|
 |
ced1f5 |
From 53c6201539d24f8b929120565ca661977ecbb1a4 Mon Sep 17 00:00:00 2001
|
|
|
ced1f5 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ced1f5 |
Date: Mon, 20 Nov 2017 16:12:58 +0100
|
|
|
ced1f5 |
Subject: [PATCH 65/67] ipa: check for SYSDB_OVERRIDE_DN in process_members and
|
|
|
ced1f5 |
get_group_dn_list
|
|
|
ced1f5 |
MIME-Version: 1.0
|
|
|
ced1f5 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ced1f5 |
Content-Transfer-Encoding: 8bit
|
|
|
ced1f5 |
|
|
|
ced1f5 |
process_members() and get_group_dn_list() are used on an IPA client to
|
|
|
ced1f5 |
determine a list of users or groups which are missing in the cache and
|
|
|
ced1f5 |
are needed to properly add a group or user object to the cache
|
|
|
ced1f5 |
respectively.
|
|
|
ced1f5 |
|
|
|
ced1f5 |
If a non-default view is assigned to the client the SYSDB_OVERRIDE_DN
|
|
|
ced1f5 |
must be set for all user and group objects to indicate that it was
|
|
|
ced1f5 |
already checked if there is an id-override defined for the object or
|
|
|
ced1f5 |
not. There a circumstances were SYSDB_OVERRIDE_DN is not set, e.g. after
|
|
|
ced1f5 |
a view name change. To make sure the cache is in a consistent state with
|
|
|
ced1f5 |
this patch user and group entries without SYSDB_OVERRIDE_DN are
|
|
|
ced1f5 |
considered as missing is a non-default view is assigned to the client.
|
|
|
ced1f5 |
|
|
|
ced1f5 |
Related to https://pagure.io/SSSD/sssd/issue/3579
|
|
|
ced1f5 |
|
|
|
ced1f5 |
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
ced1f5 |
(cherry picked from commit 919b5d76057d31877e0c25ca495711ff76c713d6)
|
|
|
ced1f5 |
---
|
|
|
ced1f5 |
src/providers/ipa/ipa_s2n_exop.c | 145 ++++++++++++++++++++++-----------------
|
|
|
ced1f5 |
1 file changed, 83 insertions(+), 62 deletions(-)
|
|
|
ced1f5 |
|
|
|
ced1f5 |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
index 39ed17cbf0e8c523212084197e9f2963fed88dc8..c6132f509dcc8e7af84e03e8bfe20701107d1392 100644
|
|
|
ced1f5 |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
@@ -1523,6 +1523,7 @@ fail:
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
static errno_t process_members(struct sss_domain_info *domain,
|
|
|
ced1f5 |
+ bool is_default_view,
|
|
|
ced1f5 |
struct sysdb_attrs *group_attrs,
|
|
|
ced1f5 |
char **members,
|
|
|
ced1f5 |
TALLOC_CTX *mem_ctx, char ***_missing_members)
|
|
|
ced1f5 |
@@ -1536,6 +1537,7 @@ static errno_t process_members(struct sss_domain_info *domain,
|
|
|
ced1f5 |
struct sss_domain_info *parent_domain;
|
|
|
ced1f5 |
char **missing_members = NULL;
|
|
|
ced1f5 |
size_t miss_count = 0;
|
|
|
ced1f5 |
+ const char *attrs[] = {SYSDB_NAME, SYSDB_OVERRIDE_DN, NULL};
|
|
|
ced1f5 |
|
|
|
ced1f5 |
if (members == NULL) {
|
|
|
ced1f5 |
DEBUG(SSSDBG_TRACE_INTERNAL, "No members\n");
|
|
|
ced1f5 |
@@ -1572,53 +1574,59 @@ static errno_t process_members(struct sss_domain_info *domain,
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = sysdb_search_user_by_name(tmp_ctx, obj_domain, members[c], NULL,
|
|
|
ced1f5 |
+ ret = sysdb_search_user_by_name(tmp_ctx, obj_domain, members[c], attrs,
|
|
|
ced1f5 |
&msg;;
|
|
|
ced1f5 |
- if (ret == EOK) {
|
|
|
ced1f5 |
- if (group_attrs != NULL) {
|
|
|
ced1f5 |
- dn_str = ldb_dn_get_linearized(msg->dn);
|
|
|
ced1f5 |
- if (dn_str == NULL) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_get_linearized failed.\n");
|
|
|
ced1f5 |
- ret = EINVAL;
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
-
|
|
|
ced1f5 |
- DEBUG(SSSDBG_TRACE_ALL, "Adding member [%s][%s]\n",
|
|
|
ced1f5 |
- members[c], dn_str);
|
|
|
ced1f5 |
+ if (ret == EOK || ret == ENOENT) {
|
|
|
ced1f5 |
+ if (ret == ENOENT
|
|
|
ced1f5 |
+ || (!is_default_view
|
|
|
ced1f5 |
+ && ldb_msg_find_attr_as_string(msg, SYSDB_OVERRIDE_DN,
|
|
|
ced1f5 |
+ NULL) == NULL)) {
|
|
|
ced1f5 |
+ /* only add ghost if the member is really missing */
|
|
|
ced1f5 |
+ if (group_attrs != NULL && ret == ENOENT) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_TRACE_ALL, "Adding ghost member [%s]\n",
|
|
|
ced1f5 |
+ members[c]);
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = sysdb_attrs_add_string_safe(group_attrs, SYSDB_MEMBER,
|
|
|
ced1f5 |
- dn_str);
|
|
|
ced1f5 |
- if (ret != EOK) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ced1f5 |
- "sysdb_attrs_add_string_safe failed.\n");
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
+ /* There were cases where the server returned the same user
|
|
|
ced1f5 |
+ * multiple times */
|
|
|
ced1f5 |
+ ret = sysdb_attrs_add_string_safe(group_attrs, SYSDB_GHOST,
|
|
|
ced1f5 |
+ members[c]);
|
|
|
ced1f5 |
+ if (ret != EOK) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ced1f5 |
+ "sysdb_attrs_add_string failed.\n");
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
- } else if (ret == ENOENT) {
|
|
|
ced1f5 |
- if (group_attrs != NULL) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_TRACE_ALL, "Adding ghost member [%s]\n",
|
|
|
ced1f5 |
- members[c]);
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- /* There were cases where the server returned the same user
|
|
|
ced1f5 |
- * multiple times */
|
|
|
ced1f5 |
- ret = sysdb_attrs_add_string_safe(group_attrs, SYSDB_GHOST,
|
|
|
ced1f5 |
- members[c]);
|
|
|
ced1f5 |
- if (ret != EOK) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ced1f5 |
- "sysdb_attrs_add_string failed.\n");
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
+ if (missing_members != NULL) {
|
|
|
ced1f5 |
+ missing_members[miss_count] = talloc_strdup(missing_members,
|
|
|
ced1f5 |
+ members[c]);
|
|
|
ced1f5 |
+ if (missing_members[miss_count] == NULL) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
|
|
|
ced1f5 |
+ ret = ENOMEM;
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
+ miss_count++;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
+ } else {
|
|
|
ced1f5 |
+ if (group_attrs != NULL) {
|
|
|
ced1f5 |
+ dn_str = ldb_dn_get_linearized(msg->dn);
|
|
|
ced1f5 |
+ if (dn_str == NULL) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_get_linearized failed.\n");
|
|
|
ced1f5 |
+ ret = EINVAL;
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
+
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_TRACE_ALL, "Adding member [%s][%s]\n",
|
|
|
ced1f5 |
+ members[c], dn_str);
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- if (missing_members != NULL) {
|
|
|
ced1f5 |
- missing_members[miss_count] = talloc_strdup(missing_members,
|
|
|
ced1f5 |
- members[c]);
|
|
|
ced1f5 |
- if (missing_members[miss_count] == NULL) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
|
|
|
ced1f5 |
- ret = ENOMEM;
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
+ ret = sysdb_attrs_add_string_safe(group_attrs, SYSDB_MEMBER,
|
|
|
ced1f5 |
+ dn_str);
|
|
|
ced1f5 |
+ if (ret != EOK) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ced1f5 |
+ "sysdb_attrs_add_string_safe failed.\n");
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
- miss_count++;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
} else {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_user_by_name failed.\n");
|
|
|
ced1f5 |
@@ -1649,6 +1657,7 @@ done:
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
static errno_t get_group_dn_list(TALLOC_CTX *mem_ctx,
|
|
|
ced1f5 |
+ bool is_default_view,
|
|
|
ced1f5 |
struct sss_domain_info *dom,
|
|
|
ced1f5 |
size_t ngroups, char **groups,
|
|
|
ced1f5 |
struct ldb_dn ***_dn_list,
|
|
|
ced1f5 |
@@ -1664,6 +1673,7 @@ static errno_t get_group_dn_list(TALLOC_CTX *mem_ctx,
|
|
|
ced1f5 |
size_t n_missing = 0;
|
|
|
ced1f5 |
struct sss_domain_info *obj_domain;
|
|
|
ced1f5 |
struct sss_domain_info *parent_domain;
|
|
|
ced1f5 |
+ const char *attrs[] = {SYSDB_NAME, SYSDB_OVERRIDE_DN, NULL};
|
|
|
ced1f5 |
|
|
|
ced1f5 |
tmp_ctx = talloc_new(NULL);
|
|
|
ced1f5 |
if (tmp_ctx == NULL) {
|
|
|
ced1f5 |
@@ -1689,25 +1699,31 @@ static errno_t get_group_dn_list(TALLOC_CTX *mem_ctx,
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = sysdb_search_group_by_name(tmp_ctx, obj_domain, groups[c], NULL,
|
|
|
ced1f5 |
+ ret = sysdb_search_group_by_name(tmp_ctx, obj_domain, groups[c], attrs,
|
|
|
ced1f5 |
&msg;;
|
|
|
ced1f5 |
- if (ret == EOK) {
|
|
|
ced1f5 |
- dn_list[n_dns] = ldb_dn_copy(dn_list, msg->dn);
|
|
|
ced1f5 |
- if (dn_list[n_dns] == NULL) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_copy failed.\n");
|
|
|
ced1f5 |
- ret = ENOMEM;
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
+ if (ret == EOK || ret == ENOENT) {
|
|
|
ced1f5 |
+ if (ret == ENOENT
|
|
|
ced1f5 |
+ || (!is_default_view
|
|
|
ced1f5 |
+ && ldb_msg_find_attr_as_string(msg, SYSDB_OVERRIDE_DN,
|
|
|
ced1f5 |
+ NULL) == NULL)) {
|
|
|
ced1f5 |
+ missing_groups[n_missing] = talloc_strdup(missing_groups,
|
|
|
ced1f5 |
+ groups[c]);
|
|
|
ced1f5 |
+ if (missing_groups[n_missing] == NULL) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
|
|
|
ced1f5 |
+ ret = ENOMEM;
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
+ n_missing++;
|
|
|
ced1f5 |
+
|
|
|
ced1f5 |
+ } else {
|
|
|
ced1f5 |
+ dn_list[n_dns] = ldb_dn_copy(dn_list, msg->dn);
|
|
|
ced1f5 |
+ if (dn_list[n_dns] == NULL) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_copy failed.\n");
|
|
|
ced1f5 |
+ ret = ENOMEM;
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
+ n_dns++;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
- n_dns++;
|
|
|
ced1f5 |
- } else if (ret == ENOENT) {
|
|
|
ced1f5 |
- missing_groups[n_missing] = talloc_strdup(missing_groups,
|
|
|
ced1f5 |
- groups[c]);
|
|
|
ced1f5 |
- if (missing_groups[n_missing] == NULL) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
|
|
|
ced1f5 |
- ret = ENOMEM;
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
- n_missing++;
|
|
|
ced1f5 |
} else {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_group_by_name failed.\n");
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
@@ -1803,7 +1819,9 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = get_group_dn_list(state, state->dom,
|
|
|
ced1f5 |
+ ret = get_group_dn_list(state,
|
|
|
ced1f5 |
+ is_default_view(state->ipa_ctx->view_name),
|
|
|
ced1f5 |
+ state->dom,
|
|
|
ced1f5 |
attrs->ngroups, attrs->groups,
|
|
|
ced1f5 |
&group_dn_list, &missing_list);
|
|
|
ced1f5 |
if (ret != EOK) {
|
|
|
ced1f5 |
@@ -1832,8 +1850,10 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
break;
|
|
|
ced1f5 |
} else if (attrs->response_type == RESP_GROUP_MEMBERS) {
|
|
|
ced1f5 |
- ret = process_members(state->dom, NULL, attrs->a.group.gr_mem,
|
|
|
ced1f5 |
- state, &missing_list);
|
|
|
ced1f5 |
+ ret = process_members(state->dom,
|
|
|
ced1f5 |
+ is_default_view(state->ipa_ctx->view_name),
|
|
|
ced1f5 |
+ NULL, attrs->a.group.gr_mem, state,
|
|
|
ced1f5 |
+ &missing_list);
|
|
|
ced1f5 |
if (ret != EOK) {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "process_members failed.\n");
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
@@ -2572,8 +2592,9 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = process_members(dom, attrs->sysdb_attrs,
|
|
|
ced1f5 |
- attrs->a.group.gr_mem, NULL, NULL);
|
|
|
ced1f5 |
+ ret = process_members(dom, is_default_view(view_name),
|
|
|
ced1f5 |
+ attrs->sysdb_attrs, attrs->a.group.gr_mem,
|
|
|
ced1f5 |
+ NULL, NULL);
|
|
|
ced1f5 |
if (ret != EOK) {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "process_members failed.\n");
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
--
|
|
|
ced1f5 |
2.14.3
|
|
|
ced1f5 |
|