From 54431eb9e2438a838904a6d4846c45131b937cd0 Mon Sep 17 00:00:00 2001 From: Ken Rossato Date: Mon, 24 Sep 2012 19:52:09 -0400 Subject: [PATCH 4/5] Ticket #481 - expand nested posix groups Description: Add ability to populate memberuid dynamically to reflect nested grouping. (cherry picked from commit b9eeb2e1a8e688dfec753e8965d0e5aeb119e638) --- Makefile.am | 1 + Makefile.in | 1 + ldap/ldif/50posix-winsync-plugin.ldif | 1 + ldap/schema/60posix-winsync-plugin.ldif | 44 + .../plugins/posix-winsync/posix-group-func.c | 846 ++++++++++++++++---- .../plugins/posix-winsync/posix-group-task.c | 249 +++++-- .../plugins/posix-winsync/posix-winsync-config.c | 16 + ldap/servers/plugins/posix-winsync/posix-winsync.c | 72 ++- .../plugins/posix-winsync/posix-wsp-ident.h | 4 +- 9 files changed, 1008 insertions(+), 226 deletions(-) create mode 100644 ldap/schema/60posix-winsync-plugin.ldif diff --git a/Makefile.am b/Makefile.am index c5c4080..507a2d6 100644 --- a/Makefile.am +++ b/Makefile.am @@ -299,6 +299,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \ $(srcdir)/ldap/schema/50ns-value.ldif \ $(srcdir)/ldap/schema/50ns-web.ldif \ $(srcdir)/ldap/schema/60pam-plugin.ldif \ + $(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \ $(srcdir)/ldap/schema/60autofs.ldif \ $(srcdir)/ldap/schema/60eduperson.ldif \ $(srcdir)/ldap/schema/60mozilla.ldif \ diff --git a/Makefile.in b/Makefile.in index 3777829..f105932 100644 --- a/Makefile.in +++ b/Makefile.in @@ -1527,6 +1527,7 @@ schema_DATA = $(srcdir)/ldap/schema/00core.ldif \ $(srcdir)/ldap/schema/50ns-value.ldif \ $(srcdir)/ldap/schema/50ns-web.ldif \ $(srcdir)/ldap/schema/60pam-plugin.ldif \ + $(srcdir)/ldap/schema/60posix-winsync-plugin.ldif \ $(srcdir)/ldap/schema/60autofs.ldif \ $(srcdir)/ldap/schema/60eduperson.ldif \ $(srcdir)/ldap/schema/60mozilla.ldif \ diff --git a/ldap/ldif/50posix-winsync-plugin.ldif b/ldap/ldif/50posix-winsync-plugin.ldif index de8c432..17dc243 100644 --- a/ldap/ldif/50posix-winsync-plugin.ldif +++ b/ldap/ldif/50posix-winsync-plugin.ldif @@ -10,6 +10,7 @@ nsslapd-pluginenabled: off nsslapd-plugin-depends-on-type: database posixWinsyncMsSFUSchema: false posixWinsyncMapMemberUID: true +posixWinsyncMapNestedGrouping: false posixWinsyncCreateMemberOfTask: false posixWinsyncLowerCaseUID: false nsslapd-pluginprecedence: 25 diff --git a/ldap/schema/60posix-winsync-plugin.ldif b/ldap/schema/60posix-winsync-plugin.ldif new file mode 100644 index 0000000..8d9a72e --- /dev/null +++ b/ldap/schema/60posix-winsync-plugin.ldif @@ -0,0 +1,44 @@ +# +# BEGIN COPYRIGHT BLOCK +# This Program is free software; you can redistribute it and/or modify it under +# the terms of the GNU General Public License as published by the Free Software +# Foundation; version 2 of the License. +# +# This Program is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS +# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along with +# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple +# Place, Suite 330, Boston, MA 02111-1307 USA. +# +# In addition, as a special exception, Red Hat, Inc. gives You the additional +# right to link the code of this Program with code not covered under the GNU +# General Public License ("Non-GPL Code") and to distribute linked combinations +# including the two, subject to the limitations in this paragraph. Non-GPL Code +# permitted under this exception must only link to the code of this Program +# through those well defined interfaces identified in the file named EXCEPTION +# found in the source code files (the "Approved Interfaces"). The files of +# Non-GPL Code may instantiate templates or use macros or inline functions from +# the Approved Interfaces without causing the resulting work to be covered by +# the GNU General Public License. Only Red Hat, Inc. may make changes or +# additions to the list of Approved Interfaces. You must obey the GNU General +# Public License in all respects for all of the Program code and other code used +# in conjunction with the Program except the Non-GPL Code covered by this +# exception. If you modify this file, you may extend this exception to your +# version of the file, but you are not obligated to do so. If you do not wish to +# provide this exception without modification, you must delete this exception +# statement from your version and license this file solely under the GPL without +# exception. +# +# +# Copyright (C) 2005 Red Hat, Inc. +# All rights reserved. +# END COPYRIGHT BLOCK +# +# +# Schema for representing internal dynamically-generated group members +# +dn: cn=schema +attributeTypes: ( 2.16.840.1.113730.3.1.2141 NAME 'dsOnlyMemberUid' DESC 'Elements from a memberuid attribute created to reflect dynamic group membership' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Red Hat Directory Server' ) +objectClasses: ( 2.16.840.1.113730.3.2.326 NAME 'dynamicGroup' DESC 'Group containing internal dynamically-generated members' SUP posixGroup AUXILIARY MAY ( dsOnlyMemberUid ) X-ORIGIN 'Red Hat Directory Server' ) diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c index 1403a89..66b9272 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-func.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c @@ -18,11 +18,14 @@ $Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $ */ #include "slapi-plugin.h" +#include "slapi-private.h" #include #include #include "posix-wsp-ident.h" +#define MAX_RECURSION_DEPTH (5) + Slapi_Value ** valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */ static PRMonitor *memberuid_operation_lock = 0; @@ -45,58 +48,100 @@ memberUidLockInit() return (memberuid_operation_lock = PR_NewMonitor()) != NULL; } +void +addDynamicGroupIfNecessary(Slapi_Entry *entry, Slapi_Mods *smods) { + Slapi_Attr *oc_attr = NULL; + Slapi_Value *voc = slapi_value_new(); + + slapi_value_init_string(voc, "dynamicGroup"); + slapi_entry_attr_find(entry, "objectClass", &oc_attr); + + if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) { + if (smods) { + slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup"); + } + else { + smods = slapi_mods_new(); + slapi_mods_add_string(smods, LDAP_MOD_ADD, "objectClass", "dynamicGroup"); + + Slapi_PBlock *mod_pb = slapi_pblock_new(); + slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0, + posix_winsync_get_plugin_identity(), 0); + slapi_modify_internal_pb(mod_pb); + slapi_pblock_destroy(mod_pb); + + slapi_mods_free(&smods); + } + } + + slapi_value_free(&voc); +} + +Slapi_Entry * +getEntry(const char *udn, char **attrs) +{ + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "getEntry: search %s\n", udn); + + Slapi_DN *udn_sdn = slapi_sdn_new_dn_byval(udn); + Slapi_Entry *result = NULL; + int rc = slapi_search_internal_get_entry(udn_sdn, attrs, &result, posix_winsync_get_plugin_identity()); + slapi_sdn_free(&udn_sdn); + + if (rc == 0) { + if (result != NULL) { + return result; /* Must be freed */ + } + else { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getEntry: %s not found\n", udn); + } + } + else { + slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME, + "getEntry: error searching for uid: %d", rc); + } + + return NULL; +} + /* search the user with DN udn and returns uid*/ char * searchUid(const char *udn) { - Slapi_PBlock *int_search_pb = slapi_pblock_new(); - Slapi_Entry **entries = NULL; - char *attrs[] = { "uid", NULL }; + char *attrs[] = { "uid", "objectclass", NULL }; + Slapi_Entry *entry = getEntry(udn, + /* "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", */ + attrs); char *uid = NULL; - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search Uid: search %s\n", udn); + if (entry) { + Slapi_Attr *attr = NULL; + Slapi_Value *v = NULL; - slapi_search_internal_set_pb(int_search_pb, udn, LDAP_SCOPE_BASE, - "(|(objectclass=posixAccount)(objectclass=ldapsubentry))", attrs, - 0 /* attrsonly */, NULL /* controls */, NULL /* uniqueid */, - posix_winsync_get_plugin_identity(), 0 /* actions */); - if (slapi_search_internal_pb(int_search_pb)) { - /* get result and log an error */ - int res = 0; - slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_RESULT, &res); - slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME, - "searchUid: error searching for uid: %d", res); - } else { - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "searchUid: searched %s\n", - udn); - slapi_pblock_get(int_search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries); - if (NULL != entries && NULL != entries[0]) { - Slapi_Attr *attr = NULL; - Slapi_Value *v = NULL; + if (slapi_entry_attr_find(entry, "uid", &attr) == 0 && hasObjectClass(entry, "posixAccount")) { + slapi_attr_first_value(attr, &v); + uid = slapi_ch_strdup(slapi_value_get_string(v)); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "searchUid: return uid %s\n", uid); + } else { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "searchUid: uid in %s not found\n", udn); + } - if (slapi_entry_attr_find(entries[0], "uid", &attr) == 0) { - slapi_attr_first_value(attr, &v); - uid = slapi_ch_strdup(slapi_value_get_string(v)); - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "searchUid: return uid %s\n", uid); - /* slapi_value_free(&v); */ - } else { - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "searchUid: uid in %s not found\n", udn); - } - slapi_free_search_results_internal(int_search_pb); - slapi_pblock_destroy(int_search_pb); - if (uid && posix_winsync_config_get_lowercase()) { - return slapi_dn_ignore_case(uid); - } - return uid; + if (uid && posix_winsync_config_get_lowercase()) { + uid = slapi_dn_ignore_case(uid); } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "searchUid: About to free entry\n", udn); + + slapi_entry_free(entry); } - slapi_free_search_results_internal(int_search_pb); - slapi_pblock_destroy(int_search_pb); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "searchUid: posix user %s not found\n", udn); - return NULL; + "searchUid: <==\n", udn); + + return uid; } int @@ -152,6 +197,36 @@ uid_in_set(const char* uid, char **uids) return false; } +int +uid_in_valueset(const char* uid, Slapi_ValueSet *uids) +{ + int i; + Slapi_Value *v = NULL; + + if (uid == NULL) + return false; + for (i = slapi_valueset_first_value(uids, &v); i != -1; + i = slapi_valueset_next_value(uids, i, &v)) { + Slapi_RDN *i_rdn = NULL; + char *i_uid = NULL; + char *t = NULL; + + const char *uid_i = slapi_value_get_string(v); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "uid_in_valueset: comp %s %s \n", + uid, uid_i); + i_rdn = slapi_rdn_new_dn(uid_i); + if (slapi_rdn_get_first(i_rdn, &t, &i_uid) == 1) { + if (strncasecmp(uid, i_uid, 256) == 0) { + slapi_rdn_free(&i_rdn); + return true; + } + } + slapi_rdn_free(&i_rdn); + } + return false; +} + /* return 1 if smods already has the given mod - 0 otherwise */ static int smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val) @@ -186,7 +261,7 @@ smods_has_mod(Slapi_Mods *smods, int modtype, const char *type, const char *val) } int -isPosixGroup(Slapi_Entry *entry) +hasObjectClass(Slapi_Entry *entry, const char *objectClass) { int rc = 0; int i; @@ -200,7 +275,7 @@ isPosixGroup(Slapi_Entry *entry) } slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "add/mod-GroupMembership scan objectclasses\n"); + "Scanning objectclasses\n"); for ( i = slapi_attr_first_value(obj_attr, &value); @@ -209,22 +284,357 @@ isPosixGroup(Slapi_Entry *entry) ) { const char *oc = NULL; oc = slapi_value_get_string(value); - if (strncasecmp(oc, "posixGroup", 11) == 0) { - return 1; /* Entry has objectclass posixGroup */ + if (strcasecmp(oc, objectClass) == 0) { + return 1; /* Entry has the desired objectclass */ + } + } + + return 0; /* Doesn't have desired objectclass */ +} + +void +posix_winsync_foreach_parent(Slapi_Entry *entry, char **attrs, plugin_search_entry_callback callback, void *callback_data) +{ + char *cookie = NULL; + Slapi_Backend *be = NULL; + + const char *value = slapi_entry_get_ndn(entry); + size_t vallen = value ? strlen(value) : 0; + char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1); + char *filter = slapi_ch_smprintf("(uniqueMember=%s)", escape_filter_value(value, vallen, filter_escaped_value)); + slapi_ch_free_string(&filter_escaped_value); + + Slapi_PBlock *search_pb = slapi_pblock_new(); + + for (be = slapi_get_first_backend(&cookie); be; + be = slapi_get_next_backend(cookie)) { + const Slapi_DN *base_sdn = slapi_be_getsuffix(be, 0); + if (base_sdn == NULL) { + continue; } + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_winsync_foreach_parent: Searching subtree %s for %s\n", + slapi_sdn_get_dn(base_sdn), + filter); + + slapi_search_internal_set_pb(search_pb, + slapi_sdn_get_dn(base_sdn), + LDAP_SCOPE_SUBTREE, + filter, + attrs, 0, NULL, NULL, + posix_winsync_get_plugin_identity(), 0); + slapi_search_internal_callback_pb(search_pb, callback_data, 0, callback, 0); + + slapi_pblock_init(search_pb); } - return 0; /* Doesn't have objectclass "posixGroup" */ + slapi_pblock_destroy(search_pb); + slapi_ch_free((void**)&cookie); + slapi_ch_free_string(&filter); } -int -modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) +/* Retrieve nested membership from chains of groups. + * Muid_vs in => any preexisting membership list + * out => the union of the input list and the total membership + * Muid_nested_vs out => the members of muid_vs "out" that weren't in muid_vs "in" + * deletions in => Any elements to NOT consider if members of base_sdn + */ +void +getMembershipFromDownward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, Slapi_ValueSet *muid_nested_vs, Slapi_ValueSet *deletions, const Slapi_DN *base_sdn, int depth) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: ==>\n"); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: entry name: %s\n", + slapi_entry_get_dn_const(entry)); + int rc = 0; + Slapi_Attr *um_attr = NULL; /* Entry attributes uniqueMember */ + Slapi_Value *uid_value = NULL; /* uniqueMember attribute values */ + + if (depth >= MAX_RECURSION_DEPTH) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: recursion limit reached: %d\n", depth); + return; + } + + rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr); + if (rc != 0 || um_attr == NULL) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward end: attribute uniquemember not found\n"); + return; + } + + int i; + for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1; + i = slapi_attr_next_value(um_attr, i, &uid_value)) { + + char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL }; + const char *uid_dn = slapi_value_get_string(uid_value); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: iterating uniqueMember: %s\n", + uid_dn); + + if (deletions && !slapi_sdn_compare(slapi_entry_get_sdn_const(entry), base_sdn)) { + if (slapi_valueset_find(um_attr, deletions, uid_value)) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: Skipping iteration because of deletion\n"); + + continue; + } + } + + Slapi_Entry *child = getEntry(uid_dn, attrs); + + if (!child) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward end: child not found: %s\n", uid_dn); + } + else { + /* PosixGroups except for the top one are already fully mapped out */ + if ((!hasObjectClass(entry, "posixGroup") || depth == 0) && + (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup"))) { + + /* Recurse downward */ + getMembershipFromDownward(child, muid_vs, muid_nested_vs, deletions, base_sdn, depth + 1); + } + + if (hasObjectClass(child, "posixAccount")) { + Slapi_Attr *uid_attr = NULL; + Slapi_Value *v = NULL; + if (slapi_entry_attr_find(child, "uid", &uid_attr) == 0) { + slapi_attr_first_value(uid_attr, &v); + + if (v && !slapi_valueset_find(uid_attr, muid_vs, v)) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: adding member: %s\n", + slapi_value_get_string(v)); + slapi_valueset_add_value(muid_vs, v); + slapi_valueset_add_value(muid_nested_vs, v); + } + } + } + slapi_entry_free(child); + } + } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "getMembershipFromDownward: <==\n"); +} + +struct propogateMembershipUpwardArgs { + Slapi_ValueSet *muid_vs; + int depth; +}; + +/* Forward declaration for next function */ +void propogateMembershipUpward(Slapi_Entry *, Slapi_ValueSet *, int); + +int +propogateMembershipUpwardCallback(Slapi_Entry *child, void *callback_data) +{ + struct propogateMembershipUpwardArgs *args = (struct propogateMembershipUpwardArgs *)(callback_data); + propogateMembershipUpward(child, args->muid_vs, args->depth); + return 0; +} + +void +propogateMembershipUpward(Slapi_Entry *entry, Slapi_ValueSet *muid_vs, int depth) +{ + if (depth >= MAX_RECURSION_DEPTH) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: recursion limit reached: %d\n", depth); + return; + } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: ==>\n"); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: entry name: %s\n", + slapi_entry_get_dn_const(entry)); + + Slapi_ValueSet *muid_here_vs = NULL; + Slapi_ValueSet *muid_upward_vs = NULL; + + /* Get the memberUids at this location, and figure out local changes to memberUid (if any) + * and changes to send upward. + */ + if (depth > 0 && hasObjectClass(entry, "posixGroup")) { + int addDynamicGroup = 0; + Slapi_Attr *muid_old_attr = NULL; + Slapi_ValueSet *muid_old_vs = NULL; + int rc = slapi_entry_attr_find(entry, "memberUid", &muid_old_attr); + if (rc != 0 || muid_old_attr == NULL) { /* Found no memberUid list, so create */ + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: no attribute memberUid\n"); + + /* There's no values from this entry to add */ + muid_upward_vs = muid_vs; + muid_here_vs = muid_vs; + } + else { + /* Eliminate duplicates */ + muid_upward_vs = slapi_valueset_new(); + muid_here_vs = slapi_valueset_new(); + + slapi_valueset_set_valueset(muid_upward_vs, muid_old_vs); + + slapi_attr_get_valueset(muid_old_attr, &muid_old_vs); + int i = 0; + Slapi_Value *v = NULL; + for (i = slapi_valueset_first_value(muid_vs, &v); i != -1; + i = slapi_valueset_next_value(muid_vs, i, &v)) { + + if (!slapi_valueset_find(muid_old_attr, muid_old_vs, v)) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: adding %s to set\n", + slapi_value_get_string(v)); + + addDynamicGroup = 1; + slapi_valueset_add_value(muid_here_vs, v); + slapi_valueset_add_value(muid_upward_vs, v); + } + } + } + + /* Update this group's membership */ + slapi_entry_add_valueset(entry, "memberUid", muid_here_vs); + if (addDynamicGroup) { + addDynamicGroupIfNecessary(entry, NULL); + slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_here_vs); + } + } + else { + muid_upward_vs = muid_vs; + } + + /* Find groups containing this one, recurse + */ + char *attrs[] = {"memberUid", "objectClass", NULL}; + struct propogateMembershipUpwardArgs data = {muid_upward_vs, depth + 1}; + + posix_winsync_foreach_parent(entry, attrs, propogateMembershipUpwardCallback, &data); + +/* Cleanup */ + if (muid_here_vs && muid_here_vs != muid_vs) { + slapi_valueset_free(muid_here_vs); muid_here_vs = NULL; + } + if (muid_upward_vs && muid_upward_vs != muid_vs) { + slapi_valueset_free(muid_upward_vs); muid_upward_vs = NULL; + } + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateMembershipUpward: <==\n"); +} + +struct propogateDeletionsUpwardArgs { + const Slapi_DN *base_sdn; + Slapi_ValueSet *smod_deluids; + Slapi_ValueSet *del_nested_vs; + int depth; +}; + +/* Forward declaration for next function */ +void propogateDeletionsUpward(Slapi_Entry *, const Slapi_DN *, Slapi_ValueSet*, Slapi_ValueSet *, int); + +int +propogateDeletionsUpwardCallback(Slapi_Entry *entry, void *callback_data) +{ + struct propogateDeletionsUpwardArgs *args = (struct propogateDeletionsUpwardArgs *)(callback_data); + propogateDeletionsUpward(entry, args->base_sdn, args->smod_deluids, args->del_nested_vs, args->depth); +} + +void +propogateDeletionsUpward(Slapi_Entry *entry, const Slapi_DN *base_sdn, Slapi_ValueSet *smod_deluids, Slapi_ValueSet *del_nested_vs, int depth) +{ + if (smod_deluids == NULL) return; + + if (depth >= MAX_RECURSION_DEPTH) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: recursion limit reached: %d\n", depth); + return; + } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: ==>\n"); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: entry name: %s\n", + slapi_entry_get_dn_const(entry)); + + char *attrs[] = { "uniqueMember", "memberUid", "objectClass", NULL }; + struct propogateDeletionsUpwardArgs data = {base_sdn, smod_deluids, del_nested_vs, depth + 1}; + posix_winsync_foreach_parent(entry, attrs, propogateDeletionsUpwardCallback, &data); + + Slapi_Attr *muid_attr = NULL; + int rc = slapi_entry_attr_find(entry, "dsOnlyMemberUid", &muid_attr); + + if (rc == 0 && muid_attr != NULL) { + + Slapi_ValueSet *muid_vs = slapi_valueset_new(); + Slapi_ValueSet *muid_nested_vs = slapi_valueset_new(); + Slapi_ValueSet *muid_deletions_vs = slapi_valueset_new(); + + getMembershipFromDownward(entry, muid_vs, muid_nested_vs, smod_deluids, base_sdn, 0); + + int i; + Slapi_Value *v; + for (i = slapi_attr_first_value(muid_attr, &v); i != -1; + i = slapi_attr_next_value(muid_attr, i, &v)) { + if (!slapi_valueset_find(muid_attr, muid_vs, v)) { + const char *uid = slapi_value_get_string(v); + if (depth == 0 && !uid_in_valueset(uid, smod_deluids)) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: Adding deletion to modlist: %s\n", + slapi_value_get_string(v)); + slapi_valueset_add_value(del_nested_vs, v); + } + else if (depth > 0) { + slapi_valueset_add_value(muid_deletions_vs, v); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: Adding deletion to deletion list: %s\n", + slapi_value_get_string(v)); + } + } + } + + if (depth > 0) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: executing deletion list\n"); + + Slapi_Mods *smods = slapi_mods_new(); + slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "memberuid", valueset_get_valuearray(muid_deletions_vs)); + slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "dsonlymemberuid", valueset_get_valuearray(muid_deletions_vs)); + + Slapi_PBlock *mod_pb = slapi_pblock_new(); + slapi_modify_internal_set_pb_ext(mod_pb, slapi_entry_get_sdn(entry), slapi_mods_get_ldapmods_passout(smods), 0, 0, + posix_winsync_get_plugin_identity(), 0); + slapi_modify_internal_pb(mod_pb); + slapi_pblock_destroy(mod_pb); + + slapi_mods_free(&smods); + } + + slapi_valueset_free(muid_vs); muid_vs = NULL; + slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL; + slapi_valueset_free(muid_deletions_vs); muid_deletions_vs = NULL; + } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "propogateDeletionsUpward: <==\n"); +} + +int +modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) +{ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: ==>\n"); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: Modding %s\n", + slapi_entry_get_dn_const(entry)); - if (!isPosixGroup(entry)) { + int posixGroup = hasObjectClass(entry, "posixGroup"); + + if (!(posixGroup || hasObjectClass(entry, "ntGroup"))) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "modGroupMembership end: Not a posixGroup or ntGroup\n"); return 0; } @@ -232,7 +642,7 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) Slapi_Mod *nextMod = slapi_mod_new(); int del_mod = 0; /* Bool: was there a delete mod? */ char **smod_adduids = NULL; - char **smod_deluids = NULL; + Slapi_ValueSet *smod_deluids = NULL; slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: posixGroup -> look for uniquemember\n"); @@ -243,15 +653,20 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) if (slapi_attr_types_equivalent(slapi_mod_get_type(smod), "uniqueMember")) { struct berval *bv; + int current_del_mod = SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod)); + if (current_del_mod) { + del_mod = 1; + } + for (bv = slapi_mod_get_first_value(smod); bv; bv = slapi_mod_get_next_value(smod)) { Slapi_Value *sv = slapi_value_new(); slapi_value_init_berval(sv, bv); /* copies bv_val */ - if (SLAPI_IS_MOD_DELETE(slapi_mod_get_operation(smod))) { - del_mod = 1; - slapi_ch_array_add(&smod_deluids, - slapi_ch_strdup(slapi_value_get_string(sv))); + if (current_del_mod) { + if (!smod_deluids) smod_deluids = slapi_valueset_new(); + + slapi_valueset_add_value(smod_deluids, sv); slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: add to deluids %s\n", bv->bv_val); @@ -268,60 +683,67 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) } slapi_mod_free(&nextMod); - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: entry is posixGroup\n"); - - Slapi_Attr * muid_attr = NULL; /* Entry attributes */ + int muid_rc = 0; + Slapi_Attr * muid_attr = NULL; /* Entry attributes */ + Slapi_ValueSet *muid_vs = NULL; Slapi_Value * uid_value = NULL; /* Attribute values */ - char **adduids = NULL; - char **moduids = NULL; - char **deluids = NULL; - int doModify = false; + Slapi_ValueSet *adduids = slapi_valueset_new(); + Slapi_ValueSet *add_nested_vs = slapi_valueset_new(); + Slapi_ValueSet *deluids = slapi_valueset_new(); + Slapi_ValueSet *del_nested_vs = slapi_valueset_new(); + + const Slapi_DN *base_sdn = slapi_entry_get_sdn_const(entry); + int j = 0; if (del_mod || smod_deluids != NULL) { do { /* Create a context to "break" from */ - Slapi_Attr * mu_attr = NULL; /* Entry attributes */ - rc = slapi_entry_attr_find(entry, "memberUid", &mu_attr); - if (rc != 0 || mu_attr == NULL) { - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership end: attribute memberUid not found\n"); - break; - } - /* found attribute uniquemember */ + muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr); + if (smod_deluids == NULL) { /* deletion of the last value, deletes the Attribut from entry complete, this operation has no value, so we must look by self */ Slapi_Attr * um_attr = NULL; /* Entry attributes */ Slapi_Value * uid_dn_value = NULL; /* Attribute values */ int rc = slapi_entry_attr_find(entry, "uniquemember", &um_attr); + if (rc != 0 || um_attr == NULL) { slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership end: attribute uniquemember not found\n"); break; } - /* found attribute uniquemember */ - /* ...loop for value... */ - for (j = slapi_attr_first_value(um_attr, &uid_dn_value); j != -1; - j = slapi_attr_next_value(um_attr, j, &uid_dn_value)) { - slapi_ch_array_add(&smod_deluids, - slapi_ch_strdup(slapi_value_get_string(uid_dn_value))); - } + + slapi_attr_get_valueset(um_attr, &smod_deluids); } - /* ...loop for value... */ - for (j = slapi_attr_first_value(mu_attr, &uid_value); j != -1; - j = slapi_attr_next_value(mu_attr, j, &uid_value)) { - /* remove from uniquemember: remove from memberUid also */ - const char *uid = NULL; + if (muid_rc != 0 || muid_attr == NULL) { slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: test dellist \n"); - uid = slapi_value_get_string(uid_value); - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: test dellist %s\n", uid); - if (uid_in_set(uid, smod_deluids)) { - slapi_ch_array_add(&deluids, slapi_ch_strdup(uid)); + "modGroupMembership end: attribute memberUid not found\n"); + } + else if (posix_winsync_config_get_mapMemberUid()) { + /* ...loop for value... */ + for (j = slapi_attr_first_value(muid_attr, &uid_value); j != -1; + j = slapi_attr_next_value(muid_attr, j, &uid_value)) { + /* remove from uniquemember: remove from memberUid also */ + const char *uid = NULL; slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: add to dellist %s\n", uid); - doModify = true; + "modGroupMembership: test dellist \n"); + uid = slapi_value_get_string(uid_value); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "modGroupMembership: test dellist %s\n", uid); + if (uid_in_valueset(uid, smod_deluids)) { + slapi_valueset_add_value(deluids, uid_value); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "modGroupMembership: add to dellist %s\n", uid); + } + } + } + + if (posix_winsync_config_get_mapNestedGrouping()) { + propogateDeletionsUpward(entry, base_sdn, smod_deluids, del_nested_vs, 0); + int i; + Slapi_Value *v; + for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1; + i = slapi_valueset_next_value(del_nested_vs, i, &v)) { + slapi_valueset_add_value(deluids, v); } } } while (false); @@ -331,93 +753,176 @@ modGroupMembership(Slapi_Entry *entry, Slapi_Mods *smods, int *do_modify) slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: posixGroup -> look for uniquemember\n"); - /* found attribute uniquemember */ - for (j = 0; smod_adduids[j]; j++) { - static char *uid = NULL; - uid_dn = smod_adduids[j]; - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: perform user %s\n", uid_dn); + if (muid_rc == 0 && muid_attr == NULL) { + muid_rc = slapi_entry_attr_find(entry, "memberUid", &muid_attr); + } + if (muid_rc == 0 && muid_attr != NULL) { + slapi_attr_get_valueset(muid_attr, &muid_vs); + } + else { + muid_vs = slapi_valueset_new(); + } - uid = searchUid(uid_dn); + if (posix_winsync_config_get_mapMemberUid()) { + for (j = 0; smod_adduids[j]; j++) { + static char *uid = NULL; - if (uid == NULL) { + uid_dn = smod_adduids[j]; slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: uid not found for %s, cannot do anything\n", - uid_dn); /* member on longer on server, do nothing */ - } else { - rc |= slapi_entry_attr_find(entry, "memberUid", &muid_attr); - if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create */ + "modGroupMembership: perform user %s\n", uid_dn); + + uid = searchUid(uid_dn); + + if (uid == NULL) { slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "modGroupMembership: no attribute memberUid, add with %s \n", - uid_dn); - slapi_ch_array_add(&adduids, uid); - uid = NULL; /* adduids now owns uid */ - doModify = true; - } else { /* Found a memberUid list, so modify */ - Slapi_ValueSet *vs = NULL; + "modGroupMembership: uid not found for %s, cannot do anything\n", + uid_dn); /* member on longer on server, do nothing */ + } else { Slapi_Value *v = slapi_value_new(); - slapi_value_init_string_passin(v, uid); - slapi_attr_get_valueset(muid_attr, &vs); - if (slapi_valueset_find(muid_attr, vs, v) != NULL) { /* already exist, all ok */ + + if (muid_rc == 0 && muid_attr != NULL && + slapi_valueset_find(muid_attr, muid_vs, v) != NULL) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: uid found in memberuid list %s nothing to do\n", uid); - } else { - slapi_ch_array_add(&moduids, uid); + } + else { + slapi_valueset_add_value(adduids, v); + slapi_valueset_add_value(muid_vs, v); slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: add to modlist %s\n", uid); - uid = NULL; /* adduids now owns uid */ - /* have to clear out v otherwise slapi_value_free will also free uid */ - slapi_value_init_berval(v, NULL); - doModify = true; } + slapi_value_free(&v); /* also frees uid since it was a passin */ - slapi_valueset_free(vs); vs = NULL; } } } + + if (posix_winsync_config_get_mapNestedGrouping()) { + + for (j = 0; smod_adduids[j]; ++j) { + char *attrs[] = { "uniqueMember", "memberUid", "uid", "objectClass", NULL }; + Slapi_Entry *child = getEntry(smod_adduids[j], attrs); + + if (child) { + if (hasObjectClass(child, "ntGroup") || hasObjectClass(child, "posixGroup")) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "modGroupMembership: Found mod to add group, adding membership: %s\n", + smod_adduids[j]); + Slapi_ValueSet *muid_tempnested = slapi_valueset_new(); + getMembershipFromDownward(child, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0); + + slapi_valueset_free(muid_tempnested); muid_tempnested = NULL; + } + } + else { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "modGroupMembership: entry not found for dn: %s\n", + smod_adduids[j]); + } + } + + getMembershipFromDownward(entry, muid_vs, add_nested_vs, smod_deluids, base_sdn, 0); + int i = 0; + Slapi_Value *v = NULL; + for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1; + i = slapi_valueset_next_value(add_nested_vs, i, &v)) { + slapi_valueset_add_value(adduids, v); + } + + propogateMembershipUpward(entry, adduids, 0); + } } - if (doModify) { + if (posixGroup) { + int addDynamicGroup = 0; int i; - for (i = 0; adduids && adduids[i]; i++) { - if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", adduids[i])) { - slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", adduids[i]); + Slapi_Value *v; + for (i = slapi_valueset_first_value(adduids, &v); i != -1; + i = slapi_valueset_next_value(adduids, i, &v)){ + const char *muid = slapi_value_get_string(v); + if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", muid)) { + *do_modify = 1; + slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", muid); + } + } + for (i = slapi_valueset_first_value(add_nested_vs, &v); i != -1; + i = slapi_valueset_next_value(add_nested_vs, i, &v)) { + const char *muid = slapi_value_get_string(v); + if (!smods_has_mod(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid)) { + addDynamicGroup = 1; + *do_modify = 1; + slapi_mods_add_string(smods, LDAP_MOD_ADD, "dsOnlyMemberUid", muid); } } - for (i = 0; moduids && moduids[i]; i++) { - if (!smods_has_mod(smods, LDAP_MOD_ADD, "memberUid", moduids[i])) { - slapi_mods_add_string(smods, LDAP_MOD_ADD, "memberUid", moduids[i]); + for (i = slapi_valueset_first_value(deluids, &v); i != -1; + i = slapi_valueset_next_value(deluids, i, &v)){ + const char *muid = slapi_value_get_string(v); + if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", muid)) { + *do_modify = 1; + slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", muid); } } - for (i = 0; deluids && deluids[i]; i++) { - if (!smods_has_mod(smods, LDAP_MOD_DELETE, "memberUid", deluids[i])) { - slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberUid", deluids[i]); + for (i = slapi_valueset_first_value(del_nested_vs, &v); i != -1; + i = slapi_valueset_next_value(del_nested_vs, i, &v)){ + const char *muid = slapi_value_get_string(v); + if (!smods_has_mod(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid)) { + *do_modify = 1; + slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsOnlyMemberUid", muid); } } + if (addDynamicGroup) { + addDynamicGroupIfNecessary(entry, smods); + } if (slapi_is_loglevel_set(SLAPI_LOG_PLUGIN)) slapi_mods_dump(smods, "memberUid - mods dump"); - *do_modify = 1; posix_winsync_config_set_MOFTaskCreated(); } slapi_ch_array_free(smod_adduids); smod_adduids = NULL; - slapi_ch_array_free(adduids); - adduids = NULL; - slapi_ch_array_free(smod_deluids); + if (smod_deluids) slapi_valueset_free(smod_deluids); smod_deluids = NULL; - slapi_ch_array_free(deluids); + + slapi_valueset_free(adduids); + adduids = NULL; + slapi_valueset_free(deluids); deluids = NULL; - slapi_ch_array_free(moduids); - moduids = NULL; + + slapi_valueset_free(add_nested_vs); add_nested_vs = NULL; + slapi_valueset_free(del_nested_vs); del_nested_vs = NULL; + + if (muid_vs) { + slapi_valueset_free(muid_vs); muid_vs = NULL; + } slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "modGroupMembership: <==\n"); return 0; } int +addUserToGroupMembership(Slapi_Entry *entry) +{ + Slapi_Attr *uid_attr = NULL; + Slapi_Value *v = NULL; + Slapi_ValueSet *muid_vs = slapi_valueset_new(); + + if (slapi_entry_attr_find(entry, "uid", &uid_attr) == 0) { + slapi_attr_first_value(uid_attr, &v); + + if (v) { + slapi_valueset_add_value(muid_vs, v); + } + } + + propogateMembershipUpward(entry, muid_vs, 0); + + slapi_valueset_free(muid_vs); muid_vs = NULL; +} + +int addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry) { int rc = 0; @@ -425,7 +930,11 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry) slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: ==>\n"); - if(!isPosixGroup(entry)) { + int posixGroup = hasObjectClass(entry, "posixGroup"); + + if(!(posixGroup || hasObjectClass(entry, "ntGroup"))) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "addGroupMembership: didn't find posixGroup or ntGroup objectclass\n"); return 0; } @@ -448,34 +957,55 @@ addGroupMembership(Slapi_Entry *entry, Slapi_Entry *ad_entry) if (rc != 0 || muid_attr == NULL) { /* Found no memberUid list, so create */ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: no attribute memberUid\n"); + muid_attr = NULL; } newvs = slapi_valueset_new(); /* ...loop for value... */ - for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1; - i = slapi_attr_next_value(um_attr, i, &uid_value)) { - const char *uid_dn = NULL; - static char *uid = NULL; - Slapi_Value *v = NULL; + if (posix_winsync_config_get_mapMemberUid()) { + for (i = slapi_attr_first_value(um_attr, &uid_value); i != -1; + i = slapi_attr_next_value(um_attr, i, &uid_value)) { + const char *uid_dn = NULL; + static char *uid = NULL; + Slapi_Value *v = NULL; - uid_dn = slapi_value_get_string(uid_value); - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "addGroupMembership: perform member %s\n", uid_dn); - uid = searchUid(uid_dn); - if (uid == NULL) { + uid_dn = slapi_value_get_string(uid_value); slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, - "addGroupMembership: uid not found for %s, cannot do anything\n", - uid_dn); /* member on longer on server, do nothing */ - } else { - v = slapi_value_new_string(uid); - slapi_ch_free_string(&uid); - if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) { - slapi_valueset_add_value(newvs, v); + "addGroupMembership: perform member %s\n", uid_dn); + uid = searchUid(uid_dn); + if (uid == NULL) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "addGroupMembership: uid not found for %s, cannot do anything\n", + uid_dn); /* member on longer on server, do nothing */ + } else { + v = slapi_value_new_string(uid); + slapi_ch_free_string(&uid); + if (slapi_attr_value_find(muid_attr, slapi_value_get_berval(v)) != 0) { + slapi_valueset_add_value(newvs, v); + } + slapi_value_free(&v); } - slapi_value_free(&v); } } - slapi_entry_add_valueset(entry, "memberUid", newvs); - slapi_valueset_free(newvs); + + if (posix_winsync_config_get_mapNestedGrouping()) { + Slapi_ValueSet *muid_nested_vs = slapi_valueset_new(); + + getMembershipFromDownward(entry, newvs, muid_nested_vs, NULL, NULL, 0); + propogateMembershipUpward(entry, newvs, 0); + + if (posixGroup) { + addDynamicGroupIfNecessary(entry, NULL); + slapi_entry_add_valueset(entry, "dsOnlyMemberUid", muid_nested_vs); + } + + slapi_valueset_free(muid_nested_vs); muid_nested_vs = NULL; + } + + if (posixGroup) { + slapi_entry_add_valueset(entry, "memberUid", newvs); + } + + slapi_valueset_free(newvs); newvs = NULL; posix_winsync_config_get_MOFTaskCreated(); slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "addGroupMembership: <==\n"); diff --git a/ldap/servers/plugins/posix-winsync/posix-group-task.c b/ldap/servers/plugins/posix-winsync/posix-group-task.c index e31064c..4555f1b 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-task.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-task.c @@ -25,11 +25,17 @@ typedef struct _cb_data } posix_group_data_data; */ +Slapi_Value ** +valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */ + /* interface function */ int posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg); +Slapi_Entry * +getEntry(const char *udn, char **attrs); + static void posix_group_task_destructor(Slapi_Task *task); static void @@ -67,6 +73,10 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode = LDAP_SUCCESS; + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: ==>\n"); + /* get arg(s) */ /* default: set replication basedn */ if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) { @@ -75,12 +85,18 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int goto out; } - if ((filter = fetch_attr(e, "filter", "(&(objectclass=posixGroup)(uniquemember=*))")) == NULL) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: retrieved basedn: %s\n", dn); + + if ((filter = fetch_attr(e, "filter", "(objectclass=ntGroup)")) == NULL) { *returncode = LDAP_OBJECT_CLASS_VIOLATION; rv = SLAPI_DSE_CALLBACK_ERROR; goto out; } + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: retrieved filter: %s\n", filter); + /* setup our task data */ mytaskdata = (task_data*) slapi_ch_malloc(sizeof(task_data)); if (mytaskdata == NULL) { @@ -91,19 +107,41 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int mytaskdata->dn = slapi_ch_strdup(dn); mytaskdata->filter_str = slapi_ch_strdup(filter); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: task data allocated\n"); + /* allocate new task now */ - task = slapi_new_task(slapi_entry_get_ndn(e)); + char * ndn = slapi_entry_get_ndn(e); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: creating task object: %s\n", + ndn); + + task = slapi_new_task(ndn); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: task object created\n"); /* register our destructor for cleaning up our private data */ slapi_task_set_destructor_fn(task, posix_group_task_destructor); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: task destructor set\n"); + /* Stash a pointer to our data in the task */ slapi_task_set_data(task, mytaskdata); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: task object initialized\n"); + /* start the sample task as a separate thread */ thread = PR_CreateThread(PR_USER_THREAD, posix_group_fixup_task_thread, (void *) task, PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD, PR_UNJOINABLE_THREAD, SLAPD_DEFAULT_THREAD_STACKSIZE); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: thread created\n"); + if (thread == NULL) { slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME, "unable to create task thread!\n"); @@ -114,7 +152,11 @@ posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int rv = SLAPI_DSE_CALLBACK_OK; } - out: return rv; + out: + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "posix_group_task_add: <==\n", filter); + + return rv; } static void @@ -195,86 +237,172 @@ posix_group_fix_memberuid(char *dn, char *filter_str, void *txn) static int posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data) { - int rc = 0; + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid ==>\n"); + cb_data *the_cb_data = (cb_data *) callback_data; + + int rc; + Slapi_Attr *muid_attr = NULL; + Slapi_Value *v = NULL; + + Slapi_Mods *smods = slapi_mods_new(); + char *dn = slapi_entry_get_dn(e); Slapi_DN *sdn = slapi_entry_get_sdn(e); - Slapi_Attr *obj_attr = NULL; +/* Clean out memberuids and dsonlymemberuids without a valid referant */ + rc = slapi_entry_attr_find(e, "memberuid", &muid_attr); + if (rc == 0 && muid_attr) { + Slapi_PBlock *search_pb = slapi_pblock_new(); + + Slapi_Attr *dsmuid_attr = NULL; + Slapi_ValueSet *dsmuid_vs = NULL; + + char *attrs[] = { "uid", NULL }; + + rc = slapi_entry_attr_find(e, "dsonlymemberuid", &dsmuid_attr); + if (rc == 0 && dsmuid_attr) { + slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs); + } + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid scan for orphaned memberuids\n"); + + int i; + for (i = slapi_attr_first_value(muid_attr, &v); i != -1; + i = slapi_attr_next_value(muid_attr, i, &v)) { + const char *muid = slapi_value_get_string(v); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid iterating memberuid: %s\n", + muid); + + size_t vallen = muid ? strlen(muid) : 0; + char *filter_escaped_value = slapi_ch_calloc(sizeof(char), vallen*3+1); + char *filter = slapi_ch_smprintf("(uid=%s)", escape_filter_value(muid, vallen, filter_escaped_value)); + slapi_ch_free_string(&filter_escaped_value); + + Slapi_Entry **search_entries = NULL; + + slapi_search_internal_set_pb(search_pb, + the_cb_data->dn, + LDAP_SCOPE_SUBTREE, + filter, + attrs, 0, NULL, NULL, + posix_winsync_get_plugin_identity(), 0); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid searching %s with filter: %s\n", + the_cb_data->dn, filter); + rc = slapi_search_internal_pb(search_pb); + + slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &search_entries); + + if (!search_entries || !search_entries[0]) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid Adding bad memberuid %s\n", + slapi_value_get_string(v)); + + slapi_mods_add_string(smods, LDAP_MOD_DELETE, "memberuid", slapi_value_get_string(v)); + + if (dsmuid_vs && slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid Adding bad dsonlymemberuid %s\n", + slapi_value_get_string(v)); + + slapi_mods_add_string(smods, LDAP_MOD_DELETE, "dsonlymemberuid", slapi_value_get_string(v)); + } + } + + slapi_free_search_results_internal(search_pb); + slapi_pblock_init(search_pb); + slapi_ch_free_string(&filter); + } + + if (dsmuid_vs) { + slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL; + } + + slapi_pblock_destroy(search_pb); search_pb = NULL; + } + + /* Cleanup uniquemembers without a referent, and verify memberuid otherwise */ + Slapi_Attr *obj_attr = NULL; rc = slapi_entry_attr_find(e, "uniquemember", &obj_attr); - if (rc == 0) { /* Found uniquemember, so... */ + if (rc == 0 && obj_attr) { + int fixMembership = 0; + Slapi_ValueSet *bad_ums = NULL; + int i; - Slapi_Value * value = slapi_value_new(); /* new memberuid Attribute values */ - Slapi_Value * uniqval = NULL; /* uniquemeber Attribute values */ - Slapi_ValueSet *uids = slapi_valueset_new(); + Slapi_Value * uniqval = NULL; /* uniquemeber Attribute values */ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "_fix_memberuid scan uniquemember, group %s\n", dn); for (i = slapi_attr_first_value(obj_attr, &uniqval); i != -1; i = slapi_attr_next_value(obj_attr, i, &uniqval)) { - const char *member = NULL; - char * uid = NULL; - member = slapi_value_get_string(uniqval); - /* search uid for member (DN) */ - slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, "search %s\n", member); - if ((uid = searchUid(member)) != NULL) { - slapi_value_set_string(value, uid); - /* add uids ValueSet */ - slapi_valueset_add_value(uids, value); + + const char *member = slapi_value_get_string(uniqval); + char *attrs[] = { "uid", "objectclass", NULL }; + Slapi_Entry *child = getEntry(member, attrs); + + if (!child) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid orphaned uniquemember found: %s\n", member); + + if (strncasecmp(member, "cn=", 3) == 0) { + fixMembership = 1; + } + if (!bad_ums) { + bad_ums = slapi_valueset_new(); + } + slapi_valueset_add_value(bad_ums, uniqval); } } - slapi_value_free(&value); - - /* If we found some posix members, replace the existing memberuid attribute - * with the found values. */ - if (uids && slapi_valueset_count(uids)) { - Slapi_PBlock *mod_pb = slapi_pblock_new(); - Slapi_Value *val = 0; - Slapi_Mod *smod; - LDAPMod **mods = (LDAPMod **) slapi_ch_malloc(2 * sizeof(LDAPMod *)); - int hint = 0; - cb_data *the_cb_data = (cb_data *) callback_data; - - smod = slapi_mod_new(); - slapi_mod_init(smod, 0); - slapi_mod_set_operation(smod, LDAP_MOD_REPLACE | LDAP_MOD_BVALUES); - slapi_mod_set_type(smod, "memberuid"); - - /* Loop through all of our values and add them to smod */ - hint = slapi_valueset_first_value(uids, &val); - while (val) { - /* this makes a copy of the berval */ - slapi_mod_add_value(smod, slapi_value_get_berval(val)); - hint = slapi_valueset_next_value(uids, hint, &val); - } - mods[0] = slapi_mod_get_ldapmod_passout(smod); - mods[1] = 0; + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid Finishing...\n"); - slapi_modify_internal_set_pb_ext(mod_pb, sdn, mods, 0, 0, - posix_winsync_get_plugin_identity(), 0); + if (fixMembership && posix_winsync_config_get_mapNestedGrouping()) { + Slapi_ValueSet *del_nested_vs = slapi_valueset_new(); - slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn); - slapi_modify_internal_pb(mod_pb); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid group deleted, recalculating nesting\n"); + propogateDeletionsUpward(e, sdn, bad_ums, del_nested_vs, 0); - slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); + slapi_valueset_free(del_nested_vs); del_nested_vs = NULL; + } - ldap_mods_free(mods, 1); - slapi_mod_free(&smod); - slapi_pblock_destroy(mod_pb); - } else { - /* No member were found, so remove the memberuid attribute - * from this entry. */ - posix_group_del_memberuid_callback(e, callback_data); + if (bad_ums) { + slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, "uniquemember", valueset_get_valuearray(bad_ums)); + slapi_valueset_free(bad_ums); bad_ums = NULL; } - slapi_valueset_free(uids); } + + Slapi_PBlock *mod_pb = slapi_pblock_new(); + + slapi_modify_internal_set_pb_ext(mod_pb, sdn, slapi_mods_get_ldapmods_passout(smods), 0, 0, + posix_winsync_get_plugin_identity(), 0); + + slapi_pblock_set(mod_pb, SLAPI_TXN, the_cb_data->txn); + slapi_modify_internal_pb(mod_pb); + + slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); + slapi_pblock_destroy(mod_pb); + + slapi_mods_free(&smods); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_fix_memberuid <==\n"); return rc; } static void posix_group_fixup_task_thread(void *arg) { + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_task_thread ==>\n"); + Slapi_Task *task = (Slapi_Task *) arg; task_data *td = NULL; int rc = 0; @@ -293,11 +421,18 @@ posix_group_fixup_task_thread(void *arg) /* release the memberOf operation lock */ memberUidUnlock(); + slapi_task_log_notice(task, "posix_group task finished."); slapi_task_log_status(task, "posix_group task finished."); slapi_task_inc_progress(task); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_task_thread finishing\n"); + /* this will queue the destruction of the task */ slapi_task_finish(task, rc); + + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_task_thread <==\n"); } diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync-config.c b/ldap/servers/plugins/posix-winsync/posix-winsync-config.c index a2d21be..a7fd6e9 100644 --- a/ldap/servers/plugins/posix-winsync/posix-winsync-config.c +++ b/ldap/servers/plugins/posix-winsync/posix-winsync-config.c @@ -142,6 +142,12 @@ posix_winsync_config_get_msSFUSchema() return theConfig.mssfuSchema; } +PRBool +posix_winsync_config_get_mapNestedGrouping() +{ + return theConfig.mapNestedGrouping; +} + Slapi_DN * posix_winsync_config_get_suffix() { @@ -182,6 +188,7 @@ posix_winsync_config(Slapi_Entry *config_e) theConfig.lowercase = PR_FALSE; theConfig.createMemberOfTask = PR_FALSE; theConfig.MOFTaskCreated = PR_FALSE; + theConfig.mapNestedGrouping = PR_FALSE; posix_winsync_apply_config(NULL, NULL, config_e, &returncode, returntext, NULL); /* config DSE must be initialized before we get here */ @@ -224,6 +231,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent PRBool createMemberOfTask = PR_FALSE; PRBool lowercase = PR_FALSE; Slapi_Attr *testattr = NULL; + PRBool mapNestedGrouping = PR_FALSE; *returncode = LDAP_UNWILLING_TO_PERFORM; /* be pessimistic */ @@ -257,6 +265,13 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent "_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_LOWER_CASE, lowercase); } + /* propogate memberuids in nested grouping */ + if (!slapi_entry_attr_find(e, POSIX_WINSYNC_MAP_NESTED_GROUPING, &testattr) && (NULL != testattr)) { + mapNestedGrouping = slapi_entry_attr_get_bool(e, POSIX_WINSYNC_MAP_NESTED_GROUPING); + slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, + "_apply_config: Config paramter %s: %d\n", POSIX_WINSYNC_MAP_NESTED_GROUPING, + mapNestedGrouping); + } /* if we got here, we have valid values for everything set the config entry */ slapi_lock_mutex(theConfig.lock); @@ -269,6 +284,7 @@ posix_winsync_apply_config(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Ent theConfig.mapMemberUID = mapMemberUID; theConfig.createMemberOfTask = createMemberOfTask; theConfig.lowercase = lowercase; + theConfig.mapNestedGrouping = mapNestedGrouping; /* success */ slapi_log_error(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME, diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c index 398541d..aa292c3 100644 --- a/ldap/servers/plugins/posix-winsync/posix-winsync.c +++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c @@ -68,7 +68,7 @@ #include "posix-wsp-ident.h" #include "posix-group-func.h" -#define MEMBEROFTASK "memberof task" +#define MEMBEROFTASK "memberuid task" Slapi_Value ** valueset_get_valuearray(const Slapi_ValueSet *vs); /* stolen from proto-slap.h */ void * @@ -103,6 +103,7 @@ static windows_attribute_map user_mssfu_attribute_map[] = { "msSFU30gecos", "gecos" }, { NULL, NULL } }; +/* memberUid must be first element or fixup in pre_ad_mod/add_group is required */ static windows_attribute_map group_attribute_map[] = { { "memberUid", "memberUid" }, { "gidNumber", "gidNumber" }, { NULL, NULL } }; @@ -661,7 +662,34 @@ posix_winsync_pre_ad_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla char *ad_type = NULL; int is_present_local; - slapi_attr_get_valueset(attr, &vs); + if (i == 0) { /* memberUid */ + Slapi_Attr *dsmuid_attr = NULL; + Slapi_Value *v = NULL; + slapi_entry_attr_find(ds_entry, "dsonlymemberuid", &dsmuid_attr); + + if (dsmuid_attr) { + Slapi_ValueSet *dsmuid_vs = NULL; + slapi_attr_get_valueset(dsmuid_attr, &dsmuid_vs); + if (dsmuid_vs) { + vs = slapi_valueset_new(); + + int j; + for (j = slapi_attr_first_value(attr, &v); j != -1; + j = slapi_attr_next_value(attr, i, &v)) { + if (!slapi_valueset_find(dsmuid_attr, dsmuid_vs, v)) { + slapi_valueset_add_value(vs, v); + } + } + + slapi_valueset_free(dsmuid_vs); dsmuid_vs = NULL; + } + } + } + + if (!vs) { + slapi_attr_get_valueset(attr, &vs); + } + ad_type = slapi_ch_strdup(attr_map[i].windows_attribute_name); slapi_entry_attr_find(ad_entry, ad_type, &ad_attr); is_present_local = (NULL == ad_attr) ? 0 : 1; @@ -810,6 +838,12 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap valueset_get_valuearray(oc_vs)); slapi_value_free(&oc_nv); slapi_valueset_free(oc_vs); + + if (posix_winsync_config_get_mapNestedGrouping()) { + memberUidLock(); + addUserToGroupMembership(ds_entry); + memberUidUnlock(); + } } } slapi_value_free(&voc); @@ -897,7 +931,7 @@ posix_winsync_pre_ds_mod_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "_pre_ds_mod_group_cb present %d modify %d before\n", is_present_local, do_modify_local); - if (posix_winsync_config_get_mapMemberUid()) { + if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) { memberUidLock(); modGroupMembership(ds_entry, smods, do_modify); memberUidUnlock(); @@ -999,6 +1033,13 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- _pre_ds_add_user_cb -- adding objectclass for new entry failed %d\n", rc); + else { + if (posix_winsync_config_get_mapNestedGrouping()) { + memberUidLock(); + addUserToGroupMembership(ds_entry); + memberUidUnlock(); + } + } } sync_acct_disable(cbdata, rawentry, ds_entry, ACCT_DISABLE_TO_DS, ds_entry, NULL, NULL); slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- _pre_ds_add_user_cb -- end\n"); @@ -1054,14 +1095,14 @@ posix_winsync_pre_ds_add_group_cb(void *cbdata, const Slapi_Entry *rawentry, Sla slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- _pre_ds_add_group_cb -- adding objectclass for new entry failed %d\n", rc); - } else { - if (posix_winsync_config_get_mapMemberUid()) { - memberUidLock(); - addGroupMembership(ds_entry, ad_entry); - memberUidUnlock(); - } } } + if (posix_winsync_config_get_mapMemberUid() || posix_winsync_config_get_mapNestedGrouping()) { + memberUidLock(); + addGroupMembership(ds_entry, ad_entry); + memberUidUnlock(); + } + slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "<-- posix_winsync_pre_ds_add_group_cb -- end\n"); @@ -1274,7 +1315,7 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap "--> posix_winsync_end_update_cb -- begin %d %d\n", posix_winsync_config_get_MOFTaskCreated(), posix_winsync_config_get_createMOFTask()); - if (posix_winsync_config_get_MOFTaskCreated() && posix_winsync_config_get_createMOFTask()) { + if (1 && posix_winsync_config_get_createMOFTask()) { /* add a task to schedule memberof Plugin for fix memebrof attributs */ Slapi_PBlock *pb = slapi_pblock_new(); Slapi_Entry *e_task = slapi_entry_alloc(); @@ -1291,13 +1332,24 @@ posix_winsync_end_update_cb(void *cbdata, const Slapi_DN *ds_subtree, const Slap posix_winsync_plugin_name, MEMBEROFTASK); return; } + + slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, + "--> posix_winsync_end_update_cb, init'ing task\n"); + slapi_entry_init(e_task, slapi_ch_strdup(dn), NULL); slapi_entry_add_string(e_task, "cn", slapi_ch_strdup(posix_winsync_plugin_name)); slapi_entry_add_string(e_task, "objectClass", "extensibleObject"); slapi_entry_add_string(e_task, "basedn", slapi_sdn_get_dn(ds_subtree)); slapi_add_entry_internal_set_pb(pb, e_task, NULL, posix_winsync_get_plugin_identity(), 0); + + + slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, + "--> posix_winsync_end_update_cb, adding task\n"); slapi_add_internal_pb(pb); + + slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, + "--> posix_winsync_end_update_cb, retrieving return code\n"); slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); if (rc != 0) { slapi_log_error(SLAPI_LOG_FATAL, posix_winsync_plugin_name, diff --git a/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h b/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h index 43a23df..f36fe40 100644 --- a/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h +++ b/ldap/servers/plugins/posix-winsync/posix-wsp-ident.h @@ -17,7 +17,7 @@ #define POSIX_WINSYNC_MAP_MEMBERUID "posixWinsyncMapMemberUID" #define POSIX_WINSYNC_CREATE_MEMBEROFTASK "posixWinsyncCreateMemberOfTask" #define POSIX_WINSYNC_LOWER_CASE "posixWinsyncLowerCaseUID" - +#define POSIX_WINSYNC_MAP_NESTED_GROUPING "posixWinsyncMapNestedGrouping" void * posix_winsync_get_plugin_identity(); @@ -29,6 +29,7 @@ typedef struct posix_winsync_config_struct { PRBool lowercase; /* store the uid in group memberuid in lower case */ PRBool createMemberOfTask; /* should memberOf Plugin Task run after AD sync */ PRBool MOFTaskCreated; + PRBool mapNestedGrouping; Slapi_DN *rep_suffix; /* namingContext in DS of the replicated suffix */ } POSIX_WinSync_Config; @@ -42,6 +43,7 @@ Slapi_DN *posix_winsync_config_get_suffix(); void posix_winsync_config_reset_MOFTaskCreated(); void posix_winsync_config_set_MOFTaskCreated(); PRBool posix_winsync_config_get_MOFTaskCreated(); +PRBool posix_winsync_config_get_mapNestedGrouping(); int posix_group_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, -- 1.7.7.6