From 6f6b3b1f4fcec79a1640a97fb3cd875f2cd8b83a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Tue, 19 Mar 2019 11:01:10 +0100
Subject: [PATCH] AD: Allow configuring auto_private_groups per subdomain or
with subdomain_inherit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Resolves:
https://pagure.io/SSSD/sssd/issue/3965
Previously, subdomains that used ID mapping always only used MPGs and
POSIX subdomains always inherited the parent domain settings. This patch
is a small RFE which allows to either set the auto_private_groups option
directly per subdomain or set it for all subdomains using the
subdomain_inherit option
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
(cherry picked from commit 41c497b8b9e6efb9f2aa8e4cc869d465c3b954b3)
---
src/man/sssd.conf.5.xml | 38 +++++----
src/providers/ad/ad_subdomains.c | 107 ++++++++++++++++++++++----
src/providers/ldap/sdap_async_users.c | 2 +-
src/util/domain_info_utils.c | 14 +++-
src/util/util.h | 3 +
5 files changed, 130 insertions(+), 34 deletions(-)
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 41ba7b924..3d017f638 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -2995,6 +2995,13 @@ subdomain_inherit = ldap_purge_cache_timeout
Create user's private group unconditionally from user's UID number.
The GID number is ignored in this case.
</para>
+ <para>
+ NOTE: Because the GID number and the user private group
+ are inferred from the UID number, it is not supported
+ to have multiple entries with the same UID or GID number
+ with this option. In other words, enabling this option
+ enforces uniqueness across the ID space.
+ </para>
</listitem>
</varlistentry>
<varlistentry>
@@ -3041,24 +3048,25 @@ subdomain_inherit = ldap_purge_cache_timeout
</varlistentry>
</variablelist>
</para>
- <para>
- For POSIX subdomains, setting the option in the main
- domain is inherited in the subdomain.
- </para>
- <para>
- For ID-mapping subdomains, auto_private_groups is
- already enabled for the subdomains and setting it to
- false will not have any effect for the subdomain.
- </para>
<para>
- NOTE: Because the GID number and the user private group
- are inferred from the UID number, it is not supported
- to have multiple entries with the same UID or GID number
- with this option. In other words, enabling this option
- enforces uniqueness across the ID space.
+ For subdomains, the default value is False for
+ subdomains that use assigned POSIX IDs and True
+ for subdomains that use automatic ID-mapping.
</para>
<para>
- Default: False
+ The value of auto_private_groups can either be set per subdomains
+ in a subsection, for example:
+<programlisting>
+[domain/forest.domain/sub.domain]
+auto_private_groups = false
+</programlisting>
+ or globally for all subdomains in the main domain section
+ using the subdomain_inherit option:
+<programlisting>
+[domain/forest.domain]
+subdomain_inherit = auto_private_groups
+auto_private_groups = false
+</programlisting>
</para>
</listitem>
</varlistentry>
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
index 5b046773c..4fc4be094 100644
--- a/src/providers/ad/ad_subdomains.c
+++ b/src/providers/ad/ad_subdomains.c
@@ -436,8 +436,87 @@ static errno_t ad_subdom_enumerates(struct sss_domain_info *parent,
return EOK;
}
+static enum sss_domain_mpg_mode
+get_default_subdom_mpg_mode(struct sdap_idmap_ctx *idmap_ctx,
+ struct sss_domain_info *parent,
+ const char *subdom_name,
+ char *subdom_sid_str)
+{
+ bool use_id_mapping;
+ bool inherit_option;
+ enum sss_domain_mpg_mode default_mpg_mode;
+
+ inherit_option = string_in_list(CONFDB_DOMAIN_AUTO_UPG,
+ parent->sd_inherit, false);
+ if (inherit_option) {
+ return get_domain_mpg_mode(parent);
+ }
+
+ use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(idmap_ctx,
+ subdom_name,
+ subdom_sid_str);
+ if (use_id_mapping == true) {
+ default_mpg_mode = MPG_ENABLED;
+ } else {
+ /* Domains that use the POSIX attributes set by the admin must
+ * inherit the MPG setting from the parent domain so that the
+ * auto_private_groups options works for trusted domains as well
+ */
+ default_mpg_mode = get_domain_mpg_mode(parent);
+ }
+
+ return default_mpg_mode;
+}
+
+static enum sss_domain_mpg_mode
+ad_subdom_mpg_mode(TALLOC_CTX *mem_ctx,
+ struct confdb_ctx *cdb,
+ struct sss_domain_info *parent,
+ enum sss_domain_mpg_mode default_mpg_mode,
+ const char *subdom_name)
+{
+ char *subdom_conf_path;
+ char *mpg_str_opt;
+ errno_t ret;
+ enum sss_domain_mpg_mode ret_mode;
+
+ subdom_conf_path = subdomain_create_conf_path_from_str(mem_ctx,
+ parent->name,
+ subdom_name);
+ if (subdom_conf_path == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "subdom_conf_path failed, will use %s mode as fallback\n",
+ str_domain_mpg_mode(default_mpg_mode));
+ return default_mpg_mode;
+ }
+
+ ret = confdb_get_string(cdb, mem_ctx, subdom_conf_path,
+ CONFDB_DOMAIN_AUTO_UPG,
+ NULL,
+ &mpg_str_opt);
+ talloc_free(subdom_conf_path);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "condb_get_string failed, will use %s mode as fallback\n",
+ str_domain_mpg_mode(default_mpg_mode));
+ return default_mpg_mode;
+ }
+
+ if (mpg_str_opt == NULL) {
+ DEBUG(SSSDBG_CONF_SETTINGS,
+ "Subdomain MPG mode not set, using %s\n",
+ str_domain_mpg_mode(default_mpg_mode));
+ return default_mpg_mode;
+ }
+
+ ret_mode = str_to_domain_mpg_mode(mpg_str_opt);
+ talloc_free(mpg_str_opt);
+ return ret_mode;
+}
+
static errno_t
-ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
+ad_subdom_store(struct confdb_ctx *cdb,
+ struct sdap_idmap_ctx *idmap_ctx,
struct sss_domain_info *domain,
struct sysdb_attrs *subdom_attrs,
bool enumerate)
@@ -451,8 +530,8 @@ ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
struct ldb_message_element *el;
char *sid_str = NULL;
uint32_t trust_type;
- bool use_id_mapping;
enum sss_domain_mpg_mode mpg_mode;
+ enum sss_domain_mpg_mode default_mpg_mode;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
@@ -501,17 +580,13 @@ ad_subdom_store(struct sdap_idmap_ctx *idmap_ctx,
goto done;
}
- use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(idmap_ctx,
- name, sid_str);
- if (use_id_mapping == true) {
- mpg_mode = MPG_ENABLED;
- } else {
- /* Domains that use the POSIX attributes set by the admin must
- * inherit the MPG setting from the parent domain so that the
- * auto_private_groups options works for trusted domains as well
- */
- mpg_mode = get_domain_mpg_mode(domain);
- }
+ default_mpg_mode = get_default_subdom_mpg_mode(idmap_ctx, domain,
+ name, sid_str);
+
+ mpg_mode = ad_subdom_mpg_mode(tmp_ctx, cdb, domain,
+ default_mpg_mode, name);
+ DEBUG(SSSDBG_CONF_SETTINGS, "MPG mode of %s is %s\n",
+ name, str_domain_mpg_mode(mpg_mode));
ret = sysdb_subdomain_store(domain->sysdb, name, realm, flat, sid_str,
mpg_mode, enumerate, domain->forest, 0, NULL);
@@ -625,7 +700,8 @@ static errno_t ad_subdomains_refresh(struct be_ctx *be_ctx,
goto done;
}
- ret = ad_subdom_store(idmap_ctx, domain, subdomains[c], enumerate);
+ ret = ad_subdom_store(be_ctx->cdb, idmap_ctx, domain,
+ subdomains[c], enumerate);
if (ret) {
/* Nothing we can do about the error. Let's at least try
* to reuse the existing domains
@@ -660,7 +736,8 @@ static errno_t ad_subdomains_refresh(struct be_ctx *be_ctx,
goto done;
}
- ret = ad_subdom_store(idmap_ctx, domain, subdomains[c], enumerate);
+ ret = ad_subdom_store(be_ctx->cdb, idmap_ctx, domain,
+ subdomains[c], enumerate);
if (ret) {
DEBUG(SSSDBG_MINOR_FAILURE, "Failed to parse subdom data, "
"will try to use cached subdomain\n");
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index 92eeda1d3..af4dc1a17 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -389,7 +389,7 @@ int sdap_save_user(TALLOC_CTX *memctx,
goto done;
}
- if (IS_SUBDOMAIN(dom) || sss_domain_is_mpg(dom) == true) {
+ if (sss_domain_is_mpg(dom) == true) {
/* For subdomain users, only create the private group as
* the subdomain is an MPG domain.
* But we have to save the GID of the original primary group
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index 4896ef051..4b1c9df39 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -889,6 +889,14 @@ bool sss_domain_is_forest_root(struct sss_domain_info *dom)
return (dom->forest_root == dom);
}
+char *subdomain_create_conf_path_from_str(TALLOC_CTX *mem_ctx,
+ const char *parent_name,
+ const char *subdom_name)
+{
+ return talloc_asprintf(mem_ctx, CONFDB_DOMAIN_PATH_TMPL "/%s",
+ parent_name, subdom_name);
+}
+
char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
struct sss_domain_info *subdomain)
{
@@ -899,9 +907,9 @@ char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
return NULL;
}
- return talloc_asprintf(mem_ctx, CONFDB_DOMAIN_PATH_TMPL "/%s",
- subdomain->parent->name,
- subdomain->name);
+ return subdomain_create_conf_path_from_str(mem_ctx,
+ subdomain->parent->name,
+ subdomain->name);
}
const char *sss_domain_type_str(struct sss_domain_info *dom)
diff --git a/src/util/util.h b/src/util/util.h
index 1e36bf02a..3003583b7 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -557,6 +557,9 @@ find_domain_by_object_name_ex(struct sss_domain_info *domain,
bool subdomain_enumerates(struct sss_domain_info *parent,
const char *sd_name);
+char *subdomain_create_conf_path_from_str(TALLOC_CTX *mem_ctx,
+ const char *parent_name,
+ const char *subdom_name);
char *subdomain_create_conf_path(TALLOC_CTX *mem_ctx,
struct sss_domain_info *subdomain);
--
2.19.1