From 4a3f3c675e360c888da7d23ab6ec4cca10876b08 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 27 Apr 2017 09:28:55 +0200
Subject: [PATCH 118/118] overrides: add certificates to mapped attribute
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Certificates in overrides are explicitly used to map users to
certificates, so we add them to SYSDB_USER_MAPPED_CERT as well.

Resolves https://pagure.io/SSSD/sssd/issue/3373

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
(cherry picked from commit 2e5fc89ef25434fab7febe2c52e97ef989b50d5b)
---
 src/db/sysdb_views.c | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/src/db/sysdb_views.c b/src/db/sysdb_views.c
index 20db9b06183d68b33bb19f498513d7f5cf84b1cf..3773dda77e16b35fa217be0aa7974da7e34c09f4 100644
--- a/src/db/sysdb_views.c
+++ b/src/db/sysdb_views.c
@@ -777,6 +777,7 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
     int ret;
     TALLOC_CTX *tmp_ctx;
     struct sysdb_attrs *attrs;
+    struct sysdb_attrs *mapped_attrs = NULL;
     size_t c;
     size_t d;
     size_t num_values;
@@ -791,6 +792,7 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
                                     SYSDB_USER_CERT,
                                     NULL };
     bool override_attrs_found = false;
+    bool is_cert = false;
 
     if (override_attrs == NULL) {
         /* nothing to do */
@@ -846,6 +848,24 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
                     num_values = 1;
                 }
 
+                is_cert = false;
+                if (strcmp(allowed_attrs[c], SYSDB_USER_CERT) == 0) {
+                    /* Certificates in overrides are explicitly used to map
+                     * users to certificates, so we add them to
+                     * SYSDB_USER_MAPPED_CERT as well. */
+                    is_cert = true;
+
+                    if (mapped_attrs == NULL) {
+                        mapped_attrs = sysdb_new_attrs(tmp_ctx);
+                        if (mapped_attrs == NULL) {
+                            DEBUG(SSSDBG_OP_FAILURE,
+                                  "sysdb_new_attrs failed.\n");
+                            ret = ENOMEM;
+                            goto done;
+                        }
+                    }
+                }
+
                 for (d = 0; d < num_values; d++) {
                     ret = sysdb_attrs_add_val(attrs,  allowed_attrs[c],
                                               &el->values[d]);
@@ -854,6 +874,18 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
                               "sysdb_attrs_add_val failed.\n");
                         goto done;
                     }
+
+                    if (is_cert) {
+                        ret = sysdb_attrs_add_val(mapped_attrs,
+                                                  SYSDB_USER_MAPPED_CERT,
+                                                  &el->values[d]);
+                        if (ret != EOK) {
+                            DEBUG(SSSDBG_OP_FAILURE,
+                                  "sysdb_attrs_add_val failed.\n");
+                            goto done;
+                        }
+                    }
+
                     DEBUG(SSSDBG_TRACE_ALL,
                           "Override [%s] with [%.*s] for [%s].\n",
                           allowed_attrs[c], (int) el->values[d].length,
@@ -878,6 +910,15 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
             DEBUG(SSSDBG_OP_FAILURE, "sysdb_set_entry_attr failed.\n");
             goto done;
         }
+
+        if (mapped_attrs != NULL) {
+            ret = sysdb_set_entry_attr(domain->sysdb, obj_dn, mapped_attrs,
+                                       SYSDB_MOD_ADD);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE,
+                      "sysdb_set_entry_attr failed, ignored.\n");
+            }
+        }
     }
 
     ret = EOK;
-- 
2.9.3