|
 |
403b09 |
From 6c69ea75765b93768ccc3cf55a4813f2d4b81dac Mon Sep 17 00:00:00 2001
|
|
|
403b09 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
403b09 |
Date: Sun, 7 Aug 2016 21:42:14 +0300
|
|
|
403b09 |
Subject: [PATCH] ipa-kdb: simplify trusted domain parent search
|
|
|
403b09 |
|
|
|
403b09 |
In terms of cross-forest trust parent domain is the root domain of
|
|
|
403b09 |
the forest because we only have trust established with the forest root.
|
|
|
403b09 |
|
|
|
403b09 |
In FreeIPA LDAP store all sub-domains stored in cn=<forest root>,
|
|
|
403b09 |
cn=ad,cn=trusts,... subtree. Thus, a first RDN after cn=ad is the
|
|
|
403b09 |
forest root domain. This allows us to simplify logic of finding
|
|
|
403b09 |
the parent domain.
|
|
|
403b09 |
|
|
|
403b09 |
For complex hierachical forests with more than two levels of
|
|
|
403b09 |
sub-domains, this will still be true because of the forest trust:
|
|
|
403b09 |
as forest trust is established to the forest root domain, any
|
|
|
403b09 |
communication to any sub-domain must traverse forest root domain's
|
|
|
403b09 |
domain controller.
|
|
|
403b09 |
|
|
|
403b09 |
Note that SSSD also generated incorrectly CA paths information
|
|
|
403b09 |
for forests with non-hierarchical tree-roots. In such cases
|
|
|
403b09 |
IPA KDC got confused and mistakenly assumed direct trust to the
|
|
|
403b09 |
non-hierarchical tree-root instead of going through the forest
|
|
|
403b09 |
root domain. See https://fedorahosted.org/sssd/ticket/3103 for
|
|
|
403b09 |
details.
|
|
|
403b09 |
|
|
|
403b09 |
Resolves: https://fedorahosted.org/freeipa/ticket/5738
|
|
|
403b09 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
403b09 |
---
|
|
|
403b09 |
daemons/ipa-kdb/ipa_kdb_mspac.c | 27 ++++++++++++++-------------
|
|
|
403b09 |
1 file changed, 14 insertions(+), 13 deletions(-)
|
|
|
403b09 |
|
|
|
403b09 |
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
403b09 |
index 80e7055fd6cd7b962eeffbccc675a73d73700793..76e9e99d0b691d06ccc86e0e851fb7e226d62597 100644
|
|
|
403b09 |
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
403b09 |
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
|
|
403b09 |
@@ -2420,6 +2420,7 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
|
|
|
403b09 |
char *base = NULL;
|
|
|
403b09 |
char *dnstr = NULL;
|
|
|
403b09 |
char *dnl = NULL;
|
|
|
403b09 |
+ LDAPDN dn = NULL;
|
|
|
403b09 |
char **sid_blacklist_incoming = NULL;
|
|
|
403b09 |
char **sid_blacklist_outgoing = NULL;
|
|
|
403b09 |
int ret, n, i;
|
|
|
403b09 |
@@ -2547,26 +2548,26 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
|
|
|
403b09 |
goto done;
|
|
|
403b09 |
}
|
|
|
403b09 |
|
|
|
403b09 |
- /* Note that after ldap_str2rdn() call dnl will point to end of one RDN
|
|
|
403b09 |
- * which would be '\0' for trust root domain and ',' for subdomain */
|
|
|
403b09 |
dnl--; dnl[0] = '\0';
|
|
|
403b09 |
- ret = ldap_str2rdn(dnstr, &rdn, &dnl, LDAP_DN_FORMAT_LDAPV3);
|
|
|
403b09 |
+ /* Create a DN, which is now everything before the base,
|
|
|
403b09 |
+ * to get list of rdn values -- the last one would be a root domain.
|
|
|
403b09 |
+ * Since with cross-forest trust we have to route everything via root
|
|
|
403b09 |
+ * domain, that is enough for us to assign parentship. */
|
|
|
403b09 |
+ ret = ldap_str2dn(dnstr, &dn, LDAP_DN_FORMAT_LDAPV3);
|
|
|
403b09 |
if (ret) {
|
|
|
403b09 |
goto done;
|
|
|
403b09 |
}
|
|
|
403b09 |
|
|
|
403b09 |
- ldap_rdnfree(rdn);
|
|
|
403b09 |
-
|
|
|
403b09 |
- if (dnl[0] != '\0') {
|
|
|
403b09 |
- dnl++;
|
|
|
403b09 |
- ret = ldap_str2rdn(dnl, &rdn, &dnl, LDAP_DN_FORMAT_LDAPV3);
|
|
|
403b09 |
- if (ret) {
|
|
|
403b09 |
- goto done;
|
|
|
403b09 |
- }
|
|
|
403b09 |
- t[n].parent_name = strndup(rdn[0]->la_value.bv_val, rdn[0]->la_value.bv_len);
|
|
|
403b09 |
- ldap_rdnfree(rdn);
|
|
|
403b09 |
+ rdn = NULL;
|
|
|
403b09 |
+ for (i = 0; dn[i] != NULL; i++) {
|
|
|
403b09 |
+ rdn = dn[i];
|
|
|
403b09 |
}
|
|
|
403b09 |
|
|
|
403b09 |
+ /* We should have a single AVA in the domain RDN */
|
|
|
403b09 |
+ t[n].parent_name = strndup(rdn[0]->la_value.bv_val, rdn[0]->la_value.bv_len);
|
|
|
403b09 |
+
|
|
|
403b09 |
+ ldap_dnfree(dn);
|
|
|
403b09 |
+
|
|
|
403b09 |
free(dnstr);
|
|
|
403b09 |
dnstr = NULL;
|
|
|
403b09 |
}
|
|
|
403b09 |
--
|
|
|
403b09 |
2.7.4
|
|
|
403b09 |
|