From 373b1136ccb3bf54f32d47473e8120d0258f8405 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Tue, 21 May 2019 10:22:04 +0200

Subject: [PATCH 31/31] sdap: inherit SDAP_SASL_MECH if not set explicitly

If ldap_sasl_mech is set for the configured domain in sssd.conf the

value is inherited automatically to all sub-domains. The can be

overwritten by setting ldap_sasl_mech for a given sub-domain explicitly

in sssd.conf.

Related to https://pagure.io/SSSD/sssd/issue/4006

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit 070f22f896b909c140ed7598aed2393d61a834ae)

---

 src/config/cfg_rules.ini                  |  1 +

 src/man/sssd-ldap.5.xml                   | 10 ++++++

 src/man/sssd.conf.5.xml                   |  1 +

 src/providers/ad/ad_common.c              | 38 +++++++++++++++++++++++

 src/providers/ad/ad_common.h              |  5 +++

 src/providers/ad/ad_subdomains.c          | 18 ++++++++++-

 src/providers/ipa/ipa_subdomains_server.c | 19 +++++++++++-

 7 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini

index 603211711..3976ec4e1 100644

--- a/src/config/cfg_rules.ini

+++ b/src/config/cfg_rules.ini

@@ -753,6 +753,7 @@ option = ldap_user_search_base

 option = ldap_group_search_base

 option = ldap_netgroup_search_base

 option = ldap_service_search_base

+option = ldap_sasl_mech

 option = ad_server

 option = ad_backup_server

 option = ad_site

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml

index 17c5523c0..fadd05cb7 100644

--- a/src/man/sssd-ldap.5.xml

+++ b/src/man/sssd-ldap.5.xml

@@ -1808,6 +1808,16 @@

                             Specify the SASL mechanism to use.  Currently only

                             GSSAPI and GSS-SPNEGO are tested and supported.

                         </para>

+                        <para>

+                            If the backend supports sub-domains the value of

+                            ldap_sasl_mech is automatically inherited to the

+                            sub-domains. If a different value is needed for a

+                            sub-domain it can be overwritten by setting

+                            ldap_sasl_mech for this sub-domain explicitly.

+                            Please see TRUSTED DOMAIN SECTION in

+                            <citerefentry><refentrytitle>sssd.conf</refentrytitle>

+                            <manvolnum>5</manvolnum></citerefentry> for details.

+                        </para>

                         <para>

                             Default: not set

                         </para>

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml

index 1ab7af00b..3f05b3942 100644

--- a/src/man/sssd.conf.5.xml

+++ b/src/man/sssd.conf.5.xml

@@ -3356,6 +3356,7 @@ ldap_user_extra_attrs = phone:telephoneNumber

             <para>ldap_group_search_base,</para>

             <para>ldap_netgroup_search_base,</para>

             <para>ldap_service_search_base,</para>

+            <para>ldap_sasl_mech,</para>

             <para>ad_server,</para>

             <para>ad_backup_server,</para>

             <para>ad_site,</para>

diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c

index 19d4b3d5a..1b8b1df19 100644

--- a/src/providers/ad/ad_common.c

+++ b/src/providers/ad/ad_common.c

@@ -1455,3 +1455,41 @@ ad_user_conn_list(TALLOC_CTX *mem_ctx,

     return clist;

 }

+

+errno_t ad_inherit_opts_if_needed(struct dp_option *parent_opts,

+                                  struct dp_option *suddom_opts,

+                                  struct confdb_ctx *cdb,

+                                  const char *subdom_conf_path,

+                                  int opt_id)

+{

+    int ret;

+    const char *parent_val = NULL;

+    char *dummy = NULL;

+    char *option_list[2] = { NULL, NULL };

+

+    parent_val = dp_opt_get_cstring(parent_opts, opt_id);

+    if (parent_val != NULL) {

+        ret = confdb_get_string(cdb, NULL, subdom_conf_path,

+                                parent_opts[opt_id].opt_name, NULL, &dummy);

+        if (ret != EOK) {

+            DEBUG(SSSDBG_OP_FAILURE, "confdb_get_string failed.\n");

+            goto done;

+        }

+

+        if (dummy == NULL) {

+            DEBUG(SSSDBG_CONF_SETTINGS,

+                  "Option [%s] is set in parent domain but not set for "

+                  "sub-domain trying to set it to [%s].\n",

+                  parent_opts[opt_id].opt_name, parent_val);

+            option_list[0] = discard_const(parent_opts[opt_id].opt_name);

+            dp_option_inherit(option_list, opt_id, parent_opts, suddom_opts);

+        }

+    }

+

+    ret = EOK;

+

+done:

+    talloc_free(dummy);

+

+    return ret;

+}

diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h

index 638465958..2f624df3d 100644

--- a/src/providers/ad/ad_common.h

+++ b/src/providers/ad/ad_common.h

@@ -216,4 +216,9 @@ errno_t netlogon_get_domain_info(TALLOC_CTX *mem_ctx,

                                  char **_site,

                                  char **_forest);

+errno_t ad_inherit_opts_if_needed(struct dp_option *parent_opts,

+                                  struct dp_option *suddom_opts,

+                                  struct confdb_ctx *cdb,

+                                  const char *subdom_conf_path,

+                                  int opt_id);

 #endif /* AD_COMMON_H_ */

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c

index b4ad347e4..b4e09fb7e 100644

--- a/src/providers/ad/ad_subdomains.c

+++ b/src/providers/ad/ad_subdomains.c

@@ -305,13 +305,29 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,

                                               realm,

                                               subdom,

                                               hostname, keytab);

-    talloc_free(subdom_conf_path);

     if (ad_options == NULL) {

         DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD options\n");

         talloc_free(ad_options);

+        talloc_free(subdom_conf_path);

         return ENOMEM;

     }

+    ret = ad_inherit_opts_if_needed(id_ctx->sdap_id_ctx->opts->basic,

+                                    ad_options->id->basic,

+                                    be_ctx->cdb, subdom_conf_path,

+                                    SDAP_SASL_MECH);

+    talloc_free(subdom_conf_path);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to inherit option [%s] to sub-domain [%s]. "

+              "This error is ignored but might cause issues or unexpected "

+              "behavior later on.\n",

+              id_ctx->ad_options->id->basic[SDAP_SASL_MECH].opt_name,

+              subdom->name);

+

+        return ret;

+    }

+

     ad_site_override = dp_opt_get_string(ad_options->basic, AD_SITE);

     gc_service_name = talloc_asprintf(ad_options, "sd_gc_%s", subdom->name);

diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c

index 1d480e52b..d0e89a4f9 100644

--- a/src/providers/ipa/ipa_subdomains_server.c

+++ b/src/providers/ipa/ipa_subdomains_server.c

@@ -172,6 +172,7 @@ static struct ad_options *ipa_ad_options_new(struct be_ctx *be_ctx,

     const char *forest;

     const char *forest_realm;

     char *subdom_conf_path;

+    int ret;

     /* Trusts are only established with forest roots */

     direction = subdom->forest_root->trust_direction;

@@ -196,12 +197,28 @@ static struct ad_options *ipa_ad_options_new(struct be_ctx *be_ctx,

         DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported trust direction!\n");

         ad_options = NULL;

     }

-    talloc_free(subdom_conf_path);

     if (ad_options == NULL) {

         DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD options\n");

+        talloc_free(subdom_conf_path);

         return NULL;

     }

+

+    ret = ad_inherit_opts_if_needed(id_ctx->ipa_options->id->basic,

+                                    ad_options->id->basic, be_ctx->cdb,

+                                    subdom_conf_path, SDAP_SASL_MECH);

+    talloc_free(subdom_conf_path);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE,

+              "Failed to inherit option [%s] to sub-domain [%s]. "

+              "This error is ignored but might cause issues or unexpected "

+              "behavior later on.\n",

+              id_ctx->ipa_options->id->basic[SDAP_SASL_MECH].opt_name,

+              subdom->name);

+

+        return NULL;

+    }

+

     return ad_options;

 }

-- 

2.20.1