Blame SOURCES/0004-AD-Allow-configuring-auto_private_groups-per-subdoma.patch

841ac7
From 6f6b3b1f4fcec79a1640a97fb3cd875f2cd8b83a Mon Sep 17 00:00:00 2001
841ac7
From: Jakub Hrozek <jhrozek@redhat.com>
841ac7
Date: Tue, 19 Mar 2019 11:01:10 +0100
841ac7
Subject: [PATCH] AD: Allow configuring auto_private_groups per subdomain or
841ac7
 with subdomain_inherit
841ac7
MIME-Version: 1.0
841ac7
Content-Type: text/plain; charset=UTF-8
841ac7
Content-Transfer-Encoding: 8bit
841ac7
841ac7
Resolves:
841ac7
https://pagure.io/SSSD/sssd/issue/3965
841ac7
841ac7
Previously, subdomains that used ID mapping always only used MPGs and
841ac7
POSIX subdomains always inherited the parent domain settings. This patch
841ac7
is a small RFE which allows to either set the auto_private_groups option
841ac7
directly per subdomain or set it for all subdomains using the
841ac7
subdomain_inherit option
841ac7
841ac7
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
841ac7
(cherry picked from commit 41c497b8b9e6efb9f2aa8e4cc869d465c3b954b3)
841ac7
---
841ac7
 src/man/sssd.conf.5.xml               |  38 +++++----
841ac7
 src/providers/ad/ad_subdomains.c      | 107 ++++++++++++++++++++++----
841ac7
 src/providers/ldap/sdap_async_users.c |   2 +-
841ac7
 src/util/domain_info_utils.c          |  14 +++-
841ac7
 src/util/util.h                       |   3 +
841ac7
 5 files changed, 130 insertions(+), 34 deletions(-)
841ac7
841ac7
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
841ac7
index 41ba7b924..3d017f638 100644
841ac7
--- a/src/man/sssd.conf.5.xml
841ac7
+++ b/src/man/sssd.conf.5.xml
841ac7
@@ -2995,6 +2995,13 @@ subdomain_inherit = ldap_purge_cache_timeout
841ac7
                                             Create user's private group unconditionally from user's UID number.
841ac7
                                             The GID number is ignored in this case.
841ac7
                                         </para>
841ac7
+                                        <para>
841ac7
+                                            NOTE: Because the GID number and the user private group
841ac7
+                                            are inferred from the UID number, it is not supported
841ac7
+                                            to have multiple entries with the same UID or GID number
841ac7
+                                            with this option. In other words, enabling this option
841ac7
+                                            enforces uniqueness across the ID space.
841ac7
+                                        </para>
841ac7
                                     </listitem>
841ac7
                                 </varlistentry>
841ac7
                                 <varlistentry>
841ac7
@@ -3041,24 +3048,25 @@ subdomain_inherit = ldap_purge_cache_timeout
841ac7
                                 </varlistentry>
841ac7
                             </variablelist>
841ac7
                         </para>
841ac7
-			<para>
841ac7
-			    For POSIX subdomains, setting the option in the main
841ac7
-			    domain is inherited in the subdomain.
841ac7
-			</para>
841ac7
-			<para>
841ac7
-			    For ID-mapping subdomains, auto_private_groups is
841ac7
-			    already enabled for the subdomains and setting it to
841ac7
-			    false will not have any effect for the subdomain.
841ac7
-			</para>
841ac7
                         <para>
841ac7
-                            NOTE: Because the GID number and the user private group
841ac7
-                            are inferred from the UID number, it is not supported
841ac7
-                            to have multiple entries with the same UID or GID number
841ac7
-                            with this option. In other words, enabling this option
841ac7
-                            enforces uniqueness across the ID space.
841ac7
+                            For subdomains, the default value is False for
841ac7
+                            subdomains that use assigned POSIX IDs and True
841ac7
+                            for subdomains that use automatic ID-mapping.
841ac7
                         </para>
841ac7
                         <para>
841ac7
-                            Default: False
841ac7
+                            The value of auto_private_groups can either be set per subdomains
841ac7
+                            in a subsection, for example:
841ac7
+<programlisting>
841ac7
+[domain/forest.domain/sub.domain]
841ac7
+auto_private_groups = false
841ac7
+</programlisting>
841ac7
+                            or globally for all subdomains in the main domain section
841ac7
+                            using the subdomain_inherit option:
841ac7
+<programlisting>
841ac7
+[domain/forest.domain]
841ac7
+subdomain_inherit = auto_private_groups
841ac7
+auto_private_groups = false
841ac7
+</programlisting>
841ac7
                         </para>
841ac7
                     </listitem>
841ac7
                 </varlistentry>
841ac7
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
841ac7
index 5b046773c..4fc4be094 100644
841ac7
--- a/src/providers/ad/ad_subdomains.c
841ac7
+++ b/src/providers/ad/ad_subdomains.c
841ac7
@@ -436,8 +436,87 @@ static errno_t ad_subdom_enumerates(struct sss_domain_info *parent,
841ac7
     return EOK;
841ac7
 }
841ac7
 
841ac7
+static enum sss_domain_mpg_mode
841ac7
+get_default_subdom_mpg_mode(struct sdap_idmap_ctx *idmap_ctx,
841ac7
+                            struct sss_domain_info *parent,
841ac7
+                            const char *subdom_name,
841ac7
+                            char *subdom_sid_str)
841ac7
+{
841ac7
+    bool use_id_mapping;
841ac7
+    bool inherit_option;
841ac7
+    enum sss_domain_mpg_mode default_mpg_mode;
841ac7
+
841ac7
+    inherit_option = string_in_list(CONFDB_DOMAIN_AUTO_UPG,
841ac7
+                                    parent->sd_inherit, false);
841ac7
+    if (inherit_option) {
841ac7
+        return get_domain_mpg_mode(parent);
841ac7
+    }
841ac7
+
841ac7
+    use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(idmap_ctx,
841ac7
+                                                               subdom_name,
841ac7
+                                                               subdom_sid_str);
841ac7
+    if (use_id_mapping == true) {
841ac7
+        default_mpg_mode = MPG_ENABLED;
841ac7
+    } else {
841ac7
+        /* Domains that use the POSIX attributes set by the admin must
841ac7
+         * inherit the MPG setting from the parent domain so that the
841ac7
+         * auto_private_groups options works for trusted domains as well
841ac7
+         */
841ac7
+        default_mpg_mode = get_domain_mpg_mode(parent);
841ac7
+    }
841ac7
+
841ac7
+    return default_mpg_mode;
841ac7
+}
841ac7
+
841ac7
+static enum sss_domain_mpg_mode
841ac7
+ad_subdom_mpg_mode(TALLOC_CTX *mem_ctx,
841ac7
+                   struct confdb_ctx *cdb,
841ac7
+                   struct sss_domain_info *parent,
841ac7
+                   enum sss_domain_mpg_mode default_mpg_mode,
841ac7
+                   const char *subdom_name)
841ac7
+{
841ac7
+    char *subdom_conf_path;
841ac7
+    char *mpg_str_opt;
841ac7
+    errno_t ret;
841ac7
+    enum sss_domain_mpg_mode ret_mode;
841ac7
+
841ac7
+    subdom_conf_path = subdomain_create_conf_path_from_str(mem_ctx,
841ac7
+                                                           parent->name,
841ac7
+                                                           subdom_name);
841ac7
+    if (subdom_conf_path == NULL) {
841ac7
+        DEBUG(SSSDBG_OP_FAILURE,
841ac7
+              "subdom_conf_path failed, will use %s mode as fallback\n",
841ac7
+              str_domain_mpg_mode(default_mpg_mode));
841ac7
+        return default_mpg_mode;
841ac7
+    }
841ac7
+
841ac7
+    ret = confdb_get_string(cdb, mem_ctx, subdom_conf_path,
841ac7
+                            CONFDB_DOMAIN_AUTO_UPG,
841ac7
+                            NULL,
841ac7
+                            &mpg_str_opt);
841ac7
+    talloc_free(subdom_conf_path);
841ac7
+    if (ret != EOK) {
841ac7
+        DEBUG(SSSDBG_OP_FAILURE,
841ac7
+              "condb_get_string failed, will use %s mode as fallback\n",
841ac7
+              str_domain_mpg_mode(default_mpg_mode));
841ac7
+        return default_mpg_mode;
841ac7
+    }
841ac7
+
841ac7
+    if (mpg_str_opt == NULL) {
841ac7
+        DEBUG(SSSDBG_CONF_SETTINGS,
841ac7
+              "Subdomain MPG mode not set, using %s\n",
841ac7
+              str_domain_mpg_mode(default_mpg_mode));
841ac7
+        return default_mpg_mode;
841ac7
+    }
841ac7
+
841ac7
+    ret_mode = str_to_domain_mpg_mode(mpg_str_opt);
841ac7
+    talloc_free(mpg_str_opt);
841ac7
+    return ret_mode;
841ac7
+}
841ac7
+
841ac7
 static errno_t
841ac7
-ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
841ac7
+ad_subdom_store(struct confdb_ctx *cdb,
841ac7
+                struct sdap_idmap_ctx *idmap_ctx,
841ac7
                 struct sss_domain_info *domain,
841ac7
                 struct sysdb_attrs *subdom_attrs,
841ac7
                 bool enumerate)
841ac7
@@ -451,8 +530,8 @@ ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
841ac7
     struct ldb_message_element *el;
841ac7
     char *sid_str = NULL;
841ac7
     uint32_t trust_type;
841ac7
-    bool use_id_mapping;
841ac7
     enum sss_domain_mpg_mode mpg_mode;
841ac7
+    enum sss_domain_mpg_mode default_mpg_mode;
841ac7
 
841ac7
     tmp_ctx = talloc_new(NULL);
841ac7
     if (tmp_ctx == NULL) {
841ac7
@@ -501,17 +580,13 @@ ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
841ac7
         goto done;
841ac7
     }
841ac7
 
841ac7
-    use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(idmap_ctx,
841ac7
-                                                               name, sid_str);
841ac7
-    if (use_id_mapping == true) {
841ac7
-        mpg_mode = MPG_ENABLED;
841ac7
-    } else {
841ac7
-        /* Domains that use the POSIX attributes set by the admin must
841ac7
-         * inherit the MPG setting from the parent domain so that the
841ac7
-         * auto_private_groups options works for trusted domains as well
841ac7
-         */
841ac7
-        mpg_mode = get_domain_mpg_mode(domain);
841ac7
-    }
841ac7
+    default_mpg_mode = get_default_subdom_mpg_mode(idmap_ctx, domain,
841ac7
+                                                   name, sid_str);
841ac7
+
841ac7
+    mpg_mode = ad_subdom_mpg_mode(tmp_ctx, cdb, domain,
841ac7
+                                  default_mpg_mode, name);
841ac7
+    DEBUG(SSSDBG_CONF_SETTINGS, "MPG mode of %s is %s\n",
841ac7
+                                name, str_domain_mpg_mode(mpg_mode));
841ac7
 
841ac7
     ret = sysdb_subdomain_store(domain->sysdb, name, realm, flat, sid_str,
841ac7
                                 mpg_mode, enumerate, domain->forest, 0, NULL);
841ac7
@@ -625,7 +700,8 @@ static errno_t ad_subdomains_refresh(struct be_ctx *be_ctx,
841ac7
                 goto done;
841ac7
             }
841ac7
 
841ac7
-            ret = ad_subdom_store(idmap_ctx, domain, subdomains[c], enumerate);
841ac7
+            ret = ad_subdom_store(be_ctx->cdb, idmap_ctx, domain,
841ac7
+                                  subdomains[c], enumerate);
841ac7
             if (ret) {
841ac7
                 /* Nothing we can do about the error. Let's at least try
841ac7
                  * to reuse the existing domains
841ac7
@@ -660,7 +736,8 @@ static errno_t ad_subdomains_refresh(struct be_ctx *be_ctx,
841ac7
             goto done;
841ac7
         }
841ac7
 
841ac7
-        ret = ad_subdom_store(idmap_ctx, domain, subdomains[c], enumerate);
841ac7
+        ret = ad_subdom_store(be_ctx->cdb, idmap_ctx, domain,
841ac7
+                              subdomains[c], enumerate);
841ac7
         if (ret) {
841ac7
             DEBUG(SSSDBG_MINOR_FAILURE, "Failed to parse subdom data, "
841ac7
                   "will try to use cached subdomain\n");
841ac7
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
841ac7
index 92eeda1d3..af4dc1a17 100644
841ac7
--- a/src/providers/ldap/sdap_async_users.c
841ac7
+++ b/src/providers/ldap/sdap_async_users.c
841ac7
@@ -389,7 +389,7 @@ int sdap_save_user(TALLOC_CTX *memctx,
841ac7
             goto done;
841ac7
         }
841ac7
 
841ac7
-        if (IS_SUBDOMAIN(dom) || sss_domain_is_mpg(dom) == true) {
841ac7
+        if (sss_domain_is_mpg(dom) == true) {
841ac7
             /* For subdomain users, only create the private group as
841ac7
              * the subdomain is an MPG domain.
841ac7
              * But we have to save the GID of the original primary group
841ac7
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
841ac7
index 4896ef051..4b1c9df39 100644
841ac7
--- a/src/util/domain_info_utils.c
841ac7
+++ b/src/util/domain_info_utils.c
841ac7
@@ -889,6 +889,14 @@ bool sss_domain_is_forest_root(struct sss_domain_info *dom)
841ac7
     return (dom->forest_root == dom);
841ac7
 }
841ac7
 
841ac7
+char *subdomain_create_conf_path_from_str(TALLOC_CTX *mem_ctx,
841ac7
+                                          const char *parent_name,
841ac7
+                                          const char *subdom_name)
841ac7
+{
841ac7
+    return talloc_asprintf(mem_ctx, CONFDB_DOMAIN_PATH_TMPL "/%s",
841ac7
+                           parent_name, subdom_name);
841ac7
+}
841ac7
+
841ac7
 char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
841ac7
                                  struct sss_domain_info *subdomain)
841ac7
 {
841ac7
@@ -899,9 +907,9 @@ char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
841ac7
         return NULL;
841ac7
     }
841ac7
 
841ac7
-    return talloc_asprintf(mem_ctx, CONFDB_DOMAIN_PATH_TMPL "/%s",
841ac7
-                           subdomain->parent->name,
841ac7
-                           subdomain->name);
841ac7
+    return subdomain_create_conf_path_from_str(mem_ctx,
841ac7
+                                               subdomain->parent->name,
841ac7
+                                               subdomain->name);
841ac7
 }
841ac7
 
841ac7
 const char *sss_domain_type_str(struct sss_domain_info *dom)
841ac7
diff --git a/src/util/util.h b/src/util/util.h
841ac7
index 1e36bf02a..3003583b7 100644
841ac7
--- a/src/util/util.h
841ac7
+++ b/src/util/util.h
841ac7
@@ -557,6 +557,9 @@ find_domain_by_object_name_ex(struct sss_domain_info *domain,
841ac7
 bool subdomain_enumerates(struct sss_domain_info *parent,
841ac7
                           const char *sd_name);
841ac7
 
841ac7
+char *subdomain_create_conf_path_from_str(TALLOC_CTX *mem_ctx,
841ac7
+                                          const char *parent_name,
841ac7
+                                          const char *subdom_name);
841ac7
 char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
841ac7
                                  struct sss_domain_info *subdomain);
841ac7
 
841ac7
-- 
841ac7
2.19.1
841ac7