Blame SOURCES/0145-IPA-verify-group-memberships-of-trusted-domain-users.patch

905b4d
From ad463501d3bdea4c24c17d792efc1c3e65c08c19 Mon Sep 17 00:00:00 2001
905b4d
From: Sumit Bose <sbose@redhat.com>
905b4d
Date: Thu, 11 Dec 2014 10:49:39 +0100
905b4d
Subject: [PATCH 6/7] IPA: verify group memberships of trusted domain users
905b4d
MIME-Version: 1.0
905b4d
Content-Type: text/plain; charset=UTF-8
905b4d
Content-Transfer-Encoding: 8bit
905b4d
905b4d
Depending on the state of the cache group object a freshly created or
905b4d
updates user entry for a trusted domain user might already be a member
905b4d
of the group or not. This cache makes sure the requested user is a
905b4d
member of all groups returned from the extdom request. Special care has
905b4d
to be taken to cover cross-domain group-memberships properly.
905b4d
905b4d
Resolves https://fedorahosted.org/sssd/ticket/2529
905b4d
905b4d
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
905b4d
---
905b4d
 src/providers/ipa/ipa_s2n_exop.c | 145 ++++++++++++++++++++++++++++++++++++++-
905b4d
 1 file changed, 144 insertions(+), 1 deletion(-)
905b4d
905b4d
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
905b4d
index 0eab1afc36e4d2c1d770c596c512a641fd276425..677d1625860186ad02d4d8c7290d45b782bc4c38 100644
905b4d
--- a/src/providers/ipa/ipa_s2n_exop.c
905b4d
+++ b/src/providers/ipa/ipa_s2n_exop.c
905b4d
@@ -568,7 +568,7 @@ static errno_t add_v1_user_data(BerElement *ber, struct resp_attrs *attrs)
905b4d
          attrs->ngroups++);
905b4d
 
905b4d
     if (attrs->ngroups > 0) {
905b4d
-        attrs->groups = talloc_array(attrs, char *, attrs->ngroups);
905b4d
+        attrs->groups = talloc_zero_array(attrs, char *, attrs->ngroups + 1);
905b4d
         if (attrs->groups == NULL) {
905b4d
             DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");
905b4d
             ret = ENOMEM;
905b4d
@@ -1528,6 +1528,81 @@ done:
905b4d
     return;
905b4d
 }
905b4d
 
905b4d
+static errno_t get_groups_dns(TALLOC_CTX *mem_ctx, struct sss_domain_info *dom,
905b4d
+                              char **name_list, char ***_dn_list)
905b4d
+{
905b4d
+    int ret;
905b4d
+    TALLOC_CTX *tmp_ctx;
905b4d
+    int c;
905b4d
+    struct sss_domain_info *root_domain;
905b4d
+    char **dn_list;
905b4d
+
905b4d
+    if (name_list == NULL) {
905b4d
+        *_dn_list = NULL;
905b4d
+        return EOK;
905b4d
+    }
905b4d
+
905b4d
+    /* To handle cross-domain memberships we have to check the domain for
905b4d
+     * each group the member should be added or deleted. Since sub-domains
905b4d
+     * use fully-qualified names by default any short name can only belong
905b4d
+     * to the root/head domain. find_domain_by_object_name() will return
905b4d
+     * the domain given in the first argument if the second argument is a
905b4d
+     * a short name hence we always use root_domain as first argument. */
905b4d
+    root_domain = get_domains_head(dom);
905b4d
+    if (root_domain->fqnames) {
905b4d
+        DEBUG(SSSDBG_TRACE_FUNC,
905b4d
+              "Root domain uses fully-qualified names, " \
905b4d
+              "objects might not be correctly added to groups with " \
905b4d
+              "short names.\n");
905b4d
+    }
905b4d
+
905b4d
+    tmp_ctx = talloc_new(NULL);
905b4d
+    if (tmp_ctx == NULL) {
905b4d
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
905b4d
+        return ENOMEM;
905b4d
+    }
905b4d
+
905b4d
+    for (c = 0; name_list[c] != NULL; c++);
905b4d
+
905b4d
+    dn_list = talloc_zero_array(tmp_ctx, char *, c + 1);
905b4d
+    if (dn_list == NULL) {
905b4d
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_array failed.\n");
905b4d
+        ret = ENOMEM;
905b4d
+        goto done;
905b4d
+    }
905b4d
+
905b4d
+    for (c = 0; name_list[c] != NULL; c++) {
905b4d
+        dom = find_domain_by_object_name(root_domain, name_list[c]);
905b4d
+        if (dom == NULL) {
905b4d
+            DEBUG(SSSDBG_CRIT_FAILURE,
905b4d
+                  "Cannot find domain for [%s].\n", name_list[c]);
905b4d
+            ret = ENOENT;
905b4d
+            goto done;
905b4d
+        }
905b4d
+
905b4d
+        /* This might fail if some unexpected cases are used. But current
905b4d
+         * sysdb code which handles group membership constructs DNs this way
905b4d
+         * as well, IPA names are lowercased and AD names by default will be
905b4d
+         * lowercased as well. If there are really use-cases which cause an
905b4d
+         * issue here, sysdb_group_strdn() has to be replaced by a proper
905b4d
+         * search. */
905b4d
+        dn_list[c] = sysdb_group_strdn(dn_list, dom->name, name_list[c]);
905b4d
+        if (dn_list[c] == NULL) {
905b4d
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_group_strdn failed.\n");
905b4d
+            ret = ENOMEM;
905b4d
+            goto done;
905b4d
+        }
905b4d
+    }
905b4d
+
905b4d
+    *_dn_list = talloc_steal(mem_ctx, dn_list);
905b4d
+    ret = EOK;
905b4d
+
905b4d
+done:
905b4d
+    talloc_free(tmp_ctx);
905b4d
+
905b4d
+    return ret;
905b4d
+}
905b4d
+
905b4d
 static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
905b4d
                                     struct req_input *req_input,
905b4d
                                     struct resp_attrs *attrs,
905b4d
@@ -1548,6 +1623,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
905b4d
     const char *tmp_str;
905b4d
     struct ldb_result *res;
905b4d
     enum sysdb_member_type type;
905b4d
+    char **sysdb_grouplist;
905b4d
+    char **add_groups;
905b4d
+    char **add_groups_dns;
905b4d
+    char **del_groups;
905b4d
+    char **del_groups_dns;
905b4d
+    bool in_transaction = false;
905b4d
+    int tret;
905b4d
 
905b4d
     tmp_ctx = talloc_new(NULL);
905b4d
     if (tmp_ctx == NULL) {
905b4d
@@ -1716,6 +1798,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
905b4d
                 gid = attrs->a.user.pw_gid;
905b4d
             }
905b4d
 
905b4d
+            ret = sysdb_transaction_start(dom->sysdb);
905b4d
+            if (ret != EOK) {
905b4d
+                DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
905b4d
+                goto done;
905b4d
+            }
905b4d
+            in_transaction = true;
905b4d
+
905b4d
             ret = sysdb_store_user(dom, name, NULL,
905b4d
                                    attrs->a.user.pw_uid,
905b4d
                                    gid, attrs->a.user.pw_gecos,
905b4d
@@ -1726,6 +1815,53 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
905b4d
                 DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_user failed.\n");
905b4d
                 goto done;
905b4d
             }
905b4d
+
905b4d
+            if (attrs->response_type == RESP_USER_GROUPLIST) {
905b4d
+                ret = get_sysdb_grouplist(tmp_ctx, dom->sysdb, dom, name,
905b4d
+                                          &sysdb_grouplist);
905b4d
+                if (ret != EOK) {
905b4d
+                    DEBUG(SSSDBG_OP_FAILURE, "get_sysdb_grouplist failed.\n");
905b4d
+                    goto done;
905b4d
+                }
905b4d
+
905b4d
+                ret = diff_string_lists(tmp_ctx, attrs->groups, sysdb_grouplist,
905b4d
+                                        &add_groups, &del_groups, NULL);
905b4d
+                if (ret != EOK) {
905b4d
+                    DEBUG(SSSDBG_OP_FAILURE, "diff_string_lists failed.\n");
905b4d
+                    goto done;
905b4d
+                }
905b4d
+
905b4d
+                ret = get_groups_dns(tmp_ctx, dom, add_groups, &add_groups_dns);
905b4d
+                if (ret != EOK) {
905b4d
+                    DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n");
905b4d
+                    goto done;
905b4d
+                }
905b4d
+
905b4d
+                ret = get_groups_dns(tmp_ctx, dom, del_groups, &del_groups_dns);
905b4d
+                if (ret != EOK) {
905b4d
+                    DEBUG(SSSDBG_OP_FAILURE, "get_groups_dns failed.\n");
905b4d
+                    goto done;
905b4d
+                }
905b4d
+
905b4d
+                DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n",
905b4d
+                                             name);
905b4d
+                ret = sysdb_update_members_dn(dom, name, SYSDB_MEMBER_USER,
905b4d
+                                          (const char *const *) add_groups_dns,
905b4d
+                                          (const char *const *) del_groups_dns);
905b4d
+                if (ret != EOK) {
905b4d
+                    DEBUG(SSSDBG_CRIT_FAILURE, "Membership update failed [%d]: %s\n",
905b4d
+                                               ret, sss_strerror(ret));
905b4d
+                    goto done;
905b4d
+                }
905b4d
+            }
905b4d
+
905b4d
+            ret = sysdb_transaction_commit(dom->sysdb);
905b4d
+            if (ret != EOK) {
905b4d
+                DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
905b4d
+                goto done;
905b4d
+            }
905b4d
+            in_transaction = false;
905b4d
+
905b4d
             break;
905b4d
         case RESP_GROUP:
905b4d
         case RESP_GROUP_MEMBERS:
905b4d
@@ -1818,6 +1954,13 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
905b4d
     }
905b4d
 
905b4d
 done:
905b4d
+    if (in_transaction) {
905b4d
+        tret = sysdb_transaction_cancel(dom->sysdb);
905b4d
+        if (tret != EOK) {
905b4d
+            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
905b4d
+        }
905b4d
+    }
905b4d
+
905b4d
     talloc_free(tmp_ctx);
905b4d
 
905b4d
     return ret;
905b4d
-- 
905b4d
1.9.3
905b4d