|
 |
ecf709 |
From 8441030009c22daa835f89dbc36365415524b320 Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ecf709 |
Date: Fri, 31 Mar 2017 17:12:56 +0200
|
|
|
ecf709 |
Subject: [PATCH 114/118] CONFDB: Fix standalone application domains
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
When a standalone application domain was configured, for example:
|
|
|
ecf709 |
|
|
|
ecf709 |
-------------------------------------------------
|
|
|
ecf709 |
[sssd]
|
|
|
ecf709 |
domains = appdomain
|
|
|
ecf709 |
|
|
|
ecf709 |
[application/appdomain]
|
|
|
ecf709 |
id_provider=ldap
|
|
|
ecf709 |
ldap_uri = ldap://dc.ipa.test
|
|
|
ecf709 |
ldap_search_base = cn=accounts,dc=ipa,dc=test
|
|
|
ecf709 |
ldap_schema = rfc2307bis
|
|
|
ecf709 |
sudo_provider = none
|
|
|
ecf709 |
|
|
|
ecf709 |
ldap_sasl_mech = gssapi
|
|
|
ecf709 |
krb5_realm = IPA.TEST
|
|
|
ecf709 |
krb5_server = dc.ipa.test
|
|
|
ecf709 |
|
|
|
ecf709 |
ldap_user_uid_number = telephonenumber
|
|
|
ecf709 |
ldap_user_gid_number = mobile
|
|
|
ecf709 |
ldap_user_extra_attrs = location:l
|
|
|
ecf709 |
-------------------------------------------------
|
|
|
ecf709 |
|
|
|
ecf709 |
We would, when unrolling the application section into a domain section,
|
|
|
ecf709 |
first add a domain stub, equivalent to:
|
|
|
ecf709 |
-----------------------------
|
|
|
ecf709 |
[domain/appdomain]
|
|
|
ecf709 |
domain_type = application
|
|
|
ecf709 |
-----------------------------
|
|
|
ecf709 |
|
|
|
ecf709 |
Which in config.ldb also contains cn. Then, whem we would add the parameters
|
|
|
ecf709 |
from the [application] section, but try to add the cn again.
|
|
|
ecf709 |
|
|
|
ecf709 |
This didn't happen when inheriting from a POSIX domain, because there we
|
|
|
ecf709 |
would set LDB_FLAG_REPLACE for any attributes that exist in the inherited
|
|
|
ecf709 |
domain.
|
|
|
ecf709 |
|
|
|
ecf709 |
This patch skips the cn attribute both when replacing an inherited
|
|
|
ecf709 |
domain's attributes and when writing a standalone application domain.
|
|
|
ecf709 |
|
|
|
ecf709 |
Resolves:
|
|
|
ecf709 |
https://pagure.io/SSSD/sssd/issue/3355
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit 734e73257fff1c1884b72b8cf988f6d75c3a7567)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/confdb/confdb.c | 26 ++++++++++++++++++++++----
|
|
|
ecf709 |
1 file changed, 22 insertions(+), 4 deletions(-)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
|
|
|
ecf709 |
index 88e114457deac3ca50c291a131122624fb6f6fe4..5bb593de03cc2fb26218b883fd1d753e31bedc2d 100644
|
|
|
ecf709 |
--- a/src/confdb/confdb.c
|
|
|
ecf709 |
+++ b/src/confdb/confdb.c
|
|
|
ecf709 |
@@ -1909,7 +1909,7 @@ static int confdb_add_app_domain(TALLOC_CTX *mem_ctx,
|
|
|
ecf709 |
|
|
|
ecf709 |
cdb_path = talloc_asprintf(mem_ctx, CONFDB_DOMAIN_PATH_TMPL, name);
|
|
|
ecf709 |
if (cdb_path == NULL) {
|
|
|
ecf709 |
- return ENOMEM;
|
|
|
ecf709 |
+ return ENOMEM;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
val[0] = CONFDB_DOMAIN_TYPE_APP;
|
|
|
ecf709 |
@@ -1933,6 +1933,7 @@ static int confdb_merge_parent_domain(const char *name,
|
|
|
ecf709 |
struct ldb_message *replace_msg = NULL;
|
|
|
ecf709 |
struct ldb_message *app_msg = NULL;
|
|
|
ecf709 |
struct ldb_dn *domain_dn;
|
|
|
ecf709 |
+ struct ldb_message_element *el = NULL;
|
|
|
ecf709 |
TALLOC_CTX *tmp_ctx = NULL;
|
|
|
ecf709 |
|
|
|
ecf709 |
tmp_ctx = talloc_new(NULL);
|
|
|
ecf709 |
@@ -1974,6 +1975,12 @@ static int confdb_merge_parent_domain(const char *name,
|
|
|
ecf709 |
replace_msg->elements[i].flags = LDB_FLAG_MOD_ADD;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
+ el = ldb_msg_find_element(replace_msg, "cn");
|
|
|
ecf709 |
+ if (el != NULL) {
|
|
|
ecf709 |
+ /* Don't add second cn */
|
|
|
ecf709 |
+ ldb_msg_remove_element(replace_msg, el);
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
+
|
|
|
ecf709 |
ret = ldb_modify(cdb->ldb, replace_msg);
|
|
|
ecf709 |
if (ret != LDB_SUCCESS) {
|
|
|
ecf709 |
ret = sysdb_error_to_errno(ret);
|
|
|
ecf709 |
@@ -1993,7 +2000,14 @@ static int confdb_merge_parent_domain(const char *name,
|
|
|
ecf709 |
app_msg->dn = domain_dn;
|
|
|
ecf709 |
|
|
|
ecf709 |
for (unsigned i = 0; i < app_section->msgs[0]->num_elements; i++) {
|
|
|
ecf709 |
- struct ldb_message_element *el = NULL;
|
|
|
ecf709 |
+ struct ldb_message_element *app_el = &app_section->msgs[0]->elements[i];
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ /* These elements will be skipped when replacing attributes in
|
|
|
ecf709 |
+ * a domain to avoid EEXIST errors
|
|
|
ecf709 |
+ */
|
|
|
ecf709 |
+ if (strcasecmp(app_el->name, "cn") == 0) {
|
|
|
ecf709 |
+ continue;
|
|
|
ecf709 |
+ }
|
|
|
ecf709 |
|
|
|
ecf709 |
if (replace_msg != NULL) {
|
|
|
ecf709 |
el = ldb_msg_find_element(replace_msg,
|
|
|
ecf709 |
@@ -2013,12 +2027,16 @@ static int confdb_merge_parent_domain(const char *name,
|
|
|
ecf709 |
ret = ldb_msg_add(app_msg,
|
|
|
ecf709 |
&app_section->msgs[0]->elements[i],
|
|
|
ecf709 |
ldb_flag);
|
|
|
ecf709 |
- if (ret != EOK) {
|
|
|
ecf709 |
+ if (ret != LDB_SUCCESS) {
|
|
|
ecf709 |
continue;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
- ret = ldb_modify(cdb->ldb, app_msg);
|
|
|
ecf709 |
+ /* We use permissive modification here because adding cn or
|
|
|
ecf709 |
+ * distinguishedName from the app_section to the application
|
|
|
ecf709 |
+ * message would throw EEXIST
|
|
|
ecf709 |
+ */
|
|
|
ecf709 |
+ ret = sss_ldb_modify_permissive(cdb->ldb, app_msg);
|
|
|
ecf709 |
if (ret != LDB_SUCCESS) {
|
|
|
ecf709 |
ret = sysdb_error_to_errno(ret);
|
|
|
ecf709 |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.3
|
|
|
ecf709 |
|