[SSSD] [PATCH] Make it possible to inherit ignore_group_members, ldap_purge_cache_timeout and ldap_use_tokengroups into subdomains
Jakub Hrozek
jhrozek at redhat.com
Mon May 11 08:47:25 UTC 2015
Hi,
the attached patches are a short-term fix until subdomains can be
configured separately in the config file. They add a new option
subdomain_inherit and make it possible to inherit three options we
learned our users care about for subdomains - ignore_group_members,
ldap_purge_cache_timeout and ldap_use_tokengroups.
-------------- next part --------------
>From 104defda380bb0cd33dcec3f599f129c015d6bfc Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 29 Apr 2015 19:41:14 +0200
Subject: [PATCH 1/4] confdb: Add new option subdomain_inherit
Adds a new option subdomain_inherit that would allow administrators to pick
and choose which option to pass to subdomains.
This option is required for:
https://fedorahosted.org/sssd/ticket/2644
as a short-term fix.
The proper solution is described in:
https://fedorahosted.org/sssd/ticket/2599
---
src/confdb/confdb.c | 13 +++++++++++++
src/confdb/confdb.h | 2 ++
src/config/SSSDConfig/__init__.py.in | 1 +
src/config/SSSDConfigTest.py | 6 ++++--
src/config/etc/sssd.api.conf | 1 +
src/man/sssd.conf.5.xml | 20 +++++++++++++++++++-
6 files changed, 40 insertions(+), 3 deletions(-)
diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index 5aee1ee069bf4ed9ac968588518a3350f573132b..52a5805363f1997fb944475c984dc7de72301300 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -1245,6 +1245,19 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
}
}
+ tmp = ldb_msg_find_attr_as_string(res->msgs[0],
+ CONFDB_DOMAIN_SUBDOMAIN_INHERIT,
+ NULL);
+ if (tmp != NULL) {
+ ret = split_on_separator(domain, tmp, ',', true, true,
+ &domain->sd_inherit, NULL);
+ if (ret != 0) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "Cannot parse %s\n", CONFDB_SUBDOMAIN_ENUMERATE);
+ goto done;
+ }
+ }
+
ret = get_entry_as_uint32(res->msgs[0], &domain->subdomain_refresh_interval,
CONFDB_DOMAIN_SUBDOMAIN_REFRESH, 14400);
if (ret != EOK || domain->subdomain_refresh_interval == 0) {
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 19c56402069f9a7001188e91f77db8ad8525d690..e97c46b34e34a02f80903c204e3a1744b0a5977e 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -184,6 +184,7 @@
#define CONFDB_DOMAIN_PWD_EXPIRATION_WARNING "pwd_expiration_warning"
#define CONFDB_DOMAIN_REFRESH_EXPIRED_INTERVAL "refresh_expired_interval"
#define CONFDB_DOMAIN_OFFLINE_TIMEOUT "offline_timeout"
+#define CONFDB_DOMAIN_SUBDOMAIN_INHERIT "subdomain_inherit"
/* Local Provider */
#define CONFDB_LOCAL_DEFAULT_SHELL "default_shell"
@@ -264,6 +265,7 @@ struct sss_domain_info {
struct sss_domain_info *next;
bool disabled;
+ char **sd_inherit;
};
/**
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index 31c9c648045f1e2b031c6f9b2196b44e9c4c4313..92b53bb23c5525c90d8f7d33d8dcc2c6e0902f8e 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -148,6 +148,7 @@ option_strings = {
'dyndns_auth' : _("What kind of authentication should be used to perform the DNS update"),
'subdomain_enumerate' : _('Control enumeration of trusted domains'),
'subdomain_refresh_interval' : _('How often should subdomains list be refreshed'),
+ 'subdomain_inherit' : _('List of options that should be inherited into a subdomain'),
# [provider/ipa]
'ipa_domain' : _('IPA domain'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 3a5312ea945b5247c69e97b73565b7061e037b69..f94b79b25c7c5c5ebd2c780b467b1188f8616b99 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -538,7 +538,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
'hostid_provider',
'subdomains_provider',
'realmd_tags',
- 'subdomain_refresh_interval']
+ 'subdomain_refresh_interval',
+ 'subdomain_inherit']
self.assertTrue(type(options) == dict,
"Options should be a dictionary")
@@ -897,7 +898,8 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
'hostid_provider',
'subdomains_provider',
'realmd_tags',
- 'subdomain_refresh_interval']
+ 'subdomain_refresh_interval',
+ 'subdomain_inherit']
self.assertTrue(type(options) == dict,
"Options should be a dictionary")
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 4fa542704fbd3af065843e777b84b6305ec3e78b..59d755c2668235d046781227568d7f9e805a45d0 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -131,6 +131,7 @@ default_shell = str, None, false
description = str, None, false
realmd_tags = str, None, false
subdomain_refresh_interval = int, None, false
+subdomain_inherit = str, None, false
#Entry cache timeouts
entry_cache_user_timeout = int, None, false
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 92c64b9fd337377ce301af63bbd146118328cd6d..dc3270ff906da570ed2f8e6bc90c53ccbea08730 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -479,7 +479,25 @@
</para>
</listitem>
</varlistentry>
-
+ <varlistentry>
+ <term>subdomain_inherit (string)</term>
+ <listitem>
+ <para>
+ Specifies a list of configuration parameters that
+ should be inherited by a subdomain. Please note
+ that only selected parametrs can be inherited.
+ </para>
+ <para>
+ Example:
+ <programlisting>
+subdomain_inherit = ldap_purge_cache_timeout
+ </programlisting>
+ </para>
+ <para>
+ Default: none
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect2>
--
2.1.0
-------------- next part --------------
>From d561cfee96f14e2915c51748252c07d8d73eb881 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 6 May 2015 08:06:53 +0200
Subject: [PATCH 2/4] DP: Add a function to inherit DP options, if set
Related to:
https://fedorahosted.org/sssd/ticket/2644
Adds a utility function that checks if a DP option is present in
the subdomain_inherit list. If it is, then the option is set from source
to destination dp_option array.
---
src/providers/data_provider.h | 5 ++
src/providers/data_provider_opts.c | 57 +++++++++++++
src/tests/cmocka/test_dp_opts.c | 163 +++++++++++++++++++++++++++++++------
3 files changed, 201 insertions(+), 24 deletions(-)
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index 5df493e9d1ae21ada6f5fd6198a6d9c36680d044..2d30cb74626508199f186106b03aafa55b760d7a 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -277,6 +277,11 @@ struct dp_option {
#define DP_OPTION_TERMINATOR { NULL, 0, NULL_STRING, NULL_STRING }
+void dp_option_inherit(struct sss_domain_info *parent_dom,
+ int option,
+ struct dp_option *parent_opts,
+ struct dp_option *subdom_opts);
+
int dp_get_options(TALLOC_CTX *memctx,
struct confdb_ctx *cdb,
const char *conf_path,
diff --git a/src/providers/data_provider_opts.c b/src/providers/data_provider_opts.c
index 8ad84560b7329fb1602c675affa4bd0bdf9ecc2e..158124caaa328ca2d19b93747db5a961289c8bba 100644
--- a/src/providers/data_provider_opts.c
+++ b/src/providers/data_provider_opts.c
@@ -21,6 +21,63 @@
#include "data_provider.h"
+/* =Copy-Option-From-Subdomain-If-Allowed================================= */
+void dp_option_inherit(struct sss_domain_info *parent_dom,
+ int option,
+ struct dp_option *parent_opts,
+ struct dp_option *subdom_opts)
+{
+ errno_t ret;
+ bool inherit_option;
+
+ inherit_option = string_in_list(parent_opts[option].opt_name,
+ parent_dom->sd_inherit, false);
+ if (inherit_option == false) {
+ DEBUG(SSSDBG_CONF_SETTINGS,
+ "Option %s is not set up to be inherited\n",
+ parent_opts[option].opt_name);
+ return;
+ }
+
+ DEBUG(SSSDBG_CONF_SETTINGS,
+ "Will inherit option %s\n", parent_opts[option].opt_name);
+ switch (parent_opts[option].type) {
+ case DP_OPT_NUMBER:
+ ret = dp_opt_set_int(subdom_opts,
+ option,
+ dp_opt_get_int(parent_opts,
+ option));
+ break;
+ case DP_OPT_STRING:
+ ret = dp_opt_set_string(subdom_opts,
+ option,
+ dp_opt_get_string(parent_opts,
+ option));
+ break;
+ case DP_OPT_BLOB:
+ ret = dp_opt_set_blob(subdom_opts,
+ option,
+ dp_opt_get_blob(parent_opts,
+ option));
+ break;
+ case DP_OPT_BOOL:
+ ret = dp_opt_set_bool(subdom_opts,
+ option,
+ dp_opt_get_bool(parent_opts,
+ option));
+ break;
+ default:
+ ret = EINVAL;
+ break;
+ }
+
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ "Failed to inherit option %s\n", parent_opts[option].opt_name);
+ /* Not fatal */
+ }
+}
+
/* =Retrieve-Options====================================================== */
int dp_get_options(TALLOC_CTX *memctx,
diff --git a/src/tests/cmocka/test_dp_opts.c b/src/tests/cmocka/test_dp_opts.c
index 9192eaaca605526547a1f7be1830c9940cf9ccb4..b443e93e8bed338390bd0abf5f9a48bded84c73b 100644
--- a/src/tests/cmocka/test_dp_opts.c
+++ b/src/tests/cmocka/test_dp_opts.c
@@ -285,37 +285,63 @@ static int opt_test_getset_teardown(void **state)
return 0;
}
+static void assert_nondefault_string_empty(struct dp_option *opts)
+{
+ char *s;
+
+ s = dp_opt_get_string(opts, OPT_STRING_NODEFAULT);
+ assert_null(s);
+}
+
+static void set_nondefault_string(struct dp_option *opts)
+{
+ int ret;
+
+ ret = dp_opt_set_string(opts, OPT_STRING_NODEFAULT, "str1");
+ assert_int_equal(ret, EOK);
+}
+
+static void check_nondefault_string(struct dp_option *opts)
+{
+ char *s;
+
+ s = dp_opt_get_string(opts, OPT_STRING_NODEFAULT);
+ assert_non_null(s);
+ assert_string_equal(s, "str1");
+}
+
void opt_test_getset_string(void **state)
{
struct dp_option *opts = talloc_get_type(*state, struct dp_option);
- int ret;
- char *s;
- s = dp_opt_get_string(opts, OPT_STRING_NODEFAULT);
- assert_null(s);
-
- ret = dp_opt_set_string(opts, OPT_STRING_NODEFAULT, "str1");
- assert_int_equal(ret, EOK);
-
- s = dp_opt_get_string(opts, OPT_STRING_NODEFAULT);
- assert_non_null(s);
- assert_string_equal(s, "str1");
+ assert_nondefault_string_empty(opts);
+ set_nondefault_string(opts);
+ check_nondefault_string(opts);
}
-void opt_test_getset_blob(void **state)
+static void assert_nondefault_blob_empty(struct dp_option *opts)
{
- struct dp_option *opts = talloc_get_type(*state, struct dp_option);
- int ret;
struct dp_opt_blob b;
b = dp_opt_get_blob(opts, OPT_BLOB_NODEFAULT);
assert_null(b.data);
assert_int_equal(b.length, 0);
+}
+
+static void set_nondefault_blob(struct dp_option *opts)
+{
+ struct dp_opt_blob b;
+ int ret;
b.data = discard_const_p(uint8_t, "blob2");
b.length = strlen("blob2");
ret = dp_opt_set_blob(opts, OPT_BLOB_NODEFAULT, b);
assert_int_equal(ret, EOK);
+}
+
+static void check_nondefault_blob(struct dp_option *opts)
+{
+ struct dp_opt_blob b;
b = dp_opt_get_blob(opts, OPT_BLOB_NODEFAULT);
assert_non_null(b.data);
@@ -323,20 +349,43 @@ void opt_test_getset_blob(void **state)
assert_memory_equal(b.data, "blob2", strlen("blob2"));
}
+void opt_test_getset_blob(void **state)
+{
+ struct dp_option *opts = talloc_get_type(*state, struct dp_option);
+
+ assert_nondefault_blob_empty(opts);
+ set_nondefault_blob(opts);
+ check_nondefault_blob(opts);
+}
+
+static void assert_nondefault_int_notset(struct dp_option *opts)
+{
+ int i;
+ i = dp_opt_get_int(opts, OPT_INT_NODEFAULT);
+ assert_int_equal(i, 0);
+}
+
+static void set_nondefault_int(struct dp_option *opts)
+{
+ int ret;
+ ret = dp_opt_set_int(opts, OPT_INT_NODEFAULT, 456);
+ assert_int_equal(ret, EOK);
+}
+
+static void assert_nondefault_int_set(struct dp_option *opts)
+{
+ int i;
+ i = dp_opt_get_int(opts, OPT_INT_NODEFAULT);
+ assert_int_equal(i, 456);
+}
+
void opt_test_getset_int(void **state)
{
struct dp_option *opts = talloc_get_type(*state, struct dp_option);
- int ret;
- int i;
- i = dp_opt_get_int(opts, OPT_INT_NODEFAULT);
- assert_int_equal(i, 0);
-
- ret = dp_opt_set_int(opts, OPT_INT_NODEFAULT, 456);
- assert_int_equal(ret, EOK);
-
- i = dp_opt_get_int(opts, OPT_INT_NODEFAULT);
- assert_int_equal(i, 456);
+ assert_nondefault_int_notset(opts);
+ set_nondefault_int(opts);
+ assert_nondefault_int_set(opts);
}
void opt_test_getset_bool(void **state)
@@ -355,6 +404,69 @@ void opt_test_getset_bool(void **state)
assert_false(b == true);
}
+void opt_test_inherit(void **state)
+{
+ struct dp_option *opts = talloc_get_type(*state, struct dp_option);
+ int ret;
+ struct sss_domain_info *parent_dom;
+ struct dp_option *opts_copy;
+ const char *s;
+ const char *sd_inherit_match[] = { "string_nodefault",
+ "blob_nodefault",
+ "int_nodefault",
+ "bool_true",
+ NULL };
+
+ parent_dom = talloc(opts, struct sss_domain_info);
+ assert_non_null(parent_dom);
+
+ ret = dp_copy_defaults(parent_dom, test_def_opts,
+ OPT_NUM_OPTS, &opts_copy);
+ assert_int_equal(ret, EOK);
+ assert_defaults(opts);
+
+ parent_dom->sd_inherit = NULL;
+ dp_option_inherit(parent_dom, OPT_STRING_NODEFAULT,
+ opts, opts_copy);
+ s = dp_opt_get_string(opts_copy, OPT_STRING_NODEFAULT);
+ assert_null(s);
+
+ /* test inheritance */
+ parent_dom->sd_inherit = discard_const(sd_inherit_match);
+
+ /* string */
+ assert_nondefault_string_empty(opts_copy);
+ set_nondefault_string(opts);
+ dp_option_inherit(parent_dom, OPT_STRING_NODEFAULT,
+ opts, opts_copy);
+ check_nondefault_string(opts_copy);
+
+ /* blob */
+ assert_nondefault_blob_empty(opts_copy);
+ set_nondefault_blob(opts);
+ dp_option_inherit(parent_dom, OPT_BLOB_NODEFAULT,
+ opts, opts_copy);
+ check_nondefault_blob(opts_copy);
+
+ /* number */
+ assert_nondefault_int_notset(opts_copy);
+ set_nondefault_int(opts);
+ dp_option_inherit(parent_dom, OPT_INT_NODEFAULT,
+ opts, opts_copy);
+ assert_nondefault_int_set(opts_copy);
+
+ /* bool */
+ assert_true(dp_opt_get_bool(opts_copy, OPT_BOOL_TRUE));
+
+ ret = dp_opt_set_bool(opts, OPT_BOOL_TRUE, false);
+ assert_int_equal(ret, EOK);
+
+ dp_option_inherit(parent_dom, OPT_BOOL_TRUE,
+ opts, opts_copy);
+
+ assert_false(dp_opt_get_bool(opts_copy, OPT_BOOL_TRUE));
+}
+
int main(int argc, const char *argv[])
{
int no_cleanup = 0;
@@ -381,6 +493,9 @@ int main(int argc, const char *argv[])
cmocka_unit_test_setup_teardown(opt_test_getset_blob,
opt_test_getset_setup,
opt_test_getset_teardown),
+ cmocka_unit_test_setup_teardown(opt_test_inherit,
+ opt_test_getset_setup,
+ opt_test_getset_teardown),
cmocka_unit_test(opt_test_copy_default),
cmocka_unit_test(opt_test_copy_options),
cmocka_unit_test(opt_test_get)
--
2.1.0
-------------- next part --------------
>From 51d15144edeb6d8e7e8c45ef870b944e2816c149 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 28 Apr 2015 17:04:51 +0200
Subject: [PATCH 3/4] UTIL: Inherit ignore_group_members
Resolves:
https://fedorahosted.org/sssd/ticket/2644
Allows the administrators to extend ignore_group_members to subdomains
as well by setting:
subdomain_inherit = ignore_group_members
in the domain section.
---
src/man/sssd.conf.5.xml | 4 ++++
src/util/domain_info_utils.c | 9 +++++++++
2 files changed, 13 insertions(+)
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index dc3270ff906da570ed2f8e6bc90c53ccbea08730..98c8ea2ff1462139c398cf0be6273b985442b6b6 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -486,6 +486,10 @@
Specifies a list of configuration parameters that
should be inherited by a subdomain. Please note
that only selected parametrs can be inherited.
+ Currently the following options can be inherited:
+ </para>
+ <para>
+ ignore_group_members
</para>
<para>
Example:
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index 450b8ec5cc0d1812b3338e1855e517aecabea159..87f6d564689bbab60cb1c9f7bc8ada1b0f52ae41 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -206,6 +206,7 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
const char *forest)
{
struct sss_domain_info *dom;
+ bool inherit_option;
DEBUG(SSSDBG_TRACE_FUNC,
"Creating [%s] as subdomain of [%s]!\n", name, parent->name);
@@ -281,6 +282,14 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
dom->enumerate = enumerate;
dom->fqnames = true;
dom->mpg = mpg;
+ /* If the parent domain filters out group members, the subdomain should
+ * as well if configured */
+ inherit_option = string_in_list(CONFDB_DOMAIN_IGNORE_GROUP_MEMBERS,
+ parent->sd_inherit, false);
+ if (inherit_option) {
+ dom->ignore_group_members = parent->ignore_group_members;
+ }
+
/* If the parent domain explicitly limits ID ranges, the subdomain
* should honour the limits as well.
*/
--
2.1.0
-------------- next part --------------
>From 07e467c409d7b1b5386eb0221e1e873c2b71fcb1 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 28 Apr 2015 13:48:42 +0200
Subject: [PATCH 4/4] subdomains: Inherit cleanup period and tokengroup
settings from parent domain
Allows the administrator to extend the functionality of
ldap_purge_cache_timeout and ldap_use_tokengroups to the subdomains.
This is a less intrusive way of achieving:
https://fedorahosted.org/sssd/ticket/2627
---
src/man/sssd.conf.5.xml | 6 ++++++
src/providers/ad/ad_subdomains.c | 4 ++++
src/providers/ipa/ipa_subdomains.c | 4 ++++
src/providers/ldap/ldap_common.c | 19 +++++++++++++++++++
src/providers/ldap/ldap_common.h | 4 ++++
5 files changed, 37 insertions(+)
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 98c8ea2ff1462139c398cf0be6273b985442b6b6..bc0bb94143e53ead34b43d5500b18e44f50d71ae 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -492,6 +492,12 @@
ignore_group_members
</para>
<para>
+ ldap_purge_cache_timeout
+ </para>
+ <para>
+ ldap_use_tokengroups
+ </para>
+ <para>
Example:
<programlisting>
subdomain_inherit = ldap_purge_cache_timeout
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
index 5a6e9338d6dc581fba4f76e8b28f92a558eb6294..17a90d0d42561b32d345f2876dc5549a814aaf20 100644
--- a/src/providers/ad/ad_subdomains.c
+++ b/src/providers/ad/ad_subdomains.c
@@ -183,6 +183,10 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
return EFAULT;
}
+ ldap_inherit_options(subdom->parent,
+ id_ctx->sdap_id_ctx->opts->basic,
+ ad_id_ctx->sdap_id_ctx->opts->basic);
+
/* Set up the ID mapping object */
ad_id_ctx->sdap_id_ctx->opts->idmap_ctx =
id_ctx->sdap_id_ctx->opts->idmap_ctx;
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 20657ebb556f75108f64faecc6ad1ccc1d7e26fd..f996812022a7c691cad800524f997fdbb8517dce 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -232,6 +232,10 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
return EFAULT;
}
+ ldap_inherit_options(subdom->parent,
+ id_ctx->sdap_id_ctx->opts->basic,
+ ad_id_ctx->sdap_id_ctx->opts->basic);
+
ret = sdap_id_setup_tasks(be_ctx,
ad_id_ctx->sdap_id_ctx,
sdom,
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 8133431cc35f008768484b43cf7926d41fa0b2e0..f9bda1c5f43426c405cd03c1449cd12f9455628b 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -962,3 +962,22 @@ sdap_id_ctx_new(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
return sdap_ctx;
}
+
+void ldap_inherit_options(struct sss_domain_info *parent_dom,
+ struct dp_option *parent_opts,
+ struct dp_option *subdom_opts)
+{
+ int inherit_options[] = {
+ SDAP_CACHE_PURGE_TIMEOUT,
+ SDAP_AD_USE_TOKENGROUPS,
+ SDAP_OPTS_BASIC /* sentinel */
+ };
+ int i;
+
+ for (i = 0; inherit_options[i] != SDAP_OPTS_BASIC; i++) {
+ dp_option_inherit(parent_dom,
+ inherit_options[i],
+ parent_opts,
+ subdom_opts);
+ }
+}
diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
index 57ad1b8458988d7e108f019c20f67bcde32539d4..9c52558839482a99acf4658a329c3852ef87bce3 100644
--- a/src/providers/ldap/ldap_common.h
+++ b/src/providers/ldap/ldap_common.h
@@ -328,4 +328,8 @@ sdap_id_ctx_new(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
errno_t sdap_refresh_init(struct be_refresh_ctx *refresh_ctx,
struct sdap_id_ctx *id_ctx);
+void ldap_inherit_options(struct sss_domain_info *parent_dom,
+ struct dp_option *parent_opts,
+ struct dp_option *subdom_opts);
+
#endif /* _LDAP_COMMON_H_ */
--
2.1.0
More information about the sssd-devel
mailing list