|
 |
5fca41 |
From c9c2b60128b7faa29615123de79ed206491396a9 Mon Sep 17 00:00:00 2001
|
|
|
5fca41 |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
5fca41 |
Date: Thu, 30 May 2019 10:48:07 +0200
|
|
|
5fca41 |
Subject: [PATCH 38/44] ad: remove subdomain that has been disabled through
|
|
|
5fca41 |
ad_enabled_domains from sysdb
|
|
|
5fca41 |
|
|
|
5fca41 |
If previously enabled subdomain was disabled by removing it from ad_enabled_domains
|
|
|
5fca41 |
option in sssd.conf, its cached content (including the domain object itself)
|
|
|
5fca41 |
was kept in sysdb. Therefore eventhough the domain was effectively disabled in
|
|
|
5fca41 |
backed its cached data was still available in responders.
|
|
|
5fca41 |
|
|
|
5fca41 |
Subdomains that are disabled on server side are correctly removed from sysdb in
|
|
|
5fca41 |
`ad_subdomains_refresh()` so this issue is related only to the configuration
|
|
|
5fca41 |
option.
|
|
|
5fca41 |
|
|
|
5fca41 |
Resolves:
|
|
|
5fca41 |
https://pagure.io/SSSD/sssd/issue/4009
|
|
|
5fca41 |
|
|
|
5fca41 |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
5fca41 |
(cherry picked from commit 815957cd10a82aca6742b0bd56c7e7f199596cd4)
|
|
|
5fca41 |
---
|
|
|
5fca41 |
src/providers/ad/ad_subdomains.c | 9 +++++++++
|
|
|
5fca41 |
1 file changed, 9 insertions(+)
|
|
|
5fca41 |
|
|
|
5fca41 |
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
|
|
|
5fca41 |
index b4e09fb7e..a3906e994 100644
|
|
|
5fca41 |
--- a/src/providers/ad/ad_subdomains.c
|
|
|
5fca41 |
+++ b/src/providers/ad/ad_subdomains.c
|
|
|
5fca41 |
@@ -825,6 +825,15 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
|
|
|
5fca41 |
|
|
|
5fca41 |
if (is_domain_enabled(sd_name, enabled_domains_list) == false) {
|
|
|
5fca41 |
DEBUG(SSSDBG_TRACE_FUNC, "Disabling subdomain %s\n", sd_name);
|
|
|
5fca41 |
+
|
|
|
5fca41 |
+ /* The subdomain is now disabled in configuraiton file, we
|
|
|
5fca41 |
+ * need to delete its cached content so it is not returned
|
|
|
5fca41 |
+ * by responders. The subdomain shares sysdb with its parent
|
|
|
5fca41 |
+ * domain so it is OK to use domain->sysdb. */
|
|
|
5fca41 |
+ ret = sysdb_subdomain_delete(domain->sysdb, sd_name);
|
|
|
5fca41 |
+ if (ret != EOK) {
|
|
|
5fca41 |
+ goto fail;
|
|
|
5fca41 |
+ }
|
|
|
5fca41 |
continue;
|
|
|
5fca41 |
} else {
|
|
|
5fca41 |
DEBUG(SSSDBG_TRACE_FUNC, "Enabling subdomain %s\n", sd_name);
|
|
|
5fca41 |
--
|
|
|
5fca41 |
2.20.1
|
|
|
5fca41 |
|