Blame SOURCES/0117-SDAP-Fix-handling-of-search-bases.patch

ecf709
From ef6d1aaaa416bca3318e2961269620db7720a55b Mon Sep 17 00:00:00 2001
ecf709
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
ecf709
Date: Tue, 11 Apr 2017 19:56:37 +0200
ecf709
Subject: [PATCH 117/118] SDAP: Fix handling of search bases
ecf709
ecf709
We were rewriting the sdap_domain's search bases for only the first
ecf709
sdap_domain in the list, which does not work for subdomains.
ecf709
ecf709
Also when search bases were already initialized in sdap_domain_subdom_add,
ecf709
we should only rewrite them when they were explicitly set in sssd.conf.
ecf709
ecf709
Resolves:
ecf709
https://pagure.io/SSSD/sssd/issue/3351
ecf709
ecf709
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
ecf709
(cherry picked from commit 4c49edbd8df651b1737c59459637962c117212c6)
ecf709
---
ecf709
 src/providers/ad/ad_common.c              | 39 +++++++++++++++++++++----------
ecf709
 src/providers/ad/ad_common.h              |  3 ++-
ecf709
 src/providers/ipa/ipa_subdomains_server.c |  2 +-
ecf709
 src/providers/ldap/ldap_options.c         |  2 --
ecf709
 4 files changed, 30 insertions(+), 16 deletions(-)
ecf709
ecf709
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
ecf709
index f893b748a2ddcff1eab6e8d919d2aa950b825446..1a9d8dc0bfdf18e76e3c97a7ac7e297c4d24fd44 100644
ecf709
--- a/src/providers/ad/ad_common.c
ecf709
+++ b/src/providers/ad/ad_common.c
ecf709
@@ -29,7 +29,8 @@ struct ad_server_data {
ecf709
     bool gc;
ecf709
 };
ecf709
 
ecf709
-errno_t ad_set_search_bases(struct sdap_options *id_opts);
ecf709
+errno_t ad_set_search_bases(struct sdap_options *id_opts,
ecf709
+                            struct sdap_domain *sdap);
ecf709
 static errno_t ad_set_sdap_options(struct ad_options *ad_opts,
ecf709
                                    struct sdap_options *id_opts);
ecf709
 
ecf709
@@ -1074,7 +1075,7 @@ ad_get_id_options(struct ad_options *ad_opts,
ecf709
     }
ecf709
 
ecf709
     /* Set up search bases if they were assigned explicitly */
ecf709
-    ret = ad_set_search_bases(id_opts);
ecf709
+    ret = ad_set_search_bases(id_opts, NULL);
ecf709
     if (ret != EOK) {
ecf709
         talloc_free(id_opts);
ecf709
         return ret;
ecf709
@@ -1116,11 +1117,14 @@ ad_get_autofs_options(struct ad_options *ad_opts,
ecf709
 }
ecf709
 
ecf709
 errno_t
ecf709
-ad_set_search_bases(struct sdap_options *id_opts)
ecf709
+ad_set_search_bases(struct sdap_options *id_opts,
ecf709
+                    struct sdap_domain *sdom)
ecf709
 {
ecf709
     errno_t ret;
ecf709
-    char *default_search_base;
ecf709
+    char *default_search_base = NULL;
ecf709
     size_t o;
ecf709
+    struct sdap_domain *sdap_dom;
ecf709
+    bool has_default;
ecf709
     const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
ecf709
                                         SDAP_GROUP_SEARCH_BASE,
ecf709
                                         SDAP_NETGROUP_SEARCH_BASE,
ecf709
@@ -1132,10 +1136,21 @@ ad_set_search_bases(struct sdap_options *id_opts)
ecf709
      * been specifically overridden.
ecf709
      */
ecf709
 
ecf709
-    default_search_base =
ecf709
-            dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE);
ecf709
+    if (sdom != NULL) {
ecf709
+        sdap_dom = sdom;
ecf709
+    } else {
ecf709
+        /* If no specific sdom was given, use the first in the list. */
ecf709
+        sdap_dom = id_opts->sdom;
ecf709
+    }
ecf709
 
ecf709
-    if (default_search_base) {
ecf709
+    has_default = sdap_dom->search_bases != NULL;
ecf709
+
ecf709
+    if (has_default == false) {
ecf709
+        default_search_base =
ecf709
+                dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE);
ecf709
+    }
ecf709
+
ecf709
+    if (default_search_base && has_default == false) {
ecf709
         /* set search bases if they are not */
ecf709
         for (o = 0; search_base_options[o] != -1; o++) {
ecf709
             if (NULL == dp_opt_get_string(id_opts->basic,
ecf709
@@ -1162,31 +1177,31 @@ ad_set_search_bases(struct sdap_options *id_opts)
ecf709
     /* Default search */
ecf709
     ret = sdap_parse_search_base(id_opts, id_opts->basic,
ecf709
                                  SDAP_SEARCH_BASE,
ecf709
-                                 &id_opts->sdom->search_bases);
ecf709
+                                 &sdap_dom->search_bases);
ecf709
     if (ret != EOK && ret != ENOENT) goto done;
ecf709
 
ecf709
     /* User search */
ecf709
     ret = sdap_parse_search_base(id_opts, id_opts->basic,
ecf709
                                  SDAP_USER_SEARCH_BASE,
ecf709
-                                 &id_opts->sdom->user_search_bases);
ecf709
+                                 &sdap_dom->user_search_bases);
ecf709
     if (ret != EOK && ret != ENOENT) goto done;
ecf709
 
ecf709
     /* Group search base */
ecf709
     ret = sdap_parse_search_base(id_opts, id_opts->basic,
ecf709
                                  SDAP_GROUP_SEARCH_BASE,
ecf709
-                                 &id_opts->sdom->group_search_bases);
ecf709
+                                 &sdap_dom->group_search_bases);
ecf709
     if (ret != EOK && ret != ENOENT) goto done;
ecf709
 
ecf709
     /* Netgroup search */
ecf709
     ret = sdap_parse_search_base(id_opts, id_opts->basic,
ecf709
                                  SDAP_NETGROUP_SEARCH_BASE,
ecf709
-                                 &id_opts->sdom->netgroup_search_bases);
ecf709
+                                 &sdap_dom->netgroup_search_bases);
ecf709
     if (ret != EOK && ret != ENOENT) goto done;
ecf709
 
ecf709
     /* Service search */
ecf709
     ret = sdap_parse_search_base(id_opts, id_opts->basic,
ecf709
                                  SDAP_SERVICE_SEARCH_BASE,
ecf709
-                                 &id_opts->sdom->service_search_bases);
ecf709
+                                 &sdap_dom->service_search_bases);
ecf709
     if (ret != EOK && ret != ENOENT) goto done;
ecf709
 
ecf709
     ret = EOK;
ecf709
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
ecf709
index 2981550f6c390929501ec8942e861b16ea0a5cb0..ce33b37c75f45ae72adb268858cce34759b8b02f 100644
ecf709
--- a/src/providers/ad/ad_common.h
ecf709
+++ b/src/providers/ad/ad_common.h
ecf709
@@ -130,7 +130,8 @@ struct ad_options *ad_create_1way_trust_options(TALLOC_CTX *mem_ctx,
ecf709
                                                 const char *keytab,
ecf709
                                                 const char *sasl_authid);
ecf709
 
ecf709
-errno_t ad_set_search_bases(struct sdap_options *id_opts);
ecf709
+errno_t ad_set_search_bases(struct sdap_options *id_opts,
ecf709
+                            struct sdap_domain *sdap);
ecf709
 
ecf709
 errno_t
ecf709
 ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *ctx,
ecf709
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
ecf709
index e8ee30392d84f84e30bcdaa3d2110ba130b1ad73..b02ea67af964a03e5466067cdb2b3ba4498120eb 100644
ecf709
--- a/src/providers/ipa/ipa_subdomains_server.c
ecf709
+++ b/src/providers/ipa/ipa_subdomains_server.c
ecf709
@@ -332,7 +332,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
ecf709
         return EFAULT;
ecf709
     }
ecf709
 
ecf709
-    ret = ad_set_search_bases(ad_options->id);
ecf709
+    ret = ad_set_search_bases(ad_options->id, sdom);
ecf709
     if (ret != EOK) {
ecf709
         DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD search bases\n");
ecf709
         talloc_free(ad_options);
ecf709
diff --git a/src/providers/ldap/ldap_options.c b/src/providers/ldap/ldap_options.c
ecf709
index 15a2609f07506b6dd442b180651a7e25461976c0..eb4e177b456253ebdfa06ee52886a5dffe0d3351 100644
ecf709
--- a/src/providers/ldap/ldap_options.c
ecf709
+++ b/src/providers/ldap/ldap_options.c
ecf709
@@ -581,8 +581,6 @@ errno_t sdap_parse_search_base(TALLOC_CTX *mem_ctx,
ecf709
     char *unparsed_base;
ecf709
     const char *old_filter = NULL;
ecf709
 
ecf709
-    *_search_bases = NULL;
ecf709
-
ecf709
     switch (class) {
ecf709
     case SDAP_SEARCH_BASE:
ecf709
         class_name = "DEFAULT";
ecf709
-- 
ecf709
2.9.3
ecf709