|
 |
ced1f5 |
From 118860519777791368520f4e92ecbf2ef60cb7db Mon Sep 17 00:00:00 2001
|
|
|
ced1f5 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
ced1f5 |
Date: Mon, 20 Nov 2017 16:45:45 +0100
|
|
|
ced1f5 |
Subject: [PATCH 67/67] ipa: compare DNs instead of group names in
|
|
|
ced1f5 |
ipa_s2n_save_objects()
|
|
|
ced1f5 |
MIME-Version: 1.0
|
|
|
ced1f5 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ced1f5 |
Content-Transfer-Encoding: 8bit
|
|
|
ced1f5 |
|
|
|
ced1f5 |
If group names are used to compare the current list of group memberships
|
|
|
ced1f5 |
returned by the server with the one from the cache some groups might end
|
|
|
ced1f5 |
up in the wrong result list if group names are overridden. This
|
|
|
ced1f5 |
ambiguity can be resolved by using the DNs of the cached objects.
|
|
|
ced1f5 |
|
|
|
ced1f5 |
Related to https://pagure.io/SSSD/sssd/issue/3579
|
|
|
ced1f5 |
|
|
|
ced1f5 |
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
ced1f5 |
(cherry picked from commit a52226c651308a0a7732544b492eb4db56b84f1d)
|
|
|
ced1f5 |
---
|
|
|
ced1f5 |
src/providers/ipa/ipa_s2n_exop.c | 31 ++++++++++++-------------------
|
|
|
ced1f5 |
1 file changed, 12 insertions(+), 19 deletions(-)
|
|
|
ced1f5 |
|
|
|
ced1f5 |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
index 49c393e9a1eb19ab683949cf633a6838274bc0fe..8b97f78620f19b0708e8a480cb72fd7f12d96dfb 100644
|
|
|
ced1f5 |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ced1f5 |
@@ -2185,10 +2185,9 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
ced1f5 |
struct ldb_result *res;
|
|
|
ced1f5 |
enum sysdb_member_type type;
|
|
|
ced1f5 |
char **sysdb_grouplist;
|
|
|
ced1f5 |
- char **add_groups;
|
|
|
ced1f5 |
char **add_groups_dns;
|
|
|
ced1f5 |
- char **del_groups;
|
|
|
ced1f5 |
char **del_groups_dns;
|
|
|
ced1f5 |
+ char **groups_dns;
|
|
|
ced1f5 |
bool in_transaction = false;
|
|
|
ced1f5 |
int tret;
|
|
|
ced1f5 |
struct sysdb_attrs *gid_override_attrs = NULL;
|
|
|
ced1f5 |
@@ -2514,33 +2513,27 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
if (attrs->response_type == RESP_USER_GROUPLIST) {
|
|
|
ced1f5 |
- ret = get_sysdb_grouplist(tmp_ctx, dom->sysdb, dom, name,
|
|
|
ced1f5 |
- &sysdb_grouplist);
|
|
|
ced1f5 |
+ ret = get_sysdb_grouplist_dn(tmp_ctx, dom->sysdb, dom, name,
|
|
|
ced1f5 |
+ &sysdb_grouplist);
|
|
|
ced1f5 |
if (ret != EOK) {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "get_sysdb_grouplist failed.\n");
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = diff_string_lists(tmp_ctx, attrs->groups,
|
|
|
ced1f5 |
- sysdb_grouplist, &add_groups,
|
|
|
ced1f5 |
- &del_groups, NULL);
|
|
|
ced1f5 |
+ ret = get_groups_dns(tmp_ctx, dom, attrs->groups, &groups_dns);
|
|
|
ced1f5 |
+ if (ret != EOK) {
|
|
|
ced1f5 |
+ DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n");
|
|
|
ced1f5 |
+ goto done;
|
|
|
ced1f5 |
+ }
|
|
|
ced1f5 |
+
|
|
|
ced1f5 |
+ ret = diff_string_lists(tmp_ctx, groups_dns,
|
|
|
ced1f5 |
+ sysdb_grouplist, &add_groups_dns,
|
|
|
ced1f5 |
+ &del_groups_dns, NULL);
|
|
|
ced1f5 |
if (ret != EOK) {
|
|
|
ced1f5 |
DEBUG(SSSDBG_OP_FAILURE, "diff_string_lists failed.\n");
|
|
|
ced1f5 |
goto done;
|
|
|
ced1f5 |
}
|
|
|
ced1f5 |
|
|
|
ced1f5 |
- ret = get_groups_dns(tmp_ctx, dom, add_groups, &add_groups_dns);
|
|
|
ced1f5 |
- if (ret != EOK) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n");
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
-
|
|
|
ced1f5 |
- ret = get_groups_dns(tmp_ctx, dom, del_groups, &del_groups_dns);
|
|
|
ced1f5 |
- if (ret != EOK) {
|
|
|
ced1f5 |
- DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n");
|
|
|
ced1f5 |
- goto done;
|
|
|
ced1f5 |
- }
|
|
|
ced1f5 |
-
|
|
|
ced1f5 |
DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n",
|
|
|
ced1f5 |
name);
|
|
|
ced1f5 |
ret = sysdb_update_members_dn(dom, name, SYSDB_MEMBER_USER,
|
|
|
ced1f5 |
--
|
|
|
ced1f5 |
2.14.3
|
|
|
ced1f5 |
|