From 54431eb9e2438a838904a6d4846c45131b937cd0 Mon Sep 17 00:00:00 2001
From: Ken Rossato <ken.rossato@redhat.com>
Date: Mon, 24 Sep 2012 19:52:09 -0400
Subject: [PATCH 4/5] Ticket #481 - expand nested posix groups
Description: Add ability to populate memberuid dynamically to
reflect nested grouping.
(cherry picked from commit b9eeb2e1a8e688dfec753e8965d0e5aeb119e638)
---
Makefile.am | 1 +
Makefile.in | 1 +
ldap/ldif/50posix-winsync-plugin.ldif | 1 +
ldap/schema/60posix-winsync-plugin.ldif | 44 +
.../plugins/posix-winsync/posix-group-func.c | 846 ++++++++++++++++----
.../plugins/posix-winsync/posix-group-task.c | 249 +++++--
.../plugins/posix-winsync/posix-winsync-config.c | 16 +
ldap/servers/plugins/posix-winsync/posix-winsync.c | 72 ++-
.../plugins/posix-winsync/posix-wsp-ident.h | 4 +-
9 files changed, 1008 insertions(+), 226 deletions(-)
create mode 100644 ldap/schema/60posix-winsync-plugin.ldif
diff --git a/Makefile.am b/Makefile.am
index c5c4080..507a2d6 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -299,6 +299,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \
$(srcdir)/ldap/schema/50ns-value.ldif \
$(srcdir)/ldap/schema/50ns-web.ldif \
$(srcdir)/ldap/schema/60pam-plugin.ldif \
+ $(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \
$(srcdir)/ldap/schema/60autofs.ldif \
$(srcdir)/ldap/schema/60eduperson.ldif \
$(srcdir)/ldap/schema/60mozilla.ldif \
diff --git a/Makefile.in b/Makefile.in
index 3777829..f105932 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1527,6 +1527,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \
$(srcdir)/ldap/schema/50ns-value.ldif \
$(srcdir)/ldap/schema/50ns-web.ldif \
$(srcdir)/ldap/schema/60pam-plugin.ldif \
+ $(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \
$(srcdir)/ldap/schema/60autofs.ldif \
$(srcdir)/ldap/schema/60eduperson.ldif \
$(srcdir)/ldap/schema/60mozilla.ldif \
diff --git a/ldap/ldif/50posix-winsync-plugin.ldif b/ldap/ldif/50posix-winsync-plugin.ldif
index de8c432..17dc243 100644
--- a/ldap/ldif/50posix-winsync-plugin.ldif
+++ b/ldap/ldif/50posix-winsync-plugin.ldif
@@ -10,6 +10,7 @@ nsslapd-pluginenabled: off
nsslapd-plugin-depends-on-type: database
posixWinsyncMsSFUSchema: false
posixWinsyncMapMemberUID: true
+posixWinsyncMapNestedGrouping: false
posixWinsyncCreateMemberOfTask: false
posixWinsyncLowerCaseUID: false
nsslapd-pluginprecedence: 25
diff --git a/ldap/schema/60posix-winsync-plugin.ldif b/ldap/schema/60posix-winsync-plugin.ldif
new file mode 100644
index 0000000..8d9a72e
--- /dev/null
+++ b/ldap/schema/60posix-winsync-plugin.ldif
@@ -0,0 +1,44 @@
+#
+# BEGIN COPYRIGHT BLOCK
+# This Program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation; version 2 of the License.
+#
+# This Program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+# Place, Suite 330, Boston, MA 02111-1307 USA.
+#
+# In addition, as a special exception, Red Hat, Inc. gives You the additional
+# right to link the code of this Program with code not covered under the GNU
+# General Public License ("Non-GPL Code") and to distribute linked combinations
+# including the two, subject to the limitations in this paragraph. Non-GPL Code
+# permitted under this exception must only link to the code of this Program
+# through those well defined interfaces identified in the file named EXCEPTION
+# found in the source code files (the "Approved Interfaces"). The files of
+# Non-GPL Code may instantiate templates or use macros or inline functions from
+# the Approved Interfaces without causing the resulting work to be covered by
+# the GNU General Public License. Only Red Hat, Inc. may make changes or
+# additions to the list of Approved Interfaces. You must obey the GNU General
+# Public License in all respects for all of the Program code and other code used
+# in conjunction with the Program except the Non-GPL Code covered by this
+# exception. If you modify this file, you may extend this exception to your
+# version of the file, but you are not obligated to do so. If you do not wish to
+# provide this exception without modification, you must delete this exception
+# statement from your version and license this file solely under the GPL without
+# exception.
+#
+#
+# Copyright (C) 2005 Red Hat, Inc.
+# All rights reserved.
+# END COPYRIGHT BLOCK
+#
+#
+# Schema for representing internal dynamically-generated group members
+#
+dn: cn=schema
+attributeTypes: ( 2.16.840.1.113730.3.1.2141 NAME 'dsOnlyMemberUid' DESC 'Elements from a memberuid attribute created to reflect dynamic group membership' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Red Hat Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.326 NAME 'dynamicGroup' DESC 'Group containing internal dynamically-generated members' SUP posixGroup AUXILIARY MAY ( dsOnlyMemberUid ) X-ORIGIN 'Red Hat Directory Server' )
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c
index 1403a89..66b9272 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-func.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c
@@ -18,11 +18,14 @@
$Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $
*/
#include "slapi-plugin.h"
+#include "slapi-private.h"
#include <string.h>
#include <nspr.h>
#include "posix-wsp-ident.h"
+#define MAX_RECURSION_DEPTH (5)
+
Slapi_Value **
valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
static PRMonitor *memberuid_operation_lock = 0;
@@ -45,58 +48,100 @@ memberUidLockInit()
return (memberuid_operation_lock = PR_NewMonitor()) != NULL;
}
+void
+addDynamicGroupIfNecessary(Slapi_Entry *entry, Slapi_Mods *smods) {
+ Slapi_Attr *oc_attr = NULL;
+ Slapi_Value *voc = slapi_value_new();
+
+ slapi_value_init_string(voc, "dynamicGroup");
+ slapi_entry_attr_find(entry, "objectClass", &oc_attr);
+
+ if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
+ if (smods) {
+ slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");
+ }
+ else {
+ smods = slapi_mods_new();
+ slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup");
+
+ Slapi_PBlock *mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,
+ posix_winsync_get_plugin_identity(), 0);
+ slapi_modify_internal_pb(mod_pb);
+ slapi_pblock_destroy(mod_pb);
+
+ slapi_mods_free(&smods);
+ }
+ }
+
+ slapi_value_free(&voc);
+}
+
+Slapi_Entry *
+getEntry(const char *udn, char **attrs)
+{
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "getEntry: search %s\n", udn);
+
+ Slapi_DN *udn_sdn = slapi_sdn_new_dn_byval(udn);
+ Slapi_Entry *result = NULL;
+ int rc = slapi_search_internal_get_entry(udn_sdn, attrs, &result, posix_winsync_get_plugin_identity());
+ slapi_sdn_free(&udn_sdn);
+
+ if (rc == 0) {
+ if (result != NULL) {
+ return result; /* Must be freed */
+ }
+ else {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getEntry: %s not found\n", udn);
+ }
+ }
+ else {
+ slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
+ "getEntry: error searching for uid: %d", rc);
+ }
+
+ return NULL;
+}
+
/* search the user with DN udn and returns uid*/
char *
searchUid(const char *udn)
{
- Slapi_PBlock *int_search_pb = slapi_pblock_new();
- Slapi_Entry **entries = NULL;
- char *attrs[] = { "uid", NULL };
+ char *attrs[] = { "uid", "objectclass", NULL };
+ Slapi_Entry *entry = getEntry(udn,
+ /* "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", */
+ attrs);
char *uid = NULL;
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search Uid: search %s\n", udn);
+ if (entry) {
+ Slapi_Attr *attr = NULL;
+ Slapi_Value *v = NULL;
- slapi_search_internal_set_pb(int_search_pb, udn, LDAP_SCOPE_BASE,
- "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", attrs,
- 0 /* attrsonly */, NULL /* controls */, NULL /* uniqueid */,
- posix_winsync_get_plugin_identity(), 0 /* actions */);
- if (slapi_search_internal_pb(int_search_pb)) {
- /* get result and log an error */
- int res = 0;
- slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_RESULT, &res);
- slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
- "searchUid: error searching for uid: %d", res);
- } else {
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "searchUid: searched %s\n",
- udn);
- slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
- if (NULL != entries && NULL != entries[0]) {
- Slapi_Attr *attr = NULL;
- Slapi_Value *v = NULL;
+ if (slapi_entry_attr_find(entry, "uid", &attr) == 0 && hasObjectClass(entry, "posixAccount")) {
+ slapi_attr_first_value(attr, &v);
+ uid = slapi_ch_strdup(slapi_value_get_string(v));
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "searchUid: return uid %s\n", uid);
+ } else {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "searchUid: uid in %s not found\n", udn);
+ }
- if (slapi_entry_attr_find(entries[0], "uid", &attr) == 0) {
- slapi_attr_first_value(attr, &v);
- uid = slapi_ch_strdup(slapi_value_get_string(v));
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "searchUid: return uid %s\n", uid);
- /* slapi_value_free(&v); */
- } else {
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "searchUid: uid in %s not found\n", udn);
- }
- slapi_free_search_results_internal(int_search_pb);
- slapi_pblock_destroy(int_search_pb);
- if (uid && posix_winsync_config_get_lowercase()) {
- return slapi_dn_ignore_case(uid);
- }
- return uid;
+ if (uid && posix_winsync_config_get_lowercase()) {
+ uid = slapi_dn_ignore_case(uid);
}
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "searchUid: About to free entry\n", udn);
+
+ slapi_entry_free(entry);
}
- slapi_free_search_results_internal(int_search_pb);
- slapi_pblock_destroy(int_search_pb);
+
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "searchUid: posix user %s not found\n", udn);
- return NULL;
+ "searchUid: <==\n", udn);
+
+ return uid;
}
int
@@ -152,6 +197,36 @@ uid_in_set(const char* uid, char **uids)
return false;
}
+int
+uid_in_valueset(const char* uid, Slapi_ValueSet *uids)
+{
+ int i;
+ Slapi_Value *v = NULL;
+
+ if (uid == NULL)
+ return false;
+ for (i = slapi_valueset_first_value(uids, &v); i != -1;
+ i = slapi_valueset_next_value(uids, i, &v)) {
+ Slapi_RDN *i_rdn = NULL;
+ char *i_uid = NULL;
+ char *t = NULL;
+
+ const char *uid_i = slapi_value_get_string(v);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "uid_in_valueset: comp %s %s \n",
+ uid, uid_i);
+ i_rdn = slapi_rdn_new_dn(uid_i);
+ if (slapi_rdn_get_first(i_rdn, &t, &i_uid) == 1) {
+ if (strncasecmp(uid, i_uid, 256) == 0) {
+ slapi_rdn_free(&i_rdn);
+ return true;
+ }
+ }
+ slapi_rdn_free(&i_rdn);
+ }
+ return false;
+}
+
/* return 1 if smods already has the given mod - 0 otherwise */
static int
smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)
@@ -186,7 +261,7 @@ smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val)
}
int
-isPosixGroup(Slapi_Entry *entry)
+hasObjectClass(Slapi_Entry *entry, const char *objectClass)
{
int rc = 0;
int i;
@@ -200,7 +275,7 @@ isPosixGroup(Slapi_Entry *entry)
}
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "add/mod-GroupMembership scan objectclasses\n");
+ "Scanning objectclasses\n");
for (
i = slapi_attr_first_value(obj_attr, &value);
@@ -209,22 +284,357 @@ isPosixGroup(Slapi_Entry *entry)
) {
const char *oc = NULL;
oc = slapi_value_get_string(value);
- if (strncasecmp(oc, "posixGroup", 11) == 0) {
- return 1; /* Entry has objectclass posixGroup */
+ if (strcasecmp(oc, objectClass) == 0) {
+ return 1; /* Entry has the desired objectclass */
+ }
+ }
+
+ return 0; /* Doesn't have desired objectclass */
+}
+
+void
+posix_winsync_foreach_parent(Slapi_Entry *entry, char **attrs, plugin_search_entry_callback callback, void *callback_data)
+{
+ char *cookie = NULL;
+ Slapi_Backend *be = NULL;
+
+ const char *value = slapi_entry_get_ndn(entry);
+ size_t vallen = value ? strlen(value) : 0;
+ char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1);
+ char *filter = slapi_ch_smprintf("(uniqueMember=%s)", escape_filter_value(value, vallen, filter_escaped_value));
+ slapi_ch_free_string(&filter_escaped_value);
+
+ Slapi_PBlock *search_pb = slapi_pblock_new();
+
+ for (be = slapi_get_first_backend(&cookie); be;
+ be = slapi_get_next_backend(cookie)) {
+ const Slapi_DN *base_sdn = slapi_be_getsuffix(be, 0);
+ if (base_sdn == NULL) {
+ continue;
}
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_winsync_foreach_parent: Searching subtree %s for %s\n",
+ slapi_sdn_get_dn(base_sdn),
+ filter);
+
+ slapi_search_internal_set_pb(search_pb,
+ slapi_sdn_get_dn(base_sdn),
+ LDAP_SCOPE_SUBTREE,
+ filter,
+ attrs, 0, NULL, NULL,
+ posix_winsync_get_plugin_identity(), 0);
+ slapi_search_internal_callback_pb(search_pb, callback_data, 0, callback, 0);
+
+ slapi_pblock_init(search_pb);
}
- return 0; /* Doesn't have objectclass "posixGroup" */
+ slapi_pblock_destroy(search_pb);
+ slapi_ch_free((void**)&cookie);
+ slapi_ch_free_string(&filter);
}
-int
-modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
+/* Retrieve nested membership from chains of groups.
+ * Muid_vs in => any preexisting membership list
+ * out => the union of the input list and the total membership
+ * Muid_nested_vs out => the members of muid_vs "out" that weren't in muid_vs "in"
+ * deletions in => Any elements to NOT consider if members of base_sdn
+ */
+void
+getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, Slapi_ValueSet *muid_nested_vs, Slapi_ValueSet *deletions, const Slapi_DN *base_sdn, int depth)
{
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: ==>\n");
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: entry name: %s\n",
+ slapi_entry_get_dn_const(entry));
+
int rc = 0;
+ Slapi_Attr *um_attr = NULL; /* Entry attributes uniqueMember */
+ Slapi_Value *uid_value = NULL; /* uniqueMember attribute values */
+
+ if (depth >= MAX_RECURSION_DEPTH) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: recursion limit reached: %d\n", depth);
+ return;
+ }
+
+ rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr);
+ if (rc != 0 || um_attr == NULL) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward end: attribute uniquemember not found\n");
+ return;
+ }
+
+ int i;
+ for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
+ i = slapi_attr_next_value(um_attr, i, &uid_value)) {
+
+ char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL };
+ const char *uid_dn = slapi_value_get_string(uid_value);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: iterating uniqueMember: %s\n",
+ uid_dn);
+
+ if (deletions && !slapi_sdn_compare(slapi_entry_get_sdn_const(entry), base_sdn)) {
+ if (slapi_valueset_find(um_attr, deletions, uid_value)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: Skipping iteration because of deletion\n");
+
+ continue;
+ }
+ }
+
+ Slapi_Entry *child = getEntry(uid_dn, attrs);
+
+ if (!child) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward end: child not found: %s\n", uid_dn);
+ }
+ else {
+ /* PosixGroups except for the top one are already fully mapped out */
+ if ((!hasObjectClass(entry, "posixGroup") || depth == 0) &&
+ (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup"))) {
+
+ /* Recurse downward */
+ getMembershipFromDownward(child, muid_vs, muid_nested_vs, deletions, base_sdn, depth + 1);
+ }
+
+ if (hasObjectClass(child, "posixAccount")) {
+ Slapi_Attr *uid_attr = NULL;
+ Slapi_Value *v = NULL;
+ if (slapi_entry_attr_find(child, "uid", &uid_attr) == 0) {
+ slapi_attr_first_value(uid_attr, &v);
+
+ if (v && !slapi_valueset_find(uid_attr, muid_vs, v)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: adding member: %s\n",
+ slapi_value_get_string(v));
+ slapi_valueset_add_value(muid_vs, v);
+ slapi_valueset_add_value(muid_nested_vs, v);
+ }
+ }
+ }
+ slapi_entry_free(child);
+ }
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "getMembershipFromDownward: <==\n");
+}
+
+struct propogateMembershipUpwardArgs {
+ Slapi_ValueSet *muid_vs;
+ int depth;
+};
+
+/* Forward declaration for next function */
+void propogateMembershipUpward(Slapi_Entry *, Slapi_ValueSet *, int);
+
+int
+propogateMembershipUpwardCallback(Slapi_Entry *child, void *callback_data)
+{
+ struct propogateMembershipUpwardArgs *args = (struct propogateMembershipUpwardArgs *)(callback_data);
+ propogateMembershipUpward(child, args->muid_vs, args->depth);
+ return 0;
+}
+
+void
+propogateMembershipUpward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, int depth)
+{
+ if (depth >= MAX_RECURSION_DEPTH) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: recursion limit reached: %d\n", depth);
+ return;
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: ==>\n");
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: entry name: %s\n",
+ slapi_entry_get_dn_const(entry));
+
+ Slapi_ValueSet *muid_here_vs = NULL;
+ Slapi_ValueSet *muid_upward_vs = NULL;
+
+ /* Get the memberUids at this location, and figure out local changes to memberUid (if any)
+ * and changes to send upward.
+ */
+ if (depth > 0 && hasObjectClass(entry, "posixGroup")) {
+ int addDynamicGroup = 0;
+ Slapi_Attr *muid_old_attr = NULL;
+ Slapi_ValueSet *muid_old_vs = NULL;
+ int rc = slapi_entry_attr_find(entry, "memberUid", &muid_old_attr);
+ if (rc != 0 || muid_old_attr == NULL) { /* Found no memberUid list, so create */
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: no attribute memberUid\n");
+
+ /* There's no values from this entry to add */
+ muid_upward_vs = muid_vs;
+ muid_here_vs = muid_vs;
+ }
+ else {
+ /* Eliminate duplicates */
+ muid_upward_vs = slapi_valueset_new();
+ muid_here_vs = slapi_valueset_new();
+
+ slapi_valueset_set_valueset(muid_upward_vs, muid_old_vs);
+
+ slapi_attr_get_valueset(muid_old_attr, &muid_old_vs);
+ int i = 0;
+ Slapi_Value *v = NULL;
+ for (i = slapi_valueset_first_value(muid_vs, &v); i != -1;
+ i = slapi_valueset_next_value(muid_vs, i, &v)) {
+
+ if (!slapi_valueset_find(muid_old_attr, muid_old_vs, v)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: adding %s to set\n",
+ slapi_value_get_string(v));
+
+ addDynamicGroup = 1;
+ slapi_valueset_add_value(muid_here_vs, v);
+ slapi_valueset_add_value(muid_upward_vs, v);
+ }
+ }
+ }
+
+ /* Update this group's membership */
+ slapi_entry_add_valueset(entry, "memberUid", muid_here_vs);
+ if (addDynamicGroup) {
+ addDynamicGroupIfNecessary(entry, NULL);
+ slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_here_vs);
+ }
+ }
+ else {
+ muid_upward_vs = muid_vs;
+ }
+
+ /* Find groups containing this one, recurse
+ */
+ char *attrs[] = {"memberUid", "objectClass", NULL};
+ struct propogateMembershipUpwardArgs data = {muid_upward_vs, depth + 1};
+
+ posix_winsync_foreach_parent(entry, attrs, propogateMembershipUpwardCallback, &data);
+
+/* Cleanup */
+ if (muid_here_vs && muid_here_vs != muid_vs) {
+ slapi_valueset_free(muid_here_vs); muid_here_vs = NULL;
+ }
+ if (muid_upward_vs && muid_upward_vs != muid_vs) {
+ slapi_valueset_free(muid_upward_vs); muid_upward_vs = NULL;
+ }
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateMembershipUpward: <==\n");
+}
+
+struct propogateDeletionsUpwardArgs {
+ const Slapi_DN *base_sdn;
+ Slapi_ValueSet *smod_deluids;
+ Slapi_ValueSet *del_nested_vs;
+ int depth;
+};
+
+/* Forward declaration for next function */
+void propogateDeletionsUpward(Slapi_Entry *, const Slapi_DN *, Slapi_ValueSet*, Slapi_ValueSet *, int);
+
+int
+propogateDeletionsUpwardCallback(Slapi_Entry *entry, void *callback_data)
+{
+ struct propogateDeletionsUpwardArgs *args = (struct propogateDeletionsUpwardArgs *)(callback_data);
+ propogateDeletionsUpward(entry, args->base_sdn, args->smod_deluids, args->del_nested_vs, args->depth);
+}
+
+void
+propogateDeletionsUpward(Slapi_Entry *entry, const Slapi_DN *base_sdn, Slapi_ValueSet *smod_deluids, Slapi_ValueSet *del_nested_vs, int depth)
+{
+ if (smod_deluids == NULL) return;
+
+ if (depth >= MAX_RECURSION_DEPTH) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: recursion limit reached: %d\n", depth);
+ return;
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: ==>\n");
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: entry name: %s\n",
+ slapi_entry_get_dn_const(entry));
+
+ char *attrs[] = { "uniqueMember", "memberUid", "objectClass", NULL };
+ struct propogateDeletionsUpwardArgs data = {base_sdn, smod_deluids, del_nested_vs, depth + 1};
+ posix_winsync_foreach_parent(entry, attrs, propogateDeletionsUpwardCallback, &data);
+
+ Slapi_Attr *muid_attr = NULL;
+ int rc = slapi_entry_attr_find(entry, "dsOnlyMemberUid", &muid_attr);
+
+ if (rc == 0 && muid_attr != NULL) {
+
+ Slapi_ValueSet *muid_vs = slapi_valueset_new();
+ Slapi_ValueSet *muid_nested_vs = slapi_valueset_new();
+ Slapi_ValueSet *muid_deletions_vs = slapi_valueset_new();
+
+ getMembershipFromDownward(entry, muid_vs, muid_nested_vs, smod_deluids, base_sdn, 0);
+
+ int i;
+ Slapi_Value *v;
+ for (i = slapi_attr_first_value(muid_attr, &v); i != -1;
+ i = slapi_attr_next_value(muid_attr, i, &v)) {
+ if (!slapi_valueset_find(muid_attr, muid_vs, v)) {
+ const char *uid = slapi_value_get_string(v);
+ if (depth == 0 && !uid_in_valueset(uid, smod_deluids)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: Adding deletion to modlist: %s\n",
+ slapi_value_get_string(v));
+ slapi_valueset_add_value(del_nested_vs, v);
+ }
+ else if (depth > 0) {
+ slapi_valueset_add_value(muid_deletions_vs, v);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: Adding deletion to deletion list: %s\n",
+ slapi_value_get_string(v));
+ }
+ }
+ }
+
+ if (depth > 0) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: executing deletion list\n");
+
+ Slapi_Mods *smods = slapi_mods_new();
+ slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "memberuid", valueset_get_valuearray(muid_deletions_vs));
+ slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "dsonlymemberuid", valueset_get_valuearray(muid_deletions_vs));
+
+ Slapi_PBlock *mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0,
+ posix_winsync_get_plugin_identity(), 0);
+ slapi_modify_internal_pb(mod_pb);
+ slapi_pblock_destroy(mod_pb);
+
+ slapi_mods_free(&smods);
+ }
+
+ slapi_valueset_free(muid_vs); muid_vs = NULL;
+ slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL;
+ slapi_valueset_free(muid_deletions_vs); muid_deletions_vs = NULL;
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "propogateDeletionsUpward: <==\n");
+}
+
+int
+modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
+{
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: ==>\n");
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: Modding %s\n",
+ slapi_entry_get_dn_const(entry));
- if (!isPosixGroup(entry)) {
+ int posixGroup = hasObjectClass(entry, "posixGroup");
+
+ if (!(posixGroup || hasObjectClass(entry, "ntGroup"))) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "modGroupMembership end: Not a posixGroup or ntGroup\n");
return 0;
}
@@ -232,7 +642,7 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
Slapi_Mod *nextMod = slapi_mod_new();
int del_mod = 0; /* Bool: was there a delete mod? */
char **smod_adduids = NULL;
- char **smod_deluids = NULL;
+ Slapi_ValueSet *smod_deluids = NULL;
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership: posixGroup -> look for uniquemember\n");
@@ -243,15 +653,20 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
if (slapi_attr_types_equivalent(slapi_mod_get_type(smod), "uniqueMember")) {
struct berval *bv;
+ int current_del_mod = SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod));
+ if (current_del_mod) {
+ del_mod = 1;
+ }
+
for (bv = slapi_mod_get_first_value(smod); bv;
bv = slapi_mod_get_next_value(smod)) {
Slapi_Value *sv = slapi_value_new();
slapi_value_init_berval(sv, bv); /* copies bv_val */
- if (SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod))) {
- del_mod = 1;
- slapi_ch_array_add(&smod_deluids,
- slapi_ch_strdup(slapi_value_get_string(sv)));
+ if (current_del_mod) {
+ if (!smod_deluids) smod_deluids = slapi_valueset_new();
+
+ slapi_valueset_add_value(smod_deluids, sv);
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership: add to deluids %s\n",
bv->bv_val);
@@ -268,60 +683,67 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
}
slapi_mod_free(&nextMod);
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: entry is posixGroup\n");
-
- Slapi_Attr * muid_attr = NULL; /* Entry attributes */
+ int muid_rc = 0;
+ Slapi_Attr * muid_attr = NULL; /* Entry attributes */
+ Slapi_ValueSet *muid_vs = NULL;
Slapi_Value * uid_value = NULL; /* Attribute values */
- char **adduids = NULL;
- char **moduids = NULL;
- char **deluids = NULL;
- int doModify = false;
+ Slapi_ValueSet *adduids = slapi_valueset_new();
+ Slapi_ValueSet *add_nested_vs = slapi_valueset_new();
+ Slapi_ValueSet *deluids = slapi_valueset_new();
+ Slapi_ValueSet *del_nested_vs = slapi_valueset_new();
+
+ const Slapi_DN *base_sdn = slapi_entry_get_sdn_const(entry);
+
int j = 0;
if (del_mod || smod_deluids != NULL) {
do { /* Create a context to "break" from */
- Slapi_Attr * mu_attr = NULL; /* Entry attributes */
- rc = slapi_entry_attr_find(entry, "memberUid", &mu_attr);
- if (rc != 0 || mu_attr == NULL) {
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership end: attribute memberUid not found\n");
- break;
- }
- /* found attribute uniquemember */
+ muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr);
+
if (smod_deluids == NULL) { /* deletion of the last value, deletes the Attribut from entry complete, this operation has no value, so we must look by self */
Slapi_Attr * um_attr = NULL; /* Entry attributes */
Slapi_Value * uid_dn_value = NULL; /* Attribute values */
int rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr);
+
if (rc != 0 || um_attr == NULL) {
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership end: attribute uniquemember not found\n");
break;
}
- /* found attribute uniquemember */
- /* ...loop for value... */
- for (j = slapi_attr_first_value(um_attr, &uid_dn_value); j != -1;
- j = slapi_attr_next_value(um_attr, j, &uid_dn_value)) {
- slapi_ch_array_add(&smod_deluids,
- slapi_ch_strdup(slapi_value_get_string(uid_dn_value)));
- }
+
+ slapi_attr_get_valueset(um_attr, &smod_deluids);
}
- /* ...loop for value... */
- for (j = slapi_attr_first_value(mu_attr, &uid_value); j != -1;
- j = slapi_attr_next_value(mu_attr, j, &uid_value)) {
- /* remove from uniquemember: remove from memberUid also */
- const char *uid = NULL;
+ if (muid_rc != 0 || muid_attr == NULL) {
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: test dellist \n");
- uid = slapi_value_get_string(uid_value);
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: test dellist %s\n", uid);
- if (uid_in_set(uid, smod_deluids)) {
- slapi_ch_array_add(&deluids, slapi_ch_strdup(uid));
+ "modGroupMembership end: attribute memberUid not found\n");
+ }
+ else if (posix_winsync_config_get_mapMemberUid()) {
+ /* ...loop for value... */
+ for (j = slapi_attr_first_value(muid_attr, &uid_value); j != -1;
+ j = slapi_attr_next_value(muid_attr, j, &uid_value)) {
+ /* remove from uniquemember: remove from memberUid also */
+ const char *uid = NULL;
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: add to dellist %s\n", uid);
- doModify = true;
+ "modGroupMembership: test dellist \n");
+ uid = slapi_value_get_string(uid_value);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "modGroupMembership: test dellist %s\n", uid);
+ if (uid_in_valueset(uid, smod_deluids)) {
+ slapi_valueset_add_value(deluids, uid_value);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "modGroupMembership: add to dellist %s\n", uid);
+ }
+ }
+ }
+
+ if (posix_winsync_config_get_mapNestedGrouping()) {
+ propogateDeletionsUpward(entry, base_sdn, smod_deluids, del_nested_vs, 0);
+ int i;
+ Slapi_Value *v;
+ for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1;
+ i = slapi_valueset_next_value(del_nested_vs, i, &v)) {
+ slapi_valueset_add_value(deluids, v);
}
}
} while (false);
@@ -331,93 +753,176 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify)
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership: posixGroup -> look for uniquemember\n");
- /* found attribute uniquemember */
- for (j = 0; smod_adduids[j]; j++) {
- static char *uid = NULL;
- uid_dn = smod_adduids[j];
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: perform user %s\n", uid_dn);
+ if (muid_rc == 0 && muid_attr == NULL) {
+ muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr);
+ }
+ if (muid_rc == 0 && muid_attr != NULL) {
+ slapi_attr_get_valueset(muid_attr, &muid_vs);
+ }
+ else {
+ muid_vs = slapi_valueset_new();
+ }
- uid = searchUid(uid_dn);
+ if (posix_winsync_config_get_mapMemberUid()) {
+ for (j = 0; smod_adduids[j]; j++) {
+ static char *uid = NULL;
- if (uid == NULL) {
+ uid_dn = smod_adduids[j];
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: uid not found for %s, cannot do anything\n",
- uid_dn); /* member on longer on server, do nothing */
- } else {
- rc |= slapi_entry_attr_find(entry, "memberUid", &muid_attr);
- if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create */
+ "modGroupMembership: perform user %s\n", uid_dn);
+
+ uid = searchUid(uid_dn);
+
+ if (uid == NULL) {
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "modGroupMembership: no attribute memberUid, add with %s \n",
- uid_dn);
- slapi_ch_array_add(&adduids, uid);
- uid = NULL; /* adduids now owns uid */
- doModify = true;
- } else { /* Found a memberUid list, so modify */
- Slapi_ValueSet *vs = NULL;
+ "modGroupMembership: uid not found for %s, cannot do anything\n",
+ uid_dn); /* member on longer on server, do nothing */
+ } else {
Slapi_Value *v = slapi_value_new();
-
slapi_value_init_string_passin(v, uid);
- slapi_attr_get_valueset(muid_attr, &vs);
- if (slapi_valueset_find(muid_attr, vs, v) != NULL) { /* already exist, all ok */
+
+ if (muid_rc == 0 && muid_attr != NULL &&
+ slapi_valueset_find(muid_attr, muid_vs, v) != NULL) {
+
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership: uid found in memberuid list %s nothing to do\n",
uid);
- } else {
- slapi_ch_array_add(&moduids, uid);
+ }
+ else {
+ slapi_valueset_add_value(adduids, v);
+ slapi_valueset_add_value(muid_vs, v);
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"modGroupMembership: add to modlist %s\n", uid);
- uid = NULL; /* adduids now owns uid */
- /* have to clear out v otherwise slapi_value_free will also free uid */
- slapi_value_init_berval(v, NULL);
- doModify = true;
}
+
slapi_value_free(&v); /* also frees uid since it was a passin */
- slapi_valueset_free(vs); vs = NULL;
}
}
}
+
+ if (posix_winsync_config_get_mapNestedGrouping()) {
+
+ for (j = 0; smod_adduids[j]; ++j) {
+ char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL };
+ Slapi_Entry *child = getEntry(smod_adduids[j], attrs);
+
+ if (child) {
+ if (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup")) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "modGroupMembership: Found mod to add group, adding membership: %s\n",
+ smod_adduids[j]);
+ Slapi_ValueSet *muid_tempnested = slapi_valueset_new();
+ getMembershipFromDownward(child, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0);
+
+ slapi_valueset_free(muid_tempnested); muid_tempnested = NULL;
+ }
+ }
+ else {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "modGroupMembership: entry not found for dn: %s\n",
+ smod_adduids[j]);
+ }
+ }
+
+ getMembershipFromDownward(entry, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0);
+ int i = 0;
+ Slapi_Value *v = NULL;
+ for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1;
+ i = slapi_valueset_next_value(add_nested_vs, i, &v)) {
+ slapi_valueset_add_value(adduids, v);
+ }
+
+ propogateMembershipUpward(entry, adduids, 0);
+ }
}
- if (doModify) {
+ if (posixGroup) {
+ int addDynamicGroup = 0;
int i;
- for (i = 0; adduids && adduids[i]; i++) {
- if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", adduids[i])) {
- slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", adduids[i]);
+ Slapi_Value *v;
+ for (i = slapi_valueset_first_value(adduids, &v); i != -1;
+ i = slapi_valueset_next_value(adduids, i, &v)){
+ const char *muid = slapi_value_get_string(v);
+ if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", muid)) {
+ *do_modify = 1;
+ slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", muid);
+ }
+ }
+ for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1;
+ i = slapi_valueset_next_value(add_nested_vs, i, &v)) {
+ const char *muid = slapi_value_get_string(v);
+ if (!smods_has_mod(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid)) {
+ addDynamicGroup = 1;
+ *do_modify = 1;
+ slapi_mods_add_string(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid);
}
}
- for (i = 0; moduids && moduids[i]; i++) {
- if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", moduids[i])) {
- slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", moduids[i]);
+ for (i = slapi_valueset_first_value(deluids, &v); i != -1;
+ i = slapi_valueset_next_value(deluids, i, &v)){
+ const char *muid = slapi_value_get_string(v);
+ if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", muid)) {
+ *do_modify = 1;
+ slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", muid);
}
}
- for (i = 0; deluids && deluids[i]; i++) {
- if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", deluids[i])) {
- slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", deluids[i]);
+ for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1;
+ i = slapi_valueset_next_value(del_nested_vs, i, &v)){
+ const char *muid = slapi_value_get_string(v);
+ if (!smods_has_mod(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid)) {
+ *do_modify = 1;
+ slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid);
}
}
+ if (addDynamicGroup) {
+ addDynamicGroupIfNecessary(entry, smods);
+ }
if (slapi_is_loglevel_set(SLAPI_LOG_PLUGIN))
slapi_mods_dump(smods, "memberUid - mods dump");
- *do_modify = 1;
posix_winsync_config_set_MOFTaskCreated();
}
slapi_ch_array_free(smod_adduids);
smod_adduids = NULL;
- slapi_ch_array_free(adduids);
- adduids = NULL;
- slapi_ch_array_free(smod_deluids);
+ if (smod_deluids) slapi_valueset_free(smod_deluids);
smod_deluids = NULL;
- slapi_ch_array_free(deluids);
+
+ slapi_valueset_free(adduids);
+ adduids = NULL;
+ slapi_valueset_free(deluids);
deluids = NULL;
- slapi_ch_array_free(moduids);
- moduids = NULL;
+
+ slapi_valueset_free(add_nested_vs); add_nested_vs = NULL;
+ slapi_valueset_free(del_nested_vs); del_nested_vs = NULL;
+
+ if (muid_vs) {
+ slapi_valueset_free(muid_vs); muid_vs = NULL;
+ }
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: <==\n");
return 0;
}
int
+addUserToGroupMembership(Slapi_Entry *entry)
+{
+ Slapi_Attr *uid_attr = NULL;
+ Slapi_Value *v = NULL;
+ Slapi_ValueSet *muid_vs = slapi_valueset_new();
+
+ if (slapi_entry_attr_find(entry, "uid", &uid_attr) == 0) {
+ slapi_attr_first_value(uid_attr, &v);
+
+ if (v) {
+ slapi_valueset_add_value(muid_vs, v);
+ }
+ }
+
+ propogateMembershipUpward(entry, muid_vs, 0);
+
+ slapi_valueset_free(muid_vs); muid_vs = NULL;
+}
+
+int
addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
{
int rc = 0;
@@ -425,7 +930,11 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: ==>\n");
- if(!isPosixGroup(entry)) {
+ int posixGroup = hasObjectClass(entry, "posixGroup");
+
+ if(!(posixGroup || hasObjectClass(entry, "ntGroup"))) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "addGroupMembership: didn't find posixGroup or ntGroup objectclass\n");
return 0;
}
@@ -448,34 +957,55 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry)
if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create */
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"addGroupMembership: no attribute memberUid\n");
+ muid_attr = NULL;
}
newvs = slapi_valueset_new();
/* ...loop for value... */
- for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
- i = slapi_attr_next_value(um_attr, i, &uid_value)) {
- const char *uid_dn = NULL;
- static char *uid = NULL;
- Slapi_Value *v = NULL;
+ if (posix_winsync_config_get_mapMemberUid()) {
+ for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1;
+ i = slapi_attr_next_value(um_attr, i, &uid_value)) {
+ const char *uid_dn = NULL;
+ static char *uid = NULL;
+ Slapi_Value *v = NULL;
- uid_dn = slapi_value_get_string(uid_value);
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "addGroupMembership: perform member %s\n", uid_dn);
- uid = searchUid(uid_dn);
- if (uid == NULL) {
+ uid_dn = slapi_value_get_string(uid_value);
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
- "addGroupMembership: uid not found for %s, cannot do anything\n",
- uid_dn); /* member on longer on server, do nothing */
- } else {
- v = slapi_value_new_string(uid);
- slapi_ch_free_string(&uid);
- if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) {
- slapi_valueset_add_value(newvs, v);
+ "addGroupMembership: perform member %s\n", uid_dn);
+ uid = searchUid(uid_dn);
+ if (uid == NULL) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "addGroupMembership: uid not found for %s, cannot do anything\n",
+ uid_dn); /* member on longer on server, do nothing */
+ } else {
+ v = slapi_value_new_string(uid);
+ slapi_ch_free_string(&uid);
+ if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) {
+ slapi_valueset_add_value(newvs, v);
+ }
+ slapi_value_free(&v);
}
- slapi_value_free(&v);
}
}
- slapi_entry_add_valueset(entry, "memberUid", newvs);
- slapi_valueset_free(newvs);
+
+ if (posix_winsync_config_get_mapNestedGrouping()) {
+ Slapi_ValueSet *muid_nested_vs = slapi_valueset_new();
+
+ getMembershipFromDownward(entry, newvs, muid_nested_vs, NULL, NULL, 0);
+ propogateMembershipUpward(entry, newvs, 0);
+
+ if (posixGroup) {
+ addDynamicGroupIfNecessary(entry, NULL);
+ slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_nested_vs);
+ }
+
+ slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL;
+ }
+
+ if (posixGroup) {
+ slapi_entry_add_valueset(entry, "memberUid", newvs);
+ }
+
+ slapi_valueset_free(newvs); newvs = NULL;
posix_winsync_config_get_MOFTaskCreated();
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: <==\n");
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c
index e31064c..4555f1b 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-task.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c
@@ -25,11 +25,17 @@ typedef struct _cb_data
} posix_group_data_data;
*/
+Slapi_Value **
+valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
+
/* interface function */
int
posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode,
char *returntext, void *arg);
+Slapi_Entry *
+getEntry(const char *udn, char **attrs);
+
static void
posix_group_task_destructor(Slapi_Task *task);
static void
@@ -67,6 +73,10 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
*returncode = LDAP_SUCCESS;
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: ==>\n");
+
/* get arg(s) */
/* default: set replication basedn */
if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) {
@@ -75,12 +85,18 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
goto out;
}
- if ((filter = fetch_attr(e, "filter", "(&(objectclass=posixGroup)(uniquemember=*))")) == NULL) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: retrieved basedn: %s\n", dn);
+
+ if ((filter = fetch_attr(e, "filter", "(objectclass=ntGroup)")) == NULL) {
*returncode = LDAP_OBJECT_CLASS_VIOLATION;
rv = SLAPI_DSE_CALLBACK_ERROR;
goto out;
}
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: retrieved filter: %s\n", filter);
+
/* setup our task data */
mytaskdata = (task_data*) slapi_ch_malloc(sizeof(task_data));
if (mytaskdata == NULL) {
@@ -91,19 +107,41 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
mytaskdata->dn = slapi_ch_strdup(dn);
mytaskdata->filter_str = slapi_ch_strdup(filter);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: task data allocated\n");
+
/* allocate new task now */
- task = slapi_new_task(slapi_entry_get_ndn(e));
+ char * ndn = slapi_entry_get_ndn(e);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: creating task object: %s\n",
+ ndn);
+
+ task = slapi_new_task(ndn);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: task object created\n");
/* register our destructor for cleaning up our private data */
slapi_task_set_destructor_fn(task, posix_group_task_destructor);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: task destructor set\n");
+
/* Stash a pointer to our data in the task */
slapi_task_set_data(task, mytaskdata);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: task object initialized\n");
+
/* start the sample task as a separate thread */
thread = PR_CreateThread(PR_USER_THREAD, posix_group_fixup_task_thread, (void *) task,
PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD, PR_UNJOINABLE_THREAD,
SLAPD_DEFAULT_THREAD_STACKSIZE);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: thread created\n");
+
if (thread == NULL) {
slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
"unable to create task thread!\n");
@@ -114,7 +152,11 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int
rv = SLAPI_DSE_CALLBACK_OK;
}
- out: return rv;
+ out:
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "posix_group_task_add: <==\n", filter);
+
+ return rv;
}
static void
@@ -195,86 +237,172 @@ posix_group_fix_memberuid(char *dn, char *filter_str, void *txn)
static int
posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data)
{
- int rc = 0;
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid ==>\n");
+ cb_data *the_cb_data = (cb_data *) callback_data;
+
+ int rc;
+ Slapi_Attr *muid_attr = NULL;
+ Slapi_Value *v = NULL;
+
+ Slapi_Mods *smods = slapi_mods_new();
+
char *dn = slapi_entry_get_dn(e);
Slapi_DN *sdn = slapi_entry_get_sdn(e);
- Slapi_Attr *obj_attr = NULL;
+/* Clean out memberuids and dsonlymemberuids without a valid referant */
+ rc = slapi_entry_attr_find(e, "memberuid", &muid_attr);
+ if (rc == 0 && muid_attr) {
+ Slapi_PBlock *search_pb = slapi_pblock_new();
+
+ Slapi_Attr *dsmuid_attr = NULL;
+ Slapi_ValueSet *dsmuid_vs = NULL;
+
+ char *attrs[] = { "uid", NULL };
+
+ rc = slapi_entry_attr_find(e, "dsonlymemberuid", &dsmuid_attr);
+ if (rc == 0 && dsmuid_attr) {
+ slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs);
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid scan for orphaned memberuids\n");
+
+ int i;
+ for (i = slapi_attr_first_value(muid_attr, &v); i != -1;
+ i = slapi_attr_next_value(muid_attr, i, &v)) {
+ const char *muid = slapi_value_get_string(v);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid iterating memberuid: %s\n",
+ muid);
+
+ size_t vallen = muid ? strlen(muid) : 0;
+ char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1);
+ char *filter = slapi_ch_smprintf("(uid=%s)", escape_filter_value(muid, vallen, filter_escaped_value));
+ slapi_ch_free_string(&filter_escaped_value);
+
+ Slapi_Entry **search_entries = NULL;
+
+ slapi_search_internal_set_pb(search_pb,
+ the_cb_data->dn,
+ LDAP_SCOPE_SUBTREE,
+ filter,
+ attrs, 0, NULL, NULL,
+ posix_winsync_get_plugin_identity(), 0);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid searching %s with filter: %s\n",
+ the_cb_data->dn, filter);
+ rc = slapi_search_internal_pb(search_pb);
+
+ slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &search_entries);
+
+ if (!search_entries || !search_entries[0]) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid Adding bad memberuid %s\n",
+ slapi_value_get_string(v));
+
+ slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberuid", slapi_value_get_string(v));
+
+ if (dsmuid_vs && slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid Adding bad dsonlymemberuid %s\n",
+ slapi_value_get_string(v));
+
+ slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsonlymemberuid", slapi_value_get_string(v));
+ }
+ }
+
+ slapi_free_search_results_internal(search_pb);
+ slapi_pblock_init(search_pb);
+ slapi_ch_free_string(&filter);
+ }
+
+ if (dsmuid_vs) {
+ slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL;
+ }
+
+ slapi_pblock_destroy(search_pb); search_pb = NULL;
+ }
+
+ /* Cleanup uniquemembers without a referent, and verify memberuid otherwise */
+ Slapi_Attr *obj_attr = NULL;
rc = slapi_entry_attr_find(e, "uniquemember", &obj_attr);
- if (rc == 0) { /* Found uniquemember, so... */
+ if (rc == 0 && obj_attr) {
+ int fixMembership = 0;
+ Slapi_ValueSet *bad_ums = NULL;
+
int i;
- Slapi_Value * value = slapi_value_new(); /* new memberuid Attribute values */
- Slapi_Value * uniqval = NULL; /* uniquemeber Attribute values */
- Slapi_ValueSet *uids = slapi_valueset_new();
+ Slapi_Value * uniqval = NULL; /* uniquemeber Attribute values */
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
"_fix_memberuid scan uniquemember, group %s\n", dn);
for (i = slapi_attr_first_value(obj_attr, &uniqval); i != -1;
i = slapi_attr_next_value(obj_attr, i, &uniqval)) {
- const char *member = NULL;
- char * uid = NULL;
- member = slapi_value_get_string(uniqval);
- /* search uid for member (DN) */
- slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search %s\n", member);
- if ((uid = searchUid(member)) != NULL) {
- slapi_value_set_string(value, uid);
- /* add uids ValueSet */
- slapi_valueset_add_value(uids, value);
+
+ const char *member = slapi_value_get_string(uniqval);
+ char *attrs[] = { "uid", "objectclass", NULL };
+ Slapi_Entry *child = getEntry(member, attrs);
+
+ if (!child) {
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid orphaned uniquemember found: %s\n", member);
+
+ if (strncasecmp(member, "cn=", 3) == 0) {
+ fixMembership = 1;
+ }
+ if (!bad_ums) {
+ bad_ums = slapi_valueset_new();
+ }
+ slapi_valueset_add_value(bad_ums, uniqval);
}
}
- slapi_value_free(&value);
-
- /* If we found some posix members, replace the existing memberuid attribute
- * with the found values. */
- if (uids && slapi_valueset_count(uids)) {
- Slapi_PBlock *mod_pb = slapi_pblock_new();
- Slapi_Value *val = 0;
- Slapi_Mod *smod;
- LDAPMod **mods = (LDAPMod **) slapi_ch_malloc(2 * sizeof(LDAPMod *));
- int hint = 0;
- cb_data *the_cb_data = (cb_data *) callback_data;
-
- smod = slapi_mod_new();
- slapi_mod_init(smod, 0);
- slapi_mod_set_operation(smod, LDAP_MOD_REPLACE | LDAP_MOD_BVALUES);
- slapi_mod_set_type(smod, "memberuid");
-
- /* Loop through all of our values and add them to smod */
- hint = slapi_valueset_first_value(uids, &val);
- while (val) {
- /* this makes a copy of the berval */
- slapi_mod_add_value(smod, slapi_value_get_berval(val));
- hint = slapi_valueset_next_value(uids, hint, &val);
- }
- mods[0] = slapi_mod_get_ldapmod_passout(smod);
- mods[1] = 0;
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid Finishing...\n");
- slapi_modify_internal_set_pb_ext(mod_pb, sdn, mods, 0, 0,
- posix_winsync_get_plugin_identity(), 0);
+ if (fixMembership && posix_winsync_config_get_mapNestedGrouping()) {
+ Slapi_ValueSet *del_nested_vs = slapi_valueset_new();
- slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn);
- slapi_modify_internal_pb(mod_pb);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid group deleted, recalculating nesting\n");
+ propogateDeletionsUpward(e, sdn, bad_ums, del_nested_vs, 0);
- slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+ slapi_valueset_free(del_nested_vs); del_nested_vs = NULL;
+ }
- ldap_mods_free(mods, 1);
- slapi_mod_free(&smod);
- slapi_pblock_destroy(mod_pb);
- } else {
- /* No member were found, so remove the memberuid attribute
- * from this entry. */
- posix_group_del_memberuid_callback(e, callback_data);
+ if (bad_ums) {
+ slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "uniquemember", valueset_get_valuearray(bad_ums));
+ slapi_valueset_free(bad_ums); bad_ums = NULL;
}
- slapi_valueset_free(uids);
}
+
+ Slapi_PBlock *mod_pb = slapi_pblock_new();
+
+ slapi_modify_internal_set_pb_ext(mod_pb, sdn, slapi_mods_get_ldapmods_passout(smods), 0, 0,
+ posix_winsync_get_plugin_identity(), 0);
+
+ slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn);
+ slapi_modify_internal_pb(mod_pb);
+
+ slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+ slapi_pblock_destroy(mod_pb);
+
+ slapi_mods_free(&smods);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_fix_memberuid <==\n");
return rc;
}
static void
posix_group_fixup_task_thread(void *arg)
{
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_task_thread ==>\n");
+
Slapi_Task *task = (Slapi_Task *) arg;
task_data *td = NULL;
int rc = 0;
@@ -293,11 +421,18 @@ posix_group_fixup_task_thread(void *arg)
/* release the memberOf operation lock */
memberUidUnlock();
+
slapi_task_log_notice(task, "posix_group task finished.");
slapi_task_log_status(task, "posix_group task finished.");
slapi_task_inc_progress(task);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_task_thread finishing\n");
+
/* this will queue the destruction of the task */
slapi_task_finish(task, rc);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_task_thread <==\n");
}
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync-config.c b/ldap/servers/plugins/posix-winsync/posix-winsync-config.c
index a2d21be..a7fd6e9 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync-config.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync-config.c
@@ -142,6 +142,12 @@ posix_winsync_config_get_msSFUSchema()
return theConfig.mssfuSchema;
}
+PRBool
+posix_winsync_config_get_mapNestedGrouping()
+{
+ return theConfig.mapNestedGrouping;
+}
+
Slapi_DN *
posix_winsync_config_get_suffix()
{
@@ -182,6 +188,7 @@ posix_winsync_config(Slapi_Entry *config_e)
theConfig.lowercase = PR_FALSE;
theConfig.createMemberOfTask = PR_FALSE;
theConfig.MOFTaskCreated = PR_FALSE;
+ theConfig.mapNestedGrouping = PR_FALSE;
posix_winsync_apply_config(NULL, NULL, config_e, &returncode, returntext, NULL);
/* config DSE must be initialized before we get here */
@@ -224,6 +231,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
PRBool createMemberOfTask = PR_FALSE;
PRBool lowercase = PR_FALSE;
Slapi_Attr *testattr = NULL;
+ PRBool mapNestedGrouping = PR_FALSE;
*returncode = LDAP_UNWILLING_TO_PERFORM; /* be pessimistic */
@@ -257,6 +265,13 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
"_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_LOWER_CASE,
lowercase);
}
+ /* propogate memberuids in nested grouping */
+ if (!slapi_entry_attr_find(e, POSIX_WINSYNC_MAP_NESTED_GROUPING, &testattr) && (NULL != testattr)) {
+ mapNestedGrouping = slapi_entry_attr_get_bool(e, POSIX_WINSYNC_MAP_NESTED_GROUPING);
+ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
+ "_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_MAP_NESTED_GROUPING,
+ mapNestedGrouping);
+ }
/* if we got here, we have valid values for everything
set the config entry */
slapi_lock_mutex(theConfig.lock);
@@ -269,6 +284,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent
theConfig.mapMemberUID = mapMemberUID;
theConfig.createMemberOfTask = createMemberOfTask;
theConfig.lowercase = lowercase;
+ theConfig.mapNestedGrouping = mapNestedGrouping;
/* success */
slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 398541d..aa292c3 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -68,7 +68,7 @@
#include "posix-wsp-ident.h"
#include "posix-group-func.h"
-#define MEMBEROFTASK "memberof task"
+#define MEMBEROFTASK "memberuid task"
Slapi_Value **
valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */
void *
@@ -103,6 +103,7 @@ static windows_attribute_map user_mssfu_attribute_map[] =
{ "msSFU30gecos", "gecos" },
{ NULL, NULL } };
+/* memberUid must be first element or fixup in pre_ad_mod/add_group is required */
static windows_attribute_map group_attribute_map[] = { { "memberUid", "memberUid" },
{ "gidNumber", "gidNumber" },
{ NULL, NULL } };
@@ -661,7 +662,34 @@ posix_winsync_pre_ad_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
char *ad_type = NULL;
int is_present_local;
- slapi_attr_get_valueset(attr, &vs);
+ if (i == 0) { /* memberUid */
+ Slapi_Attr *dsmuid_attr = NULL;
+ Slapi_Value *v = NULL;
+ slapi_entry_attr_find(ds_entry, "dsonlymemberuid", &dsmuid_attr);
+
+ if (dsmuid_attr) {
+ Slapi_ValueSet *dsmuid_vs = NULL;
+ slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs);
+ if (dsmuid_vs) {
+ vs = slapi_valueset_new();
+
+ int j;
+ for (j = slapi_attr_first_value(attr, &v); j != -1;
+ j = slapi_attr_next_value(attr, i, &v)) {
+ if (!slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) {
+ slapi_valueset_add_value(vs, v);
+ }
+ }
+
+ slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL;
+ }
+ }
+ }
+
+ if (!vs) {
+ slapi_attr_get_valueset(attr, &vs);
+ }
+
ad_type = slapi_ch_strdup(attr_map[i].windows_attribute_name);
slapi_entry_attr_find(ad_entry, ad_type, &ad_attr);
is_present_local = (NULL == ad_attr) ? 0 : 1;
@@ -810,6 +838,12 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
valueset_get_valuearray(oc_vs));
slapi_value_free(&oc_nv);
slapi_valueset_free(oc_vs);
+
+ if (posix_winsync_config_get_mapNestedGrouping()) {
+ memberUidLock();
+ addUserToGroupMembership(ds_entry);
+ memberUidUnlock();
+ }
}
}
slapi_value_free(&voc);
@@ -897,7 +931,7 @@ posix_winsync_pre_ds_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"_pre_ds_mod_group_cb present %d modify %d before\n", is_present_local,
do_modify_local);
- if (posix_winsync_config_get_mapMemberUid()) {
+ if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) {
memberUidLock();
modGroupMembership(ds_entry, smods, do_modify);
memberUidUnlock();
@@ -999,6 +1033,13 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"<-- _pre_ds_add_user_cb -- adding objectclass for new entry failed %d\n",
rc);
+ else {
+ if (posix_winsync_config_get_mapNestedGrouping()) {
+ memberUidLock();
+ addUserToGroupMembership(ds_entry);
+ memberUidUnlock();
+ }
+ }
}
sync_acct_disable(cbdata, rawentry, ds_entry, ACCT_DISABLE_TO_DS, ds_entry, NULL, NULL);
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- _pre_ds_add_user_cb -- end\n");
@@ -1054,14 +1095,14 @@ posix_winsync_pre_ds_add_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"<-- _pre_ds_add_group_cb -- adding objectclass for new entry failed %d\n",
rc);
- } else {
- if (posix_winsync_config_get_mapMemberUid()) {
- memberUidLock();
- addGroupMembership(ds_entry, ad_entry);
- memberUidUnlock();
- }
}
}
+ if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) {
+ memberUidLock();
+ addGroupMembership(ds_entry, ad_entry);
+ memberUidUnlock();
+ }
+
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"<-- posix_winsync_pre_ds_add_group_cb -- end\n");
@@ -1274,7 +1315,7 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap
"--> posix_winsync_end_update_cb -- begin %d %d\n",
posix_winsync_config_get_MOFTaskCreated(),
posix_winsync_config_get_createMOFTask());
- if (posix_winsync_config_get_MOFTaskCreated() && posix_winsync_config_get_createMOFTask()) {
+ if (1 && posix_winsync_config_get_createMOFTask()) {
/* add a task to schedule memberof Plugin for fix memebrof attributs */
Slapi_PBlock *pb = slapi_pblock_new();
Slapi_Entry *e_task = slapi_entry_alloc();
@@ -1291,13 +1332,24 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap
posix_winsync_plugin_name, MEMBEROFTASK);
return;
}
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> posix_winsync_end_update_cb, init'ing task\n");
+
slapi_entry_init(e_task, slapi_ch_strdup(dn), NULL);
slapi_entry_add_string(e_task, "cn", slapi_ch_strdup(posix_winsync_plugin_name));
slapi_entry_add_string(e_task, "objectClass", "extensibleObject");
slapi_entry_add_string(e_task, "basedn", slapi_sdn_get_dn(ds_subtree));
slapi_add_entry_internal_set_pb(pb, e_task, NULL, posix_winsync_get_plugin_identity(), 0);
+
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> posix_winsync_end_update_cb, adding task\n");
slapi_add_internal_pb(pb);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> posix_winsync_end_update_cb, retrieving return code\n");
slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
if (rc != 0) {
slapi_log_error(SLAPI_LOG_FATAL, posix_winsync_plugin_name,
diff --git a/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h b/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h
index 43a23df..f36fe40 100644
--- a/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h
+++ b/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h
@@ -17,7 +17,7 @@
#define POSIX_WINSYNC_MAP_MEMBERUID "posixWinsyncMapMemberUID"
#define POSIX_WINSYNC_CREATE_MEMBEROFTASK "posixWinsyncCreateMemberOfTask"
#define POSIX_WINSYNC_LOWER_CASE "posixWinsyncLowerCaseUID"
-
+#define POSIX_WINSYNC_MAP_NESTED_GROUPING "posixWinsyncMapNestedGrouping"
void * posix_winsync_get_plugin_identity();
@@ -29,6 +29,7 @@ typedef struct posix_winsync_config_struct {
PRBool lowercase; /* store the uid in group memberuid in lower case */
PRBool createMemberOfTask; /* should memberOf Plugin Task run after AD sync */
PRBool MOFTaskCreated;
+ PRBool mapNestedGrouping;
Slapi_DN *rep_suffix; /* namingContext in DS of the replicated suffix */
} POSIX_WinSync_Config;
@@ -42,6 +43,7 @@ Slapi_DN *posix_winsync_config_get_suffix();
void posix_winsync_config_reset_MOFTaskCreated();
void posix_winsync_config_set_MOFTaskCreated();
PRBool posix_winsync_config_get_MOFTaskCreated();
+PRBool posix_winsync_config_get_mapNestedGrouping();
int posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e,
Slapi_Entry *eAfter, int *returncode, char *returntext,
--
1.7.7.6