -1185,6 +1185,7 @@ static int be_get_account_info(struct sbus_request *dbus_req, void *user_data)
         } else if (strcmp(filter, ENUM_INDICATOR) == 0) {
             req->filter_type = BE_FILTER_ENUM;
             req->filter_value = NULL;
+            req->extra_value = NULL;
         } else {
             err_maj = DP_ERR_FATAL;
             err_min = EINVAL;
-- 
2.4.3

-------------- next part --------------
>From ec5b977b758cb562c9b0fd22d8ce9b7401a11b69 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 29 May 2015 16:37:54 +0200
Subject: [PATCH 18/24] ldap: use proper sysdb name in groups_by_user_done()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In a recent change set_initgroups_expire_attribute() was added to
groups_by_user_done() to make sure that the initgroups timeout is only
added to the user object until all groups added to the cache.

This change (and the original code in groups_by_user_done() as well)
didn't took sub-domain users into account where the name in sysdb might
different form the original request and the domain is not the configured
domain. This patch tries to ensure that the right name and domain are
used.

https://fedorahosted.org/sssd/ticket/2663

Reviewed-by: Lukáš Slebodník <lslebodn at redhat.com>
(cherry picked from commit d0b7e5fcfca7d0db9e3d19be7b51f34d03d3d720)
(cherry picked from commit edc1538566e7034eea9b8d592206fbc236233dff)
---
 src/providers/ldap/ldap_id.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index bf4a344be64ff6c9d5c076810f98fda27dc006dd..ab981faf6374bde4b0191317a33e9175951dc14c 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -1085,6 +1085,7 @@ static void groups_by_user_done(struct tevent_req *subreq)
                                                      struct groups_by_user_state);
     int dp_error = DP_ERR_FATAL;
     int ret;
+    const char *cname;
 
     ret = sdap_get_initgr_recv(subreq);
     talloc_zfree(subreq);
@@ -1108,17 +1109,25 @@ static void groups_by_user_done(struct tevent_req *subreq)
         return;
     }
 
+    /* state->name is still the name used for the original request. The cached
+     * object might have a different name, e.g. a fully-qualified name. */
+    ret = sysdb_get_real_name(state, state->domain->sysdb, state->domain,
+                              state->name, &cname);
+    if (ret != EOK) {
+        cname = state->name;
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to canonicalize name, using [%s].\n",
+                                 cname);
+    }
+
     if (ret == ENOENT && state->noexist_delete == true) {
-        ret = sysdb_delete_user(state->ctx->be->domain->sysdb,
-                                state->ctx->be->domain, state->name, 0);
+        ret = sysdb_delete_user(state->domain->sysdb, state->domain, cname, 0);
         if (ret != EOK && ret != ENOENT) {
             tevent_req_error(req, ret);
             return;
         }
     }
 
-    ret = set_initgroups_expire_attribute(state->ctx->be->domain,
-                                          state->name);
+    ret = set_initgroups_expire_attribute(state->domain, cname);
     if (ret != EOK) {
         state->dp_error = DP_ERR_FATAL;
         tevent_req_error(req, ret);
-- 
2.4.3



More information about the sssd-devel mailing list