From 569233a9db93bfd2926bb1ecf73d9b67a634e840 Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Thu, 17 Sep 2015 17:11:34 +0200

Subject: [PATCH 96/96] IPA: Retry fetching keytab if IPA user lookup fails

Required for:

    https://fedorahosted.org/sssd/ticket/2639

Instead of calling ipa_get_ad_acct_send directly, call a new request

ipa_srv_ad_acct_send. The new request wraps ipa_get_ad_acct_send and

either tries to request a new keytab every time the lookup fails but the

domain is online.

be_mark_dom_offline() is called when the retry fails with the new code.

The retry tries to re-setup the trusted domain. With two-way setups, the

request is a no-op. With one-way trust setups, the request re-fetches

new keytab unconditionally.

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit 0aff5b651a414a1fd58ab3eb2f029399c0278a18)

---

 src/providers/ipa/ipa_id.h            |   9 --

 src/providers/ipa/ipa_subdomains_id.c | 190 +++++++++++++++++++++++++++++++++-

 2 files changed, 185 insertions(+), 14 deletions(-)

diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h

index c03ca037a2850478a8f4933bac4fcf8bd70ada04..91a94115386955f63eca706bf6f4ac41884445eb 100644

--- a/src/providers/ipa/ipa_id.h

+++ b/src/providers/ipa/ipa_id.h

@@ -70,15 +70,6 @@ struct tevent_req *ipa_get_subdom_acct_send(TALLOC_CTX *memctx,

                                             struct be_acct_req *ar);

 int ipa_get_subdom_acct_recv(struct tevent_req *req, int *dp_error_out);

-struct tevent_req *ipa_get_ad_acct_send(TALLOC_CTX *mem_ctx,

-                                        struct tevent_context *ev,

-                                        struct ipa_id_ctx *ipa_ctx,

-                                        struct be_req *be_req,

-                                        struct sysdb_attrs *override_attrs,

-                                        struct be_acct_req *ar);

-

-errno_t ipa_get_ad_acct_recv(struct tevent_req *req, int *dp_error_out);

-

 errno_t get_be_acct_req_for_sid(TALLOC_CTX *mem_ctx, const char *sid,

                                 const char *domain_name,

                                 struct be_acct_req **_ar);

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c

index ff14b4a4c68cb5c6e9865a66931ee4ecd6e49211..86dd71f3cc09f11de88c4269d49552718c5ba027 100644

--- a/src/providers/ipa/ipa_subdomains_id.c

+++ b/src/providers/ipa/ipa_subdomains_id.c

@@ -34,6 +34,16 @@

 #include "providers/ad/ad_id.h"

 #include "providers/ipa/ipa_subdomains.h"

+static struct tevent_req *

+ipa_srv_ad_acct_send(TALLOC_CTX *mem_ctx,

+                     struct tevent_context *ev,

+                     struct ipa_id_ctx *ipa_ctx,

+                     struct be_req *be_req,

+                     struct sysdb_attrs *override_attrs,

+                     struct be_acct_req *ar);

+static errno_t

+ipa_srv_ad_acct_recv(struct tevent_req *req, int *dp_error_out);

+

 struct ipa_subdomain_account_state {

     struct tevent_context *ev;

     struct ipa_id_ctx *ipa_ctx;

@@ -45,6 +55,7 @@ struct ipa_subdomain_account_state {

     struct be_acct_req *ar;

     bool ipa_server_mode;

+    bool server_retry;

     int entry_type;

     const char *filter;

     int filter_type;

@@ -263,7 +274,7 @@ static errno_t ipa_subdomain_account_get_original_step(struct tevent_req *req,

     struct tevent_req *subreq;

     if (state->ipa_server_mode) {

-        subreq = ipa_get_ad_acct_send(state, state->ev, state->ipa_ctx,

+        subreq = ipa_srv_ad_acct_send(state, state->ev, state->ipa_ctx,

                                       state->be_req, state->override_attrs, ar);

     } else {

         subreq = ipa_get_subdom_acct_send(state, state->ev, state->ipa_ctx,

@@ -291,7 +302,7 @@ static void ipa_subdomain_account_done(struct tevent_req *subreq)

     int ret;

     if (state->ipa_server_mode) {

-        ret = ipa_get_ad_acct_recv(subreq, &dp_error);

+        ret = ipa_srv_ad_acct_recv(subreq, &dp_error);

     } else {

         ret = ipa_get_subdom_acct_recv(subreq, &dp_error);

     }

@@ -575,7 +586,7 @@ static void ipa_get_ad_acct_done(struct tevent_req *subreq);

 static struct ad_id_ctx *ipa_get_ad_id_ctx(struct ipa_id_ctx *ipa_ctx,

                                            struct sss_domain_info *dom);

-struct tevent_req *

+static struct tevent_req *

 ipa_get_ad_acct_send(TALLOC_CTX *mem_ctx,

                      struct tevent_context *ev,

                      struct ipa_id_ctx *ipa_ctx,

@@ -1039,7 +1050,6 @@ ipa_get_ad_acct_ad_part_done(struct tevent_req *subreq)

     ret = ad_handle_acct_info_recv(subreq, &state->dp_error, NULL);

     talloc_zfree(subreq);

     if (ret == ERR_SUBDOM_INACTIVE) {

-        be_mark_dom_offline(state->obj_dom, be_req_get_be_ctx(state->be_req));

         tevent_req_error(req, ret);

         return;

     } else if (ret != EOK) {

@@ -1324,7 +1334,7 @@ ipa_get_ad_acct_done(struct tevent_req *subreq)

     tevent_req_done(req);

 }

-errno_t

+static errno_t

 ipa_get_ad_acct_recv(struct tevent_req *req, int *dp_error_out)

 {

     struct ipa_get_ad_acct_state *state = tevent_req_data(req,

@@ -1338,3 +1348,173 @@ ipa_get_ad_acct_recv(struct tevent_req *req, int *dp_error_out)

     return EOK;

 }

+

+struct ipa_srv_ad_acct_state {

+    struct tevent_context *ev;

+    struct ipa_id_ctx *ipa_ctx;

+    struct be_req *be_req;

+    struct sysdb_attrs *override_attrs;

+    struct be_acct_req *ar;

+

+    struct sss_domain_info *obj_dom;

+    struct be_ctx *be_ctx;

+    bool retry;

+

+    int dp_error;

+};

+

+static int ipa_srv_ad_acct_lookup_step(struct tevent_req *req);

+static void ipa_srv_ad_acct_lookup_done(struct tevent_req *subreq);

+static void ipa_srv_ad_acct_retried(struct tevent_req *subreq);

+

+static struct tevent_req *

+ipa_srv_ad_acct_send(TALLOC_CTX *mem_ctx,

+                     struct tevent_context *ev,

+                     struct ipa_id_ctx *ipa_ctx,

+                     struct be_req *be_req,

+                     struct sysdb_attrs *override_attrs,

+                     struct be_acct_req *ar)

+{

+    errno_t ret;

+    struct tevent_req *req;

+    struct ipa_srv_ad_acct_state *state;

+

+    req = tevent_req_create(mem_ctx, &state, struct ipa_srv_ad_acct_state);

+    if (req == NULL) {

+        return NULL;

+    }

+

+    state->ev = ev;

+    state->ipa_ctx = ipa_ctx;

+    state->be_req = be_req;

+    state->override_attrs = override_attrs;

+    state->ar = ar;

+    state->retry = true;

+    state->dp_error = DP_ERR_FATAL;

+    state->be_ctx = be_req_get_be_ctx(state->be_req);

+

+    state->obj_dom = find_domain_by_name(

+                                  state->ipa_ctx->sdap_id_ctx->be->domain,

+                                  state->ar->domain, true);

+    if (state->obj_dom == NULL) {

+        DEBUG(SSSDBG_OP_FAILURE, "Domain not found\n");

+        ret = ERR_DOMAIN_NOT_FOUND;

+        goto fail;

+    }

+

+    ret = ipa_srv_ad_acct_lookup_step(req);

+    if (ret != EOK) {

+        goto fail;

+    }

+

+    return req;

+

+fail:

+    tevent_req_error(req, ret);

+    tevent_req_post(req, ev);

+    return req;

+}

+

+static int ipa_srv_ad_acct_lookup_step(struct tevent_req *req)

+{

+    struct tevent_req *subreq;

+    struct ipa_srv_ad_acct_state *state = tevent_req_data(req,

+                                            struct ipa_srv_ad_acct_state);

+

+    DEBUG(SSSDBG_TRACE_FUNC, "Looking up AD account\n");

+    subreq = ipa_get_ad_acct_send(state, state->ev, state->ipa_ctx,

+                                  state->be_req, state->override_attrs,

+                                  state->ar);

+    if (subreq == NULL) {

+        return ENOMEM;

+    }

+    tevent_req_set_callback(subreq, ipa_srv_ad_acct_lookup_done, req);

+

+    return EOK;

+}

+

+static void ipa_srv_ad_acct_lookup_done(struct tevent_req *subreq)

+{

+    errno_t ret;

+    int dp_error = DP_ERR_FATAL;

+    struct tevent_req *req = tevent_req_callback_data(subreq,

+                                                struct tevent_req);

+    struct ipa_srv_ad_acct_state *state = tevent_req_data(req,

+                                            struct ipa_srv_ad_acct_state);

+

+    ret = ipa_get_ad_acct_recv(subreq, &dp_error);

+    talloc_free(subreq);

+    if (ret == ERR_SUBDOM_INACTIVE && state->retry == true) {

+

+        state->retry = false;

+

+        DEBUG(SSSDBG_MINOR_FAILURE,

+              "Sudomain lookup failed, will try to reset sudomain..\n");

+        subreq = ipa_server_trusted_dom_setup_send(state, state->ev,

+                                                   state->be_ctx,

+                                                   state->ipa_ctx,

+                                                   state->obj_dom);

+        if (subreq == NULL) {

+            goto fail;

+        }

+        tevent_req_set_callback(subreq, ipa_srv_ad_acct_retried, req);

+        return;

+    } else if (ret != EOK) {

+        be_mark_dom_offline(state->obj_dom, state->be_ctx);

+

+        DEBUG(SSSDBG_OP_FAILURE, "ipa_get_*_acct request failed: [%d]: %s.\n",

+              ret, sss_strerror(ret));

+        goto fail;

+    }

+

+    state->dp_error = DP_ERR_OK;

+    tevent_req_done(req);

+    return;

+

+fail:

+    state->dp_error = dp_error;

+    tevent_req_error(req, ret);

+}

+

+static void ipa_srv_ad_acct_retried(struct tevent_req *subreq)

+{

+    errno_t ret;

+    struct tevent_req *req = tevent_req_callback_data(subreq,

+                                                struct tevent_req);

+    struct ipa_srv_ad_acct_state *state = tevent_req_data(req,

+                                            struct ipa_srv_ad_acct_state);

+

+    ret = ipa_server_trusted_dom_setup_recv(subreq);

+    talloc_free(subreq);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Failed to re-set subdomain [%d]: %s\n", ret, sss_strerror(ret));

+        state->dp_error = DP_ERR_FATAL;

+        tevent_req_error(req, ret);

+    }

+

+    DEBUG(SSSDBG_TRACE_FUNC, "Sudomain re-set, will retry lookup\n");

+    be_fo_reset_svc(state->be_ctx, state->obj_dom->name);

+

+    ret = ipa_srv_ad_acct_lookup_step(req);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Failed to look up AD acct [%d]: %s\n", ret, sss_strerror(ret));

+        state->dp_error = DP_ERR_FATAL;

+        tevent_req_error(req, ret);

+    }

+}

+

+static errno_t

+ipa_srv_ad_acct_recv(struct tevent_req *req, int *dp_error_out)

+{

+    struct ipa_srv_ad_acct_state *state = tevent_req_data(req,

+                                                struct ipa_srv_ad_acct_state);

+

+    if (dp_error_out) {

+        *dp_error_out = state->dp_error;

+    }

+

+    TEVENT_REQ_RETURN_ON_ERROR(req);

+    return EOK;

+}

-- 

2.4.3