From 405f08eabf5017cc00891fb2090be80306c8aeae Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 30 Nov 2017 12:01:51 +0100
Subject: [PATCH 70/83] LDAP: Only run the POSIX check with a GC connection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, we used to run the POSIX check also with an LDAP connection.
This was wasteful, but worked, so the waste wasn't the biggest problem
-- the approach would only cause problems with the following patch which
uses a NULL search base to search the Global Catalog, because searching
with a SUBTREE scope and a NULL base returns a referral with an LDAP
connection.

Instead, this patch uses a heuristics (whether the connection ignores
the offline state) to check if the connection is a POSIX one and if it
is NOT, then skips the POSIX check.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
(cherry picked from commit dacfe74113dde62ddaaa7f9abf9d2b6448d89db6)
---
 src/providers/ldap/ldap_common.c     | 2 ++
 src/providers/ldap/ldap_common.h     | 1 +
 src/providers/ldap/ldap_id.c         | 2 ++
 src/providers/ldap/sdap_async_enum.c | 1 +
 4 files changed, 6 insertions(+)

diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 3eff3515d95043d4b59cb0d9953cf050355a0ca5..36e79b9d6ca23ef5e21a8b0bedc7f05db8f4fc98 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -973,12 +973,14 @@ sdap_id_ctx_new(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
 }
 
 bool should_run_posix_check(struct sdap_id_ctx *ctx,
+                            struct sdap_id_conn_ctx *conn,
                             bool use_id_mapping,
                             bool posix_request)
 {
     if (use_id_mapping == false &&
             posix_request == true &&
             ctx->opts->schema_type == SDAP_SCHEMA_AD &&
+            conn->ignore_mark_offline == true &&
             ctx->srv_opts &&
             ctx->srv_opts->posix_checked == false) {
         return true;
diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
index fa7cda4df9d7334f6f0f5baccae0cba0478bfbea..44dbc3fb0678412f46366321e0be836313380949 100644
--- a/src/providers/ldap/ldap_common.h
+++ b/src/providers/ldap/ldap_common.h
@@ -305,6 +305,7 @@ char *get_enterprise_principal_string_filter(TALLOC_CTX *mem_ctx,
                                              struct dp_option *sdap_basic_opts);
 
 bool should_run_posix_check(struct sdap_id_ctx *ctx,
+                            struct sdap_id_conn_ctx *conn,
                             bool id_mapping,
                             bool posix_request);
 
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index 6ab9e0aa1db3eed32deb75211ded30a4cb48ca30..47969a9749253721334a20f46230f7aecea64882 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -412,6 +412,7 @@ static void users_get_connect_done(struct tevent_req *subreq)
      * have no idea about POSIX attributes support, run a one-time check
      */
     if (should_run_posix_check(state->ctx,
+                               state->conn,
                                state->use_id_mapping,
                                !state->non_posix)) {
         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,
@@ -957,6 +958,7 @@ static void groups_get_connect_done(struct tevent_req *subreq)
      * have no idea about POSIX attributes support, run a one-time check
      */
     if (should_run_posix_check(state->ctx,
+                               state->conn,
                                state->use_id_mapping,
                                !state->non_posix)) {
         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,
diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c
index 2cef4eb886f982ba388a34955bdd38468fe68200..baa039d63c71cc5054e6af6538d34d04cde6b858 100644
--- a/src/providers/ldap/sdap_async_enum.c
+++ b/src/providers/ldap/sdap_async_enum.c
@@ -197,6 +197,7 @@ static void sdap_dom_enum_ex_get_users(struct tevent_req *subreq)
      * have no idea about POSIX attributes support, run a one-time check
      */
     if (should_run_posix_check(state->ctx,
+                               state->user_conn,
                                use_id_mapping,
                                true)) {
         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,
-- 
2.14.3