From b2a823cf415a12416dca9ff019666906d61cfc2f Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Wed, 22 Mar 2017 13:06:14 +0100

Subject: [PATCH 71/72] LDAP: Relax search filters in application domains

Related to:

https://pagure.io/SSSD/sssd/issue/3310

If a request comes towards an application domain, we can drop the part

of the filter that asserts that the object has a valid UID/GID. Instead,

we just search by name.

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/providers/ldap/ldap_id.c               | 35 ++++++++++++++++++++++++----

 src/providers/ldap/sdap_async_enum.c       |  7 +++++-

 src/providers/ldap/sdap_async_initgroups.c | 37 ++++++++++++++++++++++++------

 3 files changed, 66 insertions(+), 13 deletions(-)

diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c

index 0bee0ca8d71abece6749fdb8393b9ceacb64417d..7400dc1f57e30cc6ae5f939ffa628a1e9dd47e06 100644

--- a/src/providers/ldap/ldap_id.c

+++ b/src/providers/ldap/ldap_id.c

@@ -56,6 +56,7 @@ struct users_get_state {

     char *filter;

     const char **attrs;

     bool use_id_mapping;

+    bool non_posix;

     int dp_error;

     int sdap_ret;

@@ -114,6 +115,10 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,

     state->filter_value = filter_value;

     state->filter_type = filter_type;

+    if (state->domain->type == DOM_TYPE_APPLICATION) {

+        state->non_posix = true;

+    }

+

     state->use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(

                                                           ctx->opts->idmap_ctx,

                                                           sdom->dom->name,

@@ -292,7 +297,13 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,

         }

     }

-    if (state->use_id_mapping || filter_type == BE_FILTER_SECID) {

+    if (state->non_posix) {

+        state->filter = talloc_asprintf(state,

+                                        "(&%s(objectclass=%s)(%s=*))",

+                                        user_filter,

+                                        ctx->opts->user_map[SDAP_OC_USER].name,

+                                        ctx->opts->user_map[SDAP_AT_USER_NAME].name);

+    } else if (state->use_id_mapping || filter_type == BE_FILTER_SECID) {

         /* When mapping IDs or looking for SIDs, we don't want to limit

          * ourselves to users with a UID value. But there must be a SID to map

          * from.

@@ -304,7 +315,8 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,

                                         ctx->opts->user_map[SDAP_AT_USER_NAME].name,

                                         ctx->opts->user_map[SDAP_AT_USER_OBJECTSID].name);

     } else {

-        /* When not ID-mapping, make sure there is a non-NULL UID */

+        /* When not ID-mapping or looking up POSIX users,

+         * make sure there is a non-NULL UID */

         state->filter = talloc_asprintf(state,

                                         "(&%s(objectclass=%s)(%s=*)(&(%s=*)(!(%s=0))))",

                                         user_filter,

@@ -380,6 +392,7 @@ static void users_get_connect_done(struct tevent_req *subreq)

      * have no idea about POSIX attributes support, run a one-time check

      */

     if (state->use_id_mapping == false &&

+            state->non_posix == false &&

             state->ctx->opts->schema_type == SDAP_SCHEMA_AD &&

             state->ctx->srv_opts &&

             state->ctx->srv_opts->posix_checked == false) {

@@ -650,6 +663,7 @@ struct groups_get_state {

     char *filter;

     const char **attrs;

     bool use_id_mapping;

+    bool non_posix;

     int dp_error;

     int sdap_ret;

@@ -709,6 +723,10 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,

     state->filter_value = filter_value;

     state->filter_type = filter_type;

+    if (state->domain->type == DOM_TYPE_APPLICATION) {

+        state->non_posix = true;

+    }

+

     state->use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(

                                                           ctx->opts->idmap_ctx,

                                                           sdom->dom->name,

@@ -827,9 +845,11 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx,

         goto done;

     }

-    if (state->use_id_mapping || filter_type == BE_FILTER_SECID) {

-        /* When mapping IDs or looking for SIDs, we don't want to limit

-         * ourselves to groups with a GID value

+    if (state->non_posix

+            || state->use_id_mapping

+            || filter_type == BE_FILTER_SECID) {

+        /* When mapping IDs or looking for SIDs, or when in a non-POSIX domain,

+         * we don't want to limit ourselves to groups with a GID value

          */

         state->filter = talloc_asprintf(state,

@@ -1123,6 +1143,7 @@ struct groups_by_user_state {

     int filter_type;

     const char *extra_value;

     const char **attrs;

+    bool non_posix;

     int dp_error;

     int sdap_ret;

@@ -1204,6 +1225,10 @@ static struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,

     state->domain = sdom->dom;

     state->sysdb = sdom->dom->sysdb;

+    if (state->domain->type == DOM_TYPE_APPLICATION) {

+        state->non_posix = true;

+    }

+

     ret = build_attrs_from_map(state, ctx->opts->group_map, SDAP_OPTS_GROUP,

                                NULL, &state->attrs, NULL);

     if (ret != EOK) goto fail;

diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c

index 3f65059e18d5c8b548da0babec867d27c3a64198..91e481c4e694126900c729e86d187fba355de0b8 100644

--- a/src/providers/ldap/sdap_async_enum.c

+++ b/src/providers/ldap/sdap_async_enum.c

@@ -717,6 +717,7 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,

     struct enum_groups_state *state;

     int ret;

     bool use_mapping;

+    bool non_posix = false;

     char *oc_list;

     req = tevent_req_create(memctx, &state, struct enum_groups_state);

@@ -727,6 +728,10 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,

     state->ctx = ctx;

     state->op = op;

+    if (sdom->dom->type == DOM_TYPE_APPLICATION) {

+        non_posix = true;

+    }

+

     use_mapping = sdap_idmap_domain_has_algorithmic_mapping(

                                                         ctx->opts->idmap_ctx,

                                                         sdom->dom->name,

@@ -749,7 +754,7 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,

         goto fail;

     }

-    if (use_mapping) {

+    if (!non_posix && use_mapping) {

         /* If we're ID-mapping, check for the objectSID as well */

         state->filter = talloc_asprintf_append_buffer(

                 state->filter, "(%s=*)",

diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c

index 79af7a3eda3fe8533933535c98c2b4b4698dfda2..c926ddcbefe471daa80505e139c3f19efa33b9ba 100644

--- a/src/providers/ldap/sdap_async_initgroups.c

+++ b/src/providers/ldap/sdap_async_initgroups.c

@@ -376,7 +376,7 @@ struct sdap_initgr_rfc2307_state {

     struct sdap_handle *sh;

     const char **attrs;

     const char *name;

-    const char *base_filter;

+    char *base_filter;

     const char *orig_dn;

     char *filter;

     int timeout;

@@ -473,18 +473,32 @@ struct tevent_req *sdap_initgr_rfc2307_send(TALLOC_CTX *memctx,

     }

     state->base_filter = talloc_asprintf(state,

-                             "(&(%s=%s)(%s)(%s=*)(&(%s=*)(!(%s=0))))",

+                             "(&(%s=%s)(%s)(%s=*)",

                              opts->group_map[SDAP_AT_GROUP_MEMBER].name,

                              clean_name, oc_list,

-                             opts->group_map[SDAP_AT_GROUP_NAME].name,

-                             opts->group_map[SDAP_AT_GROUP_GID].name,

-                             opts->group_map[SDAP_AT_GROUP_GID].name);

+                             opts->group_map[SDAP_AT_GROUP_NAME].name);

     if (!state->base_filter) {

         talloc_zfree(req);

         return NULL;

     }

     talloc_zfree(clean_name);

+    switch (domain->type) {

+    case DOM_TYPE_APPLICATION:

+        state->base_filter = talloc_asprintf_append(state->base_filter, ")");

+        break;

+    case DOM_TYPE_POSIX:

+        state->base_filter = talloc_asprintf_append(state->base_filter,

+                                        "(&(%s=*)(!(%s=0))))",

+                                        opts->group_map[SDAP_AT_GROUP_GID].name,

+                                        opts->group_map[SDAP_AT_GROUP_GID].name);

+        break;

+    }

+    if (!state->base_filter) {

+        ret = ENOMEM;

+        goto done;

+    }

+

     ret = sdap_initgr_rfc2307_next_base(req);

 done:

@@ -2666,6 +2680,7 @@ struct sdap_get_initgr_state {

     char *shortname;

     char *filter;

     int timeout;

+    bool non_posix;

     struct sysdb_attrs *orig_user;

@@ -2724,6 +2739,10 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,

         goto done;

     }

+    if (state->dom->type == DOM_TYPE_APPLICATION) {

+        state->non_posix = true;

+    }

+

     use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(

                                                           id_ctx->opts->idmap_ctx,

                                                           sdom->dom->name,

@@ -2813,7 +2832,10 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,

         }

     }

-    if (use_id_mapping) {

+    if (state->non_posix) {

+        state->user_base_filter = talloc_asprintf_append(state->user_base_filter,

+                                                         ")");

+    } else if (use_id_mapping) {

         /* When mapping IDs or looking for SIDs, we don't want to limit

          * ourselves to users with a UID value. But there must be a SID to map

          * from.

@@ -2822,7 +2844,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,

                                         "(%s=*))",

                                         id_ctx->opts->user_map[SDAP_AT_USER_OBJECTSID].name);

     } else {

-        /* When not ID-mapping, make sure there is a non-NULL UID */

+        /* When not ID-mapping or looking up app users, make sure there

+         * is a non-NULL UID */

         state->user_base_filter = talloc_asprintf_append(state->user_base_filter,

                                         "(&(%s=*)(!(%s=0))))",

                                         id_ctx->opts->user_map[SDAP_AT_USER_UID].name,

-- 

2.9.3