From ef6d1aaaa416bca3318e2961269620db7720a55b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
Date: Tue, 11 Apr 2017 19:56:37 +0200
Subject: [PATCH 117/118] SDAP: Fix handling of search bases
We were rewriting the sdap_domain's search bases for only the first
sdap_domain in the list, which does not work for subdomains.
Also when search bases were already initialized in sdap_domain_subdom_add,
we should only rewrite them when they were explicitly set in sssd.conf.
Resolves:
https://pagure.io/SSSD/sssd/issue/3351
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
(cherry picked from commit 4c49edbd8df651b1737c59459637962c117212c6)
---
src/providers/ad/ad_common.c | 39 +++++++++++++++++++++----------
src/providers/ad/ad_common.h | 3 ++-
src/providers/ipa/ipa_subdomains_server.c | 2 +-
src/providers/ldap/ldap_options.c | 2 --
4 files changed, 30 insertions(+), 16 deletions(-)
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index f893b748a2ddcff1eab6e8d919d2aa950b825446..1a9d8dc0bfdf18e76e3c97a7ac7e297c4d24fd44 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -29,7 +29,8 @@ struct ad_server_data {
bool gc;
};
-errno_t ad_set_search_bases(struct sdap_options *id_opts);
+errno_t ad_set_search_bases(struct sdap_options *id_opts,
+ struct sdap_domain *sdap);
static errno_t ad_set_sdap_options(struct ad_options *ad_opts,
struct sdap_options *id_opts);
@@ -1074,7 +1075,7 @@ ad_get_id_options(struct ad_options *ad_opts,
}
/* Set up search bases if they were assigned explicitly */
- ret = ad_set_search_bases(id_opts);
+ ret = ad_set_search_bases(id_opts, NULL);
if (ret != EOK) {
talloc_free(id_opts);
return ret;
@@ -1116,11 +1117,14 @@ ad_get_autofs_options(struct ad_options *ad_opts,
}
errno_t
-ad_set_search_bases(struct sdap_options *id_opts)
+ad_set_search_bases(struct sdap_options *id_opts,
+ struct sdap_domain *sdom)
{
errno_t ret;
- char *default_search_base;
+ char *default_search_base = NULL;
size_t o;
+ struct sdap_domain *sdap_dom;
+ bool has_default;
const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
SDAP_GROUP_SEARCH_BASE,
SDAP_NETGROUP_SEARCH_BASE,
@@ -1132,10 +1136,21 @@ ad_set_search_bases(struct sdap_options *id_opts)
* been specifically overridden.
*/
- default_search_base =
- dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE);
+ if (sdom != NULL) {
+ sdap_dom = sdom;
+ } else {
+ /* If no specific sdom was given, use the first in the list. */
+ sdap_dom = id_opts->sdom;
+ }
- if (default_search_base) {
+ has_default = sdap_dom->search_bases != NULL;
+
+ if (has_default == false) {
+ default_search_base =
+ dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE);
+ }
+
+ if (default_search_base && has_default == false) {
/* set search bases if they are not */
for (o = 0; search_base_options[o] != -1; o++) {
if (NULL == dp_opt_get_string(id_opts->basic,
@@ -1162,31 +1177,31 @@ ad_set_search_bases(struct sdap_options *id_opts)
/* Default search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_SEARCH_BASE,
- &id_opts->sdom->search_bases);
+ &sdap_dom->search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* User search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_USER_SEARCH_BASE,
- &id_opts->sdom->user_search_bases);
+ &sdap_dom->user_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Group search base */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_GROUP_SEARCH_BASE,
- &id_opts->sdom->group_search_bases);
+ &sdap_dom->group_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Netgroup search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_NETGROUP_SEARCH_BASE,
- &id_opts->sdom->netgroup_search_bases);
+ &sdap_dom->netgroup_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Service search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_SERVICE_SEARCH_BASE,
- &id_opts->sdom->service_search_bases);
+ &sdap_dom->service_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
ret = EOK;
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index 2981550f6c390929501ec8942e861b16ea0a5cb0..ce33b37c75f45ae72adb268858cce34759b8b02f 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -130,7 +130,8 @@ struct ad_options *ad_create_1way_trust_options(TALLOC_CTX *mem_ctx,
const char *keytab,
const char *sasl_authid);
-errno_t ad_set_search_bases(struct sdap_options *id_opts);
+errno_t ad_set_search_bases(struct sdap_options *id_opts,
+ struct sdap_domain *sdap);
errno_t
ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *ctx,
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
index e8ee30392d84f84e30bcdaa3d2110ba130b1ad73..b02ea67af964a03e5466067cdb2b3ba4498120eb 100644
--- a/src/providers/ipa/ipa_subdomains_server.c
+++ b/src/providers/ipa/ipa_subdomains_server.c
@@ -332,7 +332,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
return EFAULT;
}
- ret = ad_set_search_bases(ad_options->id);
+ ret = ad_set_search_bases(ad_options->id, sdom);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD search bases\n");
talloc_free(ad_options);
diff --git a/src/providers/ldap/ldap_options.c b/src/providers/ldap/ldap_options.c
index 15a2609f07506b6dd442b180651a7e25461976c0..eb4e177b456253ebdfa06ee52886a5dffe0d3351 100644
--- a/src/providers/ldap/ldap_options.c
+++ b/src/providers/ldap/ldap_options.c
@@ -581,8 +581,6 @@ errno_t sdap_parse_search_base(TALLOC_CTX *mem_ctx,
char *unparsed_base;
const char *old_filter = NULL;
- *_search_bases = NULL;
-
switch (class) {
case SDAP_SEARCH_BASE:
class_name = "DEFAULT";
--
2.9.3