Blame SOURCES/0106-AD_PROVIDER-ad_enabled_domains-other-then-master.patch

b2d430
From 9438cd7b8c8cca1e919afec6c5aa3a3233a31f8c Mon Sep 17 00:00:00 2001
b2d430
From: Petr Cech <pcech@redhat.com>
b2d430
Date: Mon, 27 Jun 2016 11:51:30 +0200
b2d430
Subject: [PATCH 106/108] AD_PROVIDER: ad_enabled_domains - other then master
b2d430
MIME-Version: 1.0
b2d430
Content-Type: text/plain; charset=UTF-8
b2d430
Content-Transfer-Encoding: 8bit
b2d430
b2d430
We can skip looking up other domains if
b2d430
option ad_enabled_domains doesn't contain them.
b2d430
b2d430
Resolves:
b2d430
https://fedorahosted.org/sssd/ticket/2828
b2d430
b2d430
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
b2d430
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
b2d430
---
b2d430
 src/providers/ad/ad_subdomains.c | 40 +++++++++++++++++++++++++++++++++++++---
b2d430
 1 file changed, 37 insertions(+), 3 deletions(-)
b2d430
b2d430
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
b2d430
index 5fdfc63886457db02ea4edc430341b31c3e545ce..52bf5361fa8de02c7165cbc3513a923ec018fc15 100644
b2d430
--- a/src/providers/ad/ad_subdomains.c
b2d430
+++ b/src/providers/ad/ad_subdomains.c
b2d430
@@ -130,6 +130,16 @@ done:
b2d430
     return ret;
b2d430
 }
b2d430
 
b2d430
+static bool is_domain_enabled(const char *domain,
b2d430
+                              const char **enabled_doms)
b2d430
+{
b2d430
+    if (enabled_doms == NULL) {
b2d430
+        return true;
b2d430
+    }
b2d430
+
b2d430
+    return string_in_list(domain, discard_const_p(char *, enabled_doms), false);
b2d430
+}
b2d430
+
b2d430
 static errno_t
b2d430
 ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
b2d430
                      struct ad_id_ctx *id_ctx,
b2d430
@@ -492,6 +502,7 @@ done:
b2d430
 
b2d430
 static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
b2d430
                                      struct sss_domain_info *domain,
b2d430
+                                     const char **enabled_domains_list,
b2d430
                                      size_t nsd, struct sysdb_attrs **sd,
b2d430
                                      struct sysdb_attrs *root,
b2d430
                                      size_t *_nsd_out,
b2d430
@@ -500,9 +511,10 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
b2d430
     size_t i, sdi;
b2d430
     struct sysdb_attrs **sd_out;
b2d430
     const char *sd_name;
b2d430
+    const char *root_name;
b2d430
     errno_t ret;
b2d430
 
b2d430
-    if (root == NULL) {
b2d430
+    if (root == NULL && enabled_domains_list == NULL) {
b2d430
         /* We are connected directly to the root domain. The 'sd'
b2d430
          * list is complete and we can just use it
b2d430
          */
b2d430
@@ -529,6 +541,13 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
b2d430
             goto fail;
b2d430
         }
b2d430
 
b2d430
+        if (is_domain_enabled(sd_name, enabled_domains_list) == false) {
b2d430
+            DEBUG(SSSDBG_TRACE_FUNC, "Disabling subdomain %s\n", sd_name);
b2d430
+            continue;
b2d430
+        } else {
b2d430
+            DEBUG(SSSDBG_TRACE_FUNC, "Enabling subdomain %s\n", sd_name);
b2d430
+        }
b2d430
+
b2d430
         if (strcasecmp(sd_name, domain->name) == 0) {
b2d430
             DEBUG(SSSDBG_TRACE_INTERNAL,
b2d430
                   "Not including primary domain %s in the subdomain list\n",
b2d430
@@ -541,9 +560,23 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
b2d430
     }
b2d430
 
b2d430
     /* Now include the root */
b2d430
-    sd_out[sdi] = talloc_steal(sd_out, root);
b2d430
+    if (root != NULL) {
b2d430
+        ret = sysdb_attrs_get_string(root, AD_AT_TRUST_PARTNER, &root_name);
b2d430
+        if (ret != EOK) {
b2d430
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n");
b2d430
+            goto fail;
b2d430
+        }
b2d430
 
b2d430
-    *_nsd_out = sdi+1;
b2d430
+        if (is_domain_enabled(root_name, enabled_domains_list) == true) {
b2d430
+            sd_out[sdi] = talloc_steal(sd_out, root);
b2d430
+            sdi++;
b2d430
+        } else {
b2d430
+            DEBUG(SSSDBG_TRACE_FUNC, "Disabling forest root domain %s\n",
b2d430
+                                     root_name);
b2d430
+        }
b2d430
+    }
b2d430
+
b2d430
+    *_nsd_out = sdi;
b2d430
     *_sd_out = sd_out;
b2d430
     return EOK;
b2d430
 
b2d430
@@ -789,6 +822,7 @@ static void ad_get_slave_domain_done(struct tevent_req *subreq)
b2d430
      * subdomains.
b2d430
      */
b2d430
     ret = ad_subdomains_process(state, state->be_ctx->domain,
b2d430
+                                state->sd_ctx->ad_enabled_domains,
b2d430
                                 reply_count, reply, state->root_attrs,
b2d430
                                 &nsubdoms, &subdoms);
b2d430
     if (ret != EOK) {
b2d430
-- 
b2d430
2.4.11
b2d430