|
 |
dc8c34 |
From 81f26a33df3c5f369097d673edfe52535ce77cc4 Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
dc8c34 |
Date: Tue, 20 Aug 2013 14:09:26 -0700
|
|
|
dc8c34 |
Subject: [PATCH] Ticket #47488 - Users from AD sub OU does not sync to IPA
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Bug description: When processing a DN from AD, the DN is passed to
|
|
|
dc8c34 |
a helper function is_subject_of_agreement_remote (windows_protocol_
|
|
|
dc8c34 |
util.c) to check if the DN is a subject of the sync service or not.
|
|
|
dc8c34 |
The helper function was checking if the AD DN is just one-level
|
|
|
dc8c34 |
child of the agreement subtree top (nsds7WindowsReplicaSubtree) but
|
|
|
dc8c34 |
not the subtree-level descendents. Note: the DN is an original one
|
|
|
dc8c34 |
in AD, which has not be flattened yet. Therefore, the AD entry was
|
|
|
dc8c34 |
determined not to be synchronized.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Fix description: This bug was fixed in the master tree with the
|
|
|
dc8c34 |
ticket #521 - modrdn + NSMMReplicationPlugin - Consumer failed to
|
|
|
dc8c34 |
replay change.
|
|
|
dc8c34 |
3) is_subject_of_agreement_remote (windows_protocol_util.c):
|
|
|
dc8c34 |
When checking if the entry was in the subtree defined in the
|
|
|
dc8c34 |
agreement or not, it returned true only if the entry is a
|
|
|
dc8c34 |
direct child of the agreement subtree top. This patch returns
|
|
|
dc8c34 |
true if the entry is the further descendent of the subtree.
|
|
|
dc8c34 |
The fix is back ported to 389-ds-base-1.3.1 branch.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Reviewed by Rich (Thank you!!)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/47488
|
|
|
dc8c34 |
(cherry picked from commit 529a544a2fe9961d9286e191346fb5faca27d38b)
|
|
|
dc8c34 |
(cherry picked from commit 26c669dcad15f9dbbfdff6fbeffac579099b7718)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/plugins/replication/windows_protocol_util.c | 10 ++++++++--
|
|
|
dc8c34 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
|
|
|
dc8c34 |
index 0b3c575..75cb935 100644
|
|
|
dc8c34 |
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
|
|
|
dc8c34 |
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
|
|
|
dc8c34 |
@@ -3891,7 +3891,12 @@ error:
|
|
|
dc8c34 |
return retval;
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
|
|
|
dc8c34 |
-/* Tests if the entry is subject to our agreement (i.e. is it in the sync'ed subtree in AD and either a user or a group ?) */
|
|
|
dc8c34 |
+/*
|
|
|
dc8c34 |
+ * Tests if the entry is subject to our agreement
|
|
|
dc8c34 |
+ * (i.e. is it in the sync'ed subtree in AD and either a user or a group ?)
|
|
|
dc8c34 |
+ * return value: 1 -- it is subject to the agreement
|
|
|
dc8c34 |
+ * 0 -- out of scope
|
|
|
dc8c34 |
+ */
|
|
|
dc8c34 |
static int
|
|
|
dc8c34 |
is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
|
|
|
dc8c34 |
{
|
|
|
dc8c34 |
@@ -3922,7 +3927,8 @@ is_subject_of_agreement_remote(Slapi_Entry *e, const Repl_Agmt *ra)
|
|
|
dc8c34 |
* 'e' as out of scope.
|
|
|
dc8c34 |
*/
|
|
|
dc8c34 |
slapi_sdn_get_parent(sdn, &psdn);
|
|
|
dc8c34 |
- if (0 == slapi_sdn_compare(&psdn, agreement_subtree)) {
|
|
|
dc8c34 |
+ if (slapi_sdn_issuffix(&psdn, agreement_subtree)) {
|
|
|
dc8c34 |
+ /* parent is in agreement_subtree. */
|
|
|
dc8c34 |
retval = 1;
|
|
|
dc8c34 |
} else {
|
|
|
dc8c34 |
/* If parent entry is not local, the entry is out of scope */
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
1.8.1.4
|
|
|
dc8c34 |
|