[SSSD] [PATCH] SDAP: Remove user from cache for missing user in LDAP

Lukas Slebodnik lslebodn at redhat.com
Fri Jun 19 16:44:25 UTC 2015


On (19/06/15 18:03), Jakub Hrozek wrote:
>On Fri, Jun 19, 2015 at 05:59:04PM +0200, Michal Židek wrote:
>> On 06/18/2015 06:13 PM, Lukas Slebodnik wrote:
>> >ehlo,
>> >
>> >regression was cuased by patch d0b7e5fcfca7d0db9e3d19be7b51f34d03d3d720
>> >because function sysdb_get_real_name overrode returned code from LDAP.
>> >
>> >LS
>> >
>> >
>> 
>> ACK.
>> 
>> CI link:
>> http://sssd-ci.duckdns.org/logs/job/17/89/summary.html
>> 
>> Michal
>
>Thanks.
>
>What about adding a default: to the switch? I know we currently can't
>get any other value, but it would be better to error out in that case.
Here you are.

LS
-------------- next part --------------
>From 792398f1b6520a9c45e9129e2e4e0507a0a61abd Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 17 Jun 2015 21:35:22 +0200
Subject: [PATCH] SDAP: Remove user from cache for missing user in LDAP

Function sysdb_get_real_name overrode reurned code LDAP
and thus user was not removed from cache after removing it from LDAP.
This patch also do not try to set initgroups flag if user
does not exist. It reduce some error message.

Resolves:
https://fedorahosted.org/sssd/ticket/2681
---
 src/providers/ldap/ldap_id.c | 47 ++++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index d4f46f1dcd69898e5883d21be07f895fd198cf50..fcbd36def1872a20a87c4dce821982c29e3a335a 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -1143,32 +1143,37 @@ static void groups_by_user_done(struct tevent_req *subreq)
     }
     state->sdap_ret = ret;
 
-    if (ret && ret != ENOENT) {
-        state->dp_error = dp_error;
-        tevent_req_error(req, ret);
-        return;
+    if (ret == EOK || ret == ENOENT) {
+        /* state->name is still the name used for the original req. The cached
+         * object might have a different name, e.g. a fully-qualified name. */
+        ret = sysdb_get_real_name(state, state->domain, state->name, &cname);
+        if (ret != EOK) {
+            cname = state->name;
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Failed to canonicalize name, using [%s].\n", cname);
+        }
     }
 
-    /* state->name is still the name used for the original request. The cached
-     * object might have a different name, e.g. a fully-qualified name. */
-    ret = sysdb_get_real_name(state, state->domain, state->name, &cname);
-    if (ret != EOK) {
-        cname = state->name;
-        DEBUG(SSSDBG_OP_FAILURE, "Failed to canonicalize name, using [%s].\n",
-                                 cname);
-    }
-
-    if (ret == ENOENT && state->noexist_delete == true) {
-        ret = sysdb_delete_user(state->domain, cname, 0);
-        if (ret != EOK && ret != ENOENT) {
+    switch (state->sdap_ret) {
+    case ENOENT:
+        if (state->noexist_delete == true) {
+            ret = sysdb_delete_user(state->domain, cname, 0);
+            if (ret != EOK && ret != ENOENT) {
+                tevent_req_error(req, ret);
+                return;
+            }
+        }
+        break;
+    case EOK:
+        ret = set_initgroups_expire_attribute(state->domain, cname);
+        if (ret != EOK) {
+            state->dp_error = DP_ERR_FATAL;
             tevent_req_error(req, ret);
             return;
         }
-    }
-
-    ret = set_initgroups_expire_attribute(state->domain, cname);
-    if (ret != EOK) {
-        state->dp_error = DP_ERR_FATAL;
+        break;
+    default:
+        state->dp_error = dp_error;
         tevent_req_error(req, ret);
         return;
     }
-- 
2.4.3



More information about the sssd-devel mailing list