|
 |
ecf709 |
From 4a3f3c675e360c888da7d23ab6ec4cca10876b08 Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ecf709 |
Date: Thu, 27 Apr 2017 09:28:55 +0200
|
|
|
ecf709 |
Subject: [PATCH 118/118] overrides: add certificates to mapped attribute
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
Certificates in overrides are explicitly used to map users to
|
|
|
ecf709 |
certificates, so we add them to SYSDB_USER_MAPPED_CERT as well.
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves https://pagure.io/SSSD/sssd/issue/3373
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit 2e5fc89ef25434fab7febe2c52e97ef989b50d5b)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/db/sysdb_views.c | 41 +++++++++++++++++++++++++++++++++++++++++
|
|
|
ecf709 |
1 file changed, 41 insertions(+)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/db/sysdb_views.c b/src/db/sysdb_views.c
|
|
|
ecf709 |
index 20db9b06183d68b33bb19f498513d7f5cf84b1cf..3773dda77e16b35fa217be0aa7974da7e34c09f4 100644
|
|
|
ecf709 |
--- a/src/db/sysdb_views.c
|
|
|
ecf709 |
+++ b/src/db/sysdb_views.c
|
|
|
ecf709 |
@@ -777,6 +777,7 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
|
|
|
ecf709 |
int ret;
|
|
|
ecf709 |
TALLOC_CTX *tmp_ctx;
|
|
|
ecf709 |
struct sysdb_attrs *attrs;
|
|
|
ecf709 |
+ struct sysdb_attrs *mapped_attrs = NULL;
|
|
|
ecf709 |
size_t c;
|
|
|
ecf709 |
size_t d;
|
|
|
ecf709 |
size_t num_values;
|
|
|
ecf709 |
@@ -791,6 +792,7 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
|
|
|
ecf709 |
SYSDB_USER_CERT,
|
|
|
ecf709 |
NULL };
|
|
|
ecf709 |
bool override_attrs_found = false;
|
|
|
ecf709 |
+ bool is_cert = false;
|
|
|
ecf709 |
|
|
|
ecf709 |
if (override_attrs == NULL) {
|
|
|
ecf709 |
/* nothing to do */
|
|
|
ecf709 |
@@ -846,6 +848,24 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
|
|
|
ecf709 |
num_values = 1;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
+ is_cert = false;
|
|
|
ecf709 |
+ if (strcmp(allowed_attrs[c], SYSDB_USER_CERT) == 0) {
|
|
|
ecf709 |
+ /* Certificates in overrides are explicitly used to map
|
|
|
ecf709 |
+ * users to certificates, so we add them to
|
|
|
ecf709 |
+ * SYSDB_USER_MAPPED_CERT as well. */
|
|
|
ecf709 |
+ is_cert = true;
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ if (mapped_attrs == NULL) {
|
|
|
ecf709 |
+ mapped_attrs = sysdb_new_attrs(tmp_ctx);
|
|
|
ecf709 |
+ if (mapped_attrs == NULL) {
|
|
|
ecf709 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ecf709 |
+ "sysdb_new_attrs failed.\n");
|
|
|
ecf709 |
+ ret = ENOMEM;
|
|
|
ecf709 |
+ goto done;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
for (d = 0; d < num_values; d++) {
|
|
|
ecf709 |
ret = sysdb_attrs_add_val(attrs, allowed_attrs[c],
|
|
|
ecf709 |
&el->values[d]);
|
|
|
ecf709 |
@@ -854,6 +874,18 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
|
|
|
ecf709 |
"sysdb_attrs_add_val failed.\n");
|
|
|
ecf709 |
goto done;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ if (is_cert) {
|
|
|
ecf709 |
+ ret = sysdb_attrs_add_val(mapped_attrs,
|
|
|
ecf709 |
+ SYSDB_USER_MAPPED_CERT,
|
|
|
ecf709 |
+ &el->values[d]);
|
|
|
ecf709 |
+ if (ret != EOK) {
|
|
|
ecf709 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ecf709 |
+ "sysdb_attrs_add_val failed.\n");
|
|
|
ecf709 |
+ goto done;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
DEBUG(SSSDBG_TRACE_ALL,
|
|
|
ecf709 |
"Override [%s] with [%.*s] for [%s].\n",
|
|
|
ecf709 |
allowed_attrs[c], (int) el->values[d].length,
|
|
|
ecf709 |
@@ -878,6 +910,15 @@ errno_t sysdb_apply_default_override(struct sss_domain_info *domain,
|
|
|
ecf709 |
DEBUG(SSSDBG_OP_FAILURE, "sysdb_set_entry_attr failed.\n");
|
|
|
ecf709 |
goto done;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ if (mapped_attrs != NULL) {
|
|
|
ecf709 |
+ ret = sysdb_set_entry_attr(domain->sysdb, obj_dn, mapped_attrs,
|
|
|
ecf709 |
+ SYSDB_MOD_ADD);
|
|
|
ecf709 |
+ if (ret != EOK) {
|
|
|
ecf709 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ecf709 |
+ "sysdb_set_entry_attr failed, ignored.\n");
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
ret = EOK;
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.3
|
|
|
ecf709 |
|