|
 |
e543c9 |
From bea6b6c6bcf711e0d96a4263f60e0e1b0a64c45f Mon Sep 17 00:00:00 2001
|
|
|
e543c9 |
From: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
e543c9 |
Date: Mon, 13 Apr 2015 09:50:29 +0200
|
|
|
e543c9 |
Subject: [PATCH 200/200] SDAP: Filter ad groups in initgroups
|
|
|
e543c9 |
|
|
|
e543c9 |
Function sdap_add_incomplete_groups stored domain local groups
|
|
|
e543c9 |
from subdomain as POSIX group, which should not be done.
|
|
|
e543c9 |
|
|
|
e543c9 |
Resolves:
|
|
|
e543c9 |
https://fedorahosted.org/sssd/ticket/2614
|
|
|
e543c9 |
|
|
|
e543c9 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
e543c9 |
(cherry picked from commit b9fbeb75e7a4f50f98d979a70a710f9221892483)
|
|
|
e543c9 |
---
|
|
|
e543c9 |
src/providers/ldap/sdap_async_initgroups.c | 12 ++++++++++++
|
|
|
e543c9 |
1 file changed, 12 insertions(+)
|
|
|
e543c9 |
|
|
|
e543c9 |
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
|
|
|
e543c9 |
index bc6b5e45e6a7f7dc0c482a6bbbf2aa602371a647..43b72fe2051b452c6ea755c8842117cceafa143a 100644
|
|
|
e543c9 |
--- a/src/providers/ldap/sdap_async_initgroups.c
|
|
|
e543c9 |
+++ b/src/providers/ldap/sdap_async_initgroups.c
|
|
|
e543c9 |
@@ -51,6 +51,7 @@ errno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
|
|
|
e543c9 |
time_t now;
|
|
|
e543c9 |
char *sid_str = NULL;
|
|
|
e543c9 |
bool use_id_mapping;
|
|
|
e543c9 |
+ bool need_filter;
|
|
|
e543c9 |
char *tmp_name;
|
|
|
e543c9 |
|
|
|
e543c9 |
/* There are no groups in LDAP but we should add user to groups ?? */
|
|
|
e543c9 |
@@ -205,6 +206,17 @@ errno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
|
|
|
e543c9 |
uuid = NULL;
|
|
|
e543c9 |
}
|
|
|
e543c9 |
|
|
|
e543c9 |
+ ret = sdap_check_ad_group_type(domain, opts, ldap_groups[ai],
|
|
|
e543c9 |
+ groupname, &need_filter);
|
|
|
e543c9 |
+ if (ret != EOK) {
|
|
|
e543c9 |
+ goto done;
|
|
|
e543c9 |
+ }
|
|
|
e543c9 |
+
|
|
|
e543c9 |
+ if (need_filter) {
|
|
|
e543c9 |
+ posix = false;
|
|
|
e543c9 |
+ gid = 0;
|
|
|
e543c9 |
+ }
|
|
|
e543c9 |
+
|
|
|
e543c9 |
DEBUG(SSSDBG_TRACE_INTERNAL,
|
|
|
e543c9 |
"Adding fake group %s to sysdb\n", groupname);
|
|
|
e543c9 |
ret = sysdb_add_incomplete_group(domain, groupname, gid,
|
|
|
e543c9 |
--
|
|
|
e543c9 |
2.1.0
|
|
|
e543c9 |
|