From f994343e9ffc8f8d2917678ae61bcdf68c316a20 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>

Date: Tue, 9 May 2017 11:21:02 +0200

Subject: [PATCH 131/131] AD SUBDOMAINS: Fix search bases for child domains

When using direct AD integration, child domains did not respect

the sssd.conf configuration of search bases.

There were few issues all of which are fixed in this small

patch.

First problem was that the sdap domain list was not properly

inherited from the parent in the child domains and the children

always created their own sdap domains lists that were disconnected

from the parent context and never used.

Second issue was that the child domain did not call the function

to reinit the search bases after the sdap_domain was added to the

list of sdap domains. This caused that child domains always used

automatically detected search bases and never used the configured

ones even though they were properly read into the ID options

context attached to the subdomain.

Also there has been an issue that the sdap search bases

were rewritten by the new child domain initialization

(this only happened with more than one child domain)

because the sdap domain list was 'updated' every time

a new child domain was initialized, which caused that

only the main domain and the last child domain had proper

search bases, the others only the auto-discovered ones

(because they were overwritten with the 'update').

Resolves:

https://pagure.io/SSSD/sssd/issue/3397

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/providers/ad/ad_subdomains.c | 17 +++++++++++++++++

 src/providers/ldap/sdap_domain.c |  5 +++++

 2 files changed, 22 insertions(+)

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c

index ef166446e837c3f7cd824c1abf4b5cc587aec9da..c9b79dd9d6840802cddc067eef9d5110cf8d0778 100644

--- a/src/providers/ad/ad_subdomains.c

+++ b/src/providers/ad/ad_subdomains.c

@@ -221,6 +221,9 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,

     ad_id_ctx->sdap_id_ctx->opts = ad_options->id;

     ad_options->id_ctx = ad_id_ctx;

+    /* We need to pass the sdap list from parent */

+    ad_id_ctx->sdap_id_ctx->opts->sdom = id_ctx->sdap_id_ctx->opts->sdom;

+

     /* use AD plugin */

     srv_ctx = ad_srv_plugin_ctx_init(be_ctx, be_ctx->be_res,

                                      default_host_dbs,

@@ -257,6 +260,13 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,

     ad_id_ctx->sdap_id_ctx->opts->idmap_ctx =

         id_ctx->sdap_id_ctx->opts->idmap_ctx;

+    ret = ad_set_search_bases(ad_options->id, sdom);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "Failed to set LDAP search bases for "

+              "domain '%s'. Will try to use automatically detected search "

+              "bases.", subdom->name);

+    }

+

     *_subdom_id_ctx = ad_id_ctx;

     return EOK;

 }

@@ -621,6 +631,13 @@ ads_store_sdap_subdom(struct ad_subdomains_ctx *ctx,

         return ret;

     }

+    ret = ad_set_search_bases(ctx->ad_id_ctx->ad_options->id, ctx->sdom);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "failed to set ldap search bases for "

+              "domain '%s'. will try to use automatically detected search "

+              "bases.", ctx->sdom->dom->name);

+    }

+

     DLIST_FOR_EACH(sditer, ctx->sdom) {

         if (IS_SUBDOMAIN(sditer->dom) && sditer->pvt == NULL) {

             ret = ad_subdom_ad_ctx_new(ctx->be_ctx, ctx->ad_id_ctx,

diff --git a/src/providers/ldap/sdap_domain.c b/src/providers/ldap/sdap_domain.c

index 5cba9df0fd5fb320a57adc39093283aed865f57f..d384b2e4a0ec3a7c8d0b05e0ce735feb2189085f 100644

--- a/src/providers/ldap/sdap_domain.c

+++ b/src/providers/ldap/sdap_domain.c

@@ -154,6 +154,11 @@ sdap_domain_subdom_add(struct sdap_id_ctx *sdap_id_ctx,

                     parent->name, ret, strerror(ret));

                 return ret;

             }

+        } else if (sditer->search_bases != NULL) {

+            DEBUG(SSSDBG_TRACE_FUNC,

+                  "subdomain %s has already initialized search bases\n",

+                  dom->name);

+            continue;

         } else {

             sdom = sditer;

         }

-- 

2.9.3