|
 |
8d3578 |
From b2cd4a74e231611f7862a8bb39a655c5194a035a Mon Sep 17 00:00:00 2001
|
|
|
8d3578 |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
8d3578 |
Date: Thu, 30 May 2019 12:52:33 +0200
|
|
|
8d3578 |
Subject: [PATCH 41/44] sysdb: read and interpret domain's enabled attribute
|
|
|
8d3578 |
|
|
|
8d3578 |
Disable domain if its sysdb object has enabled=false.
|
|
|
8d3578 |
|
|
|
8d3578 |
Resolves:
|
|
|
8d3578 |
https://pagure.io/SSSD/sssd/issue/4009
|
|
|
8d3578 |
|
|
|
8d3578 |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
8d3578 |
(cherry picked from commit d278704d85fea74c229b67e6a63b650b0d776c88)
|
|
|
8d3578 |
---
|
|
|
8d3578 |
src/db/sysdb_private.h | 3 ++-
|
|
|
8d3578 |
src/db/sysdb_subdomains.c | 29 ++++++++++++++++++---
|
|
|
8d3578 |
src/tests/cmocka/test_fqnames.c | 2 +-
|
|
|
8d3578 |
src/tests/cmocka/test_negcache.c | 2 +-
|
|
|
8d3578 |
src/tests/cmocka/test_nss_srv.c | 2 +-
|
|
|
8d3578 |
src/tests/cmocka/test_responder_cache_req.c | 2 +-
|
|
|
8d3578 |
src/tests/sysdb-tests.c | 8 +++---
|
|
|
8d3578 |
7 files changed, 35 insertions(+), 13 deletions(-)
|
|
|
8d3578 |
|
|
|
8d3578 |
diff --git a/src/db/sysdb_private.h b/src/db/sysdb_private.h
|
|
|
8d3578 |
index 58544d826..f3d34dd6f 100644
|
|
|
8d3578 |
--- a/src/db/sysdb_private.h
|
|
|
8d3578 |
+++ b/src/db/sysdb_private.h
|
|
|
8d3578 |
@@ -206,7 +206,8 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
|
|
|
8d3578 |
const char *forest,
|
|
|
8d3578 |
const char **upn_suffixes,
|
|
|
8d3578 |
uint32_t trust_direction,
|
|
|
8d3578 |
- struct confdb_ctx *confdb);
|
|
|
8d3578 |
+ struct confdb_ctx *confdb,
|
|
|
8d3578 |
+ bool enabled);
|
|
|
8d3578 |
|
|
|
8d3578 |
/* Helper functions to deal with the timestamp cache should not be used
|
|
|
8d3578 |
* outside the sysdb itself. The timestamp cache should be completely
|
|
|
8d3578 |
diff --git a/src/db/sysdb_subdomains.c b/src/db/sysdb_subdomains.c
|
|
|
8d3578 |
index d467dfce5..cf09b424e 100644
|
|
|
8d3578 |
--- a/src/db/sysdb_subdomains.c
|
|
|
8d3578 |
+++ b/src/db/sysdb_subdomains.c
|
|
|
8d3578 |
@@ -39,7 +39,8 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
|
|
|
8d3578 |
const char *forest,
|
|
|
8d3578 |
const char **upn_suffixes,
|
|
|
8d3578 |
uint32_t trust_direction,
|
|
|
8d3578 |
- struct confdb_ctx *confdb)
|
|
|
8d3578 |
+ struct confdb_ctx *confdb,
|
|
|
8d3578 |
+ bool enabled)
|
|
|
8d3578 |
{
|
|
|
8d3578 |
struct sss_domain_info *dom;
|
|
|
8d3578 |
bool inherit_option;
|
|
|
8d3578 |
@@ -127,7 +128,7 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
|
|
|
8d3578 |
dom->enumerate = enumerate;
|
|
|
8d3578 |
dom->fqnames = true;
|
|
|
8d3578 |
dom->mpg_mode = mpg_mode;
|
|
|
8d3578 |
- dom->state = DOM_ACTIVE;
|
|
|
8d3578 |
+ dom->state = enabled ? DOM_ACTIVE : DOM_DISABLED;
|
|
|
8d3578 |
|
|
|
8d3578 |
/* use fully qualified names as output in order to avoid causing
|
|
|
8d3578 |
* conflicts with users who have the same name and either the
|
|
|
8d3578 |
@@ -313,6 +314,7 @@ errno_t sysdb_update_subdomains(struct sss_domain_info *domain,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_FOREST,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_TRUST_DIRECTION,
|
|
|
8d3578 |
SYSDB_UPN_SUFFIXES,
|
|
|
8d3578 |
+ SYSDB_ENABLED,
|
|
|
8d3578 |
NULL};
|
|
|
8d3578 |
struct sss_domain_info *dom;
|
|
|
8d3578 |
struct ldb_dn *basedn;
|
|
|
8d3578 |
@@ -322,6 +324,7 @@ errno_t sysdb_update_subdomains(struct sss_domain_info *domain,
|
|
|
8d3578 |
const char *id;
|
|
|
8d3578 |
const char *forest;
|
|
|
8d3578 |
const char *str_mpg_mode;
|
|
|
8d3578 |
+ bool enabled;
|
|
|
8d3578 |
enum sss_domain_mpg_mode mpg_mode;
|
|
|
8d3578 |
bool enumerate;
|
|
|
8d3578 |
uint32_t trust_direction;
|
|
|
8d3578 |
@@ -406,10 +409,14 @@ errno_t sysdb_update_subdomains(struct sss_domain_info *domain,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_TRUST_DIRECTION,
|
|
|
8d3578 |
0);
|
|
|
8d3578 |
|
|
|
8d3578 |
+ enabled = ldb_msg_find_attr_as_bool(res->msgs[i], SYSDB_ENABLED, true);
|
|
|
8d3578 |
+
|
|
|
8d3578 |
for (dom = domain->subdomains; dom;
|
|
|
8d3578 |
dom = get_next_domain(dom, SSS_GND_INCLUDE_DISABLED)) {
|
|
|
8d3578 |
if (strcasecmp(dom->name, name) == 0) {
|
|
|
8d3578 |
- sss_domain_set_state(dom, DOM_ACTIVE);
|
|
|
8d3578 |
+ if (enabled) {
|
|
|
8d3578 |
+ sss_domain_set_state(dom, DOM_ACTIVE);
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
|
|
|
8d3578 |
/* in theory these may change, but it should never happen */
|
|
|
8d3578 |
if (strcasecmp(dom->realm, realm) != 0) {
|
|
|
8d3578 |
@@ -522,7 +529,8 @@ errno_t sysdb_update_subdomains(struct sss_domain_info *domain,
|
|
|
8d3578 |
if (dom == NULL) {
|
|
|
8d3578 |
dom = new_subdomain(domain, domain, name, realm,
|
|
|
8d3578 |
flat, id, mpg_mode, enumerate, forest,
|
|
|
8d3578 |
- upn_suffixes, trust_direction, confdb);
|
|
|
8d3578 |
+ upn_suffixes, trust_direction, confdb,
|
|
|
8d3578 |
+ enabled);
|
|
|
8d3578 |
if (dom == NULL) {
|
|
|
8d3578 |
ret = ENOMEM;
|
|
|
8d3578 |
goto done;
|
|
|
8d3578 |
@@ -548,12 +556,15 @@ errno_t sysdb_master_domain_update(struct sss_domain_info *domain)
|
|
|
8d3578 |
struct ldb_message_element *tmp_el;
|
|
|
8d3578 |
struct ldb_dn *basedn;
|
|
|
8d3578 |
struct ldb_result *res;
|
|
|
8d3578 |
+ enum sss_domain_state state;
|
|
|
8d3578 |
+ bool enabled;
|
|
|
8d3578 |
const char *attrs[] = {"cn",
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_REALM,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_FLAT,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_ID,
|
|
|
8d3578 |
SYSDB_SUBDOMAIN_FOREST,
|
|
|
8d3578 |
SYSDB_UPN_SUFFIXES,
|
|
|
8d3578 |
+ SYSDB_ENABLED,
|
|
|
8d3578 |
NULL};
|
|
|
8d3578 |
char *view_name = NULL;
|
|
|
8d3578 |
|
|
|
8d3578 |
@@ -650,6 +661,16 @@ errno_t sysdb_master_domain_update(struct sss_domain_info *domain)
|
|
|
8d3578 |
talloc_zfree(domain->upn_suffixes);
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
+ state = sss_domain_get_state(domain);
|
|
|
8d3578 |
+ enabled = ldb_msg_find_attr_as_bool(res->msgs[0], SYSDB_ENABLED, true);
|
|
|
8d3578 |
+ if (!enabled) {
|
|
|
8d3578 |
+ sss_domain_set_state(domain, DOM_DISABLED);
|
|
|
8d3578 |
+ } else if (state == DOM_DISABLED) {
|
|
|
8d3578 |
+ /* We do not want to enable INACTIVE or INCONSISTENT domain. This
|
|
|
8d3578 |
+ * is managed by data provider. */
|
|
|
8d3578 |
+ sss_domain_set_state(domain, DOM_ACTIVE);
|
|
|
8d3578 |
+ }
|
|
|
8d3578 |
+
|
|
|
8d3578 |
ret = sysdb_get_view_name(tmp_ctx, domain->sysdb, &view_name);
|
|
|
8d3578 |
if (ret != EOK && ret != ENOENT) {
|
|
|
8d3578 |
DEBUG(SSSDBG_OP_FAILURE, "sysdb_get_view_name failed.\n");
|
|
|
8d3578 |
diff --git a/src/tests/cmocka/test_fqnames.c b/src/tests/cmocka/test_fqnames.c
|
|
|
8d3578 |
index 09f7db0d1..770c0d7bf 100644
|
|
|
8d3578 |
--- a/src/tests/cmocka/test_fqnames.c
|
|
|
8d3578 |
+++ b/src/tests/cmocka/test_fqnames.c
|
|
|
8d3578 |
@@ -310,7 +310,7 @@ static int parse_name_test_setup(void **state)
|
|
|
8d3578 |
*/
|
|
|
8d3578 |
test_ctx->subdom = new_subdomain(dom, dom, SUBDOMNAME, NULL, SUBFLATNAME,
|
|
|
8d3578 |
NULL, MPG_DISABLED, false,
|
|
|
8d3578 |
- NULL, NULL, 0, NULL);
|
|
|
8d3578 |
+ NULL, NULL, 0, NULL, true);
|
|
|
8d3578 |
assert_non_null(test_ctx->subdom);
|
|
|
8d3578 |
|
|
|
8d3578 |
check_leaks_push(test_ctx);
|
|
|
8d3578 |
diff --git a/src/tests/cmocka/test_negcache.c b/src/tests/cmocka/test_negcache.c
|
|
|
8d3578 |
index 0a7e563e0..0876cfdaf 100644
|
|
|
8d3578 |
--- a/src/tests/cmocka/test_negcache.c
|
|
|
8d3578 |
+++ b/src/tests/cmocka/test_negcache.c
|
|
|
8d3578 |
@@ -645,7 +645,7 @@ static void test_sss_ncache_prepopulate(void **state)
|
|
|
8d3578 |
subdomain = new_subdomain(tc, tc->dom,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
false, false, NULL, NULL, 0,
|
|
|
8d3578 |
- tc->confdb);
|
|
|
8d3578 |
+ tc->confdb, true);
|
|
|
8d3578 |
assert_non_null(subdomain);
|
|
|
8d3578 |
|
|
|
8d3578 |
ret = sysdb_subdomain_store(tc->sysdb,
|
|
|
8d3578 |
diff --git a/src/tests/cmocka/test_nss_srv.c b/src/tests/cmocka/test_nss_srv.c
|
|
|
8d3578 |
index 0ae177571..95c080caf 100644
|
|
|
8d3578 |
--- a/src/tests/cmocka/test_nss_srv.c
|
|
|
8d3578 |
+++ b/src/tests/cmocka/test_nss_srv.c
|
|
|
8d3578 |
@@ -3475,7 +3475,7 @@ static int nss_subdom_test_setup_common(void **state, bool nonfqnames)
|
|
|
8d3578 |
subdomain = new_subdomain(nss_test_ctx, nss_test_ctx->tctx->dom,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
false, false, NULL, NULL, 0,
|
|
|
8d3578 |
- nss_test_ctx->tctx->confdb);
|
|
|
8d3578 |
+ nss_test_ctx->tctx->confdb, true);
|
|
|
8d3578 |
assert_non_null(subdomain);
|
|
|
8d3578 |
|
|
|
8d3578 |
ret = sysdb_subdomain_store(nss_test_ctx->tctx->sysdb,
|
|
|
8d3578 |
diff --git a/src/tests/cmocka/test_responder_cache_req.c b/src/tests/cmocka/test_responder_cache_req.c
|
|
|
8d3578 |
index 47d9aab54..9f3b49cd9 100644
|
|
|
8d3578 |
--- a/src/tests/cmocka/test_responder_cache_req.c
|
|
|
8d3578 |
+++ b/src/tests/cmocka/test_responder_cache_req.c
|
|
|
8d3578 |
@@ -687,7 +687,7 @@ static int test_subdomain_setup(void **state)
|
|
|
8d3578 |
test_ctx->subdomain = new_subdomain(test_ctx, test_ctx->tctx->dom,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
MPG_DISABLED, false, NULL, NULL, 0,
|
|
|
8d3578 |
- test_ctx->tctx->confdb);
|
|
|
8d3578 |
+ test_ctx->tctx->confdb, true);
|
|
|
8d3578 |
assert_non_null(test_ctx->subdomain);
|
|
|
8d3578 |
|
|
|
8d3578 |
ret = sysdb_subdomain_store(test_ctx->tctx->sysdb,
|
|
|
8d3578 |
diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
|
|
|
8d3578 |
index ed98fe6ce..832d60466 100644
|
|
|
8d3578 |
--- a/src/tests/sysdb-tests.c
|
|
|
8d3578 |
+++ b/src/tests/sysdb-tests.c
|
|
|
8d3578 |
@@ -1541,7 +1541,7 @@ START_TEST (test_sysdb_get_user_attr_subdomain)
|
|
|
8d3578 |
/* Create subdomain */
|
|
|
8d3578 |
subdomain = new_subdomain(test_ctx, test_ctx->domain,
|
|
|
8d3578 |
"test.sub", "TEST.SUB", "test", "S-3",
|
|
|
8d3578 |
- MPG_DISABLED, false, NULL, NULL, 0, NULL);
|
|
|
8d3578 |
+ MPG_DISABLED, false, NULL, NULL, 0, NULL, true);
|
|
|
8d3578 |
fail_if(subdomain == NULL, "Failed to create new subdomain.");
|
|
|
8d3578 |
|
|
|
8d3578 |
ret = sss_names_init_from_args(test_ctx,
|
|
|
8d3578 |
@@ -6143,7 +6143,7 @@ START_TEST(test_sysdb_subdomain_store_user)
|
|
|
8d3578 |
|
|
|
8d3578 |
subdomain = new_subdomain(test_ctx, test_ctx->domain,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
- MPG_DISABLED, false, NULL, NULL, 0, NULL);
|
|
|
8d3578 |
+ MPG_DISABLED, false, NULL, NULL, 0, NULL, true);
|
|
|
8d3578 |
fail_unless(subdomain != NULL, "Failed to create new subdomain.");
|
|
|
8d3578 |
ret = sysdb_subdomain_store(test_ctx->sysdb,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
@@ -6222,7 +6222,7 @@ START_TEST(test_sysdb_subdomain_user_ops)
|
|
|
8d3578 |
|
|
|
8d3578 |
subdomain = new_subdomain(test_ctx, test_ctx->domain,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
- MPG_DISABLED, false, NULL, NULL, 0, NULL);
|
|
|
8d3578 |
+ MPG_DISABLED, false, NULL, NULL, 0, NULL, true);
|
|
|
8d3578 |
fail_unless(subdomain != NULL, "Failed to create new subdomain.");
|
|
|
8d3578 |
ret = sysdb_subdomain_store(test_ctx->sysdb,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
@@ -6295,7 +6295,7 @@ START_TEST(test_sysdb_subdomain_group_ops)
|
|
|
8d3578 |
|
|
|
8d3578 |
subdomain = new_subdomain(test_ctx, test_ctx->domain,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
- MPG_DISABLED, false, NULL, NULL, 0, NULL);
|
|
|
8d3578 |
+ MPG_DISABLED, false, NULL, NULL, 0, NULL, true);
|
|
|
8d3578 |
fail_unless(subdomain != NULL, "Failed to create new subdomain.");
|
|
|
8d3578 |
ret = sysdb_subdomain_store(test_ctx->sysdb,
|
|
|
8d3578 |
testdom[0], testdom[1], testdom[2], testdom[3],
|
|
|
8d3578 |
--
|
|
|
8d3578 |
2.20.1
|
|
|
8d3578 |
|