From 405f08eabf5017cc00891fb2090be80306c8aeae Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Thu, 30 Nov 2017 12:01:51 +0100

Subject: [PATCH 70/83] LDAP: Only run the POSIX check with a GC connection

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Previously, we used to run the POSIX check also with an LDAP connection.

This was wasteful, but worked, so the waste wasn't the biggest problem

-- the approach would only cause problems with the following patch which

uses a NULL search base to search the Global Catalog, because searching

with a SUBTREE scope and a NULL base returns a referral with an LDAP

connection.

Instead, this patch uses a heuristics (whether the connection ignores

the offline state) to check if the connection is a POSIX one and if it

is NOT, then skips the POSIX check.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit dacfe74113dde62ddaaa7f9abf9d2b6448d89db6)

---

 src/providers/ldap/ldap_common.c     | 2 ++

 src/providers/ldap/ldap_common.h     | 1 +

 src/providers/ldap/ldap_id.c         | 2 ++

 src/providers/ldap/sdap_async_enum.c | 1 +

 4 files changed, 6 insertions(+)

diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c

index 3eff3515d95043d4b59cb0d9953cf050355a0ca5..36e79b9d6ca23ef5e21a8b0bedc7f05db8f4fc98 100644

--- a/src/providers/ldap/ldap_common.c

+++ b/src/providers/ldap/ldap_common.c

@@ -973,12 +973,14 @@ sdap_id_ctx_new(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,

 }

 bool should_run_posix_check(struct sdap_id_ctx *ctx,

+                            struct sdap_id_conn_ctx *conn,

                             bool use_id_mapping,

                             bool posix_request)

 {

     if (use_id_mapping == false &&

             posix_request == true &&

             ctx->opts->schema_type == SDAP_SCHEMA_AD &&

+            conn->ignore_mark_offline == true &&

             ctx->srv_opts &&

             ctx->srv_opts->posix_checked == false) {

         return true;

diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h

index fa7cda4df9d7334f6f0f5baccae0cba0478bfbea..44dbc3fb0678412f46366321e0be836313380949 100644

--- a/src/providers/ldap/ldap_common.h

+++ b/src/providers/ldap/ldap_common.h

@@ -305,6 +305,7 @@ char *get_enterprise_principal_string_filter(TALLOC_CTX *mem_ctx,

                                              struct dp_option *sdap_basic_opts);

 bool should_run_posix_check(struct sdap_id_ctx *ctx,

+                            struct sdap_id_conn_ctx *conn,

                             bool id_mapping,

                             bool posix_request);

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c

index 6ab9e0aa1db3eed32deb75211ded30a4cb48ca30..47969a9749253721334a20f46230f7aecea64882 100644

--- a/src/providers/ldap/ldap_id.c

+++ b/src/providers/ldap/ldap_id.c

@@ -412,6 +412,7 @@ static void users_get_connect_done(struct tevent_req *subreq)

      * have no idea about POSIX attributes support, run a one-time check

      */

     if (should_run_posix_check(state->ctx,

+                               state->conn,

                                state->use_id_mapping,

                                !state->non_posix)) {

         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,

@@ -957,6 +958,7 @@ static void groups_get_connect_done(struct tevent_req *subreq)

      * have no idea about POSIX attributes support, run a one-time check

      */

     if (should_run_posix_check(state->ctx,

+                               state->conn,

                                state->use_id_mapping,

                                !state->non_posix)) {

         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,

diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c

index 2cef4eb886f982ba388a34955bdd38468fe68200..baa039d63c71cc5054e6af6538d34d04cde6b858 100644

--- a/src/providers/ldap/sdap_async_enum.c

+++ b/src/providers/ldap/sdap_async_enum.c

@@ -197,6 +197,7 @@ static void sdap_dom_enum_ex_get_users(struct tevent_req *subreq)

      * have no idea about POSIX attributes support, run a one-time check

      */

     if (should_run_posix_check(state->ctx,

+                               state->user_conn,

                                use_id_mapping,

                                true)) {

         subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts,

-- 

2.14.3