|
 |
8d3578 |
From cc42fe7daece23c639ba8d147808f1c699d8b6ad Mon Sep 17 00:00:00 2001
|
|
|
8d3578 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
8d3578 |
Date: Thu, 12 Sep 2019 14:45:08 +0200
|
|
|
8d3578 |
Subject: [PATCH 95/97] ipa: ignore objects from disabled domains on the client
|
|
|
8d3578 |
MIME-Version: 1.0
|
|
|
8d3578 |
Content-Type: text/plain; charset=UTF-8
|
|
|
8d3578 |
Content-Transfer-Encoding: 8bit
|
|
|
8d3578 |
|
|
|
8d3578 |
It is possible that a domain is already disabled on an IPA client but
|
|
|
8d3578 |
still active on the server. This might happen e.g. if the version of
|
|
|
8d3578 |
SSSD running on the IPA server does not support disabled domains or if
|
|
|
8d3578 |
SSSD on the IPA client updates the domain data before the IPA server and
|
|
|
8d3578 |
sees a freshly disabled domain more early.
|
|
|
8d3578 |
|
|
|
8d3578 |
As a result the server is still sending objects from disabled domains in
|
|
|
8d3578 |
the lists of group members or group memberships of a user. The client
|
|
|
8d3578 |
should just ignore those objects.
|
|
|
8d3578 |
|
|
|
8d3578 |
Related to https://pagure.io/SSSD/sssd/issue/4078
|
|
|
8d3578 |
|
|
|
8d3578 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
8d3578 |
---
|
|
|
8d3578 |
src/providers/ipa/ipa_s2n_exop.c | 15 +++++++++++++--
|
|
|
8d3578 |
1 file changed, 13 insertions(+), 2 deletions(-)
|
|
|
8d3578 |
|
|
|
8d3578 |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
8d3578 |
index b6efbcd34..f1d5768ae 100644
|
|
|
8d3578 |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
8d3578 |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
8d3578 |
@@ -637,10 +637,16 @@ static errno_t add_v1_user_data(struct sss_domain_info *dom,
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
if (domain != NULL) {
|
|
|
8d3578 |
- obj_domain = find_domain_by_name(parent_domain, domain, true);
|
|
|
8d3578 |
+ obj_domain = find_domain_by_name_ex(parent_domain, domain, true, SSS_GND_ALL_DOMAINS);
|
|
|
8d3578 |
if (obj_domain == NULL) {
|
|
|
8d3578 |
DEBUG(SSSDBG_OP_FAILURE, "find_domain_by_name failed.\n");
|
|
|
8d3578 |
return ENOMEM;
|
|
|
8d3578 |
+ } else if (sss_domain_get_state(obj_domain) == DOM_DISABLED) {
|
|
|
8d3578 |
+ /* skipping objects from disabled domains */
|
|
|
8d3578 |
+ DEBUG(SSSDBG_TRACE_ALL,
|
|
|
8d3578 |
+ "Skipping object [%s] from disabled domain.\n",
|
|
|
8d3578 |
+ list[c]);
|
|
|
8d3578 |
+ continue;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
} else {
|
|
|
8d3578 |
obj_domain = parent_domain;
|
|
|
8d3578 |
@@ -656,6 +662,7 @@ static errno_t add_v1_user_data(struct sss_domain_info *dom,
|
|
|
8d3578 |
gc++;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
}
|
|
|
8d3578 |
+ attrs->ngroups = gc;
|
|
|
8d3578 |
|
|
|
8d3578 |
tag = ber_peek_tag(ber, &ber_len);
|
|
|
8d3578 |
DEBUG(SSSDBG_TRACE_ALL, "BER tag is [%d]\n", (int) tag);
|
|
|
8d3578 |
@@ -1567,11 +1574,15 @@ static errno_t process_members(struct sss_domain_info *domain,
|
|
|
8d3578 |
parent_domain = get_domains_head(domain);
|
|
|
8d3578 |
|
|
|
8d3578 |
for (c = 0; members[c] != NULL; c++) {
|
|
|
8d3578 |
- obj_domain = find_domain_by_object_name(parent_domain, members[c]);
|
|
|
8d3578 |
+ obj_domain = find_domain_by_object_name_ex(parent_domain, members[c],
|
|
|
8d3578 |
+ false, SSS_GND_ALL_DOMAINS);
|
|
|
8d3578 |
if (obj_domain == NULL) {
|
|
|
8d3578 |
DEBUG(SSSDBG_OP_FAILURE, "find_domain_by_object_name failed.\n");
|
|
|
8d3578 |
ret = ENOMEM;
|
|
|
8d3578 |
goto done;
|
|
|
8d3578 |
+ } else if (sss_domain_get_state(obj_domain) == DOM_DISABLED) {
|
|
|
8d3578 |
+ /* skip members from disabled domains */
|
|
|
8d3578 |
+ continue;
|
|
|
8d3578 |
}
|
|
|
8d3578 |
|
|
|
8d3578 |
ret = sysdb_search_user_by_name(tmp_ctx, obj_domain, members[c], attrs,
|
|
|
8d3578 |
--
|
|
|
8d3578 |
2.20.1
|
|
|
8d3578 |
|