From 405f08eabf5017cc00891fb2090be80306c8aeae Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 30 Nov 2017 12:01:51 +0100 Subject: [PATCH 70/83] LDAP: Only run the POSIX check with a GC connection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, we used to run the POSIX check also with an LDAP connection. This was wasteful, but worked, so the waste wasn't the biggest problem -- the approach would only cause problems with the following patch which uses a NULL search base to search the Global Catalog, because searching with a SUBTREE scope and a NULL base returns a referral with an LDAP connection. Instead, this patch uses a heuristics (whether the connection ignores the offline state) to check if the connection is a POSIX one and if it is NOT, then skips the POSIX check. Reviewed-by: Pavel Březina Reviewed-by: Sumit Bose (cherry picked from commit dacfe74113dde62ddaaa7f9abf9d2b6448d89db6) --- src/providers/ldap/ldap_common.c | 2 ++ src/providers/ldap/ldap_common.h | 1 + src/providers/ldap/ldap_id.c | 2 ++ src/providers/ldap/sdap_async_enum.c | 1 + 4 files changed, 6 insertions(+) diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 3eff3515d95043d4b59cb0d9953cf050355a0ca5..36e79b9d6ca23ef5e21a8b0bedc7f05db8f4fc98 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -973,12 +973,14 @@ sdap_id_ctx_new(TALLOC_CTX *mem_ctx, struct be_ctx *bectx, } bool should_run_posix_check(struct sdap_id_ctx *ctx, + struct sdap_id_conn_ctx *conn, bool use_id_mapping, bool posix_request) { if (use_id_mapping == false && posix_request == true && ctx->opts->schema_type == SDAP_SCHEMA_AD && + conn->ignore_mark_offline == true && ctx->srv_opts && ctx->srv_opts->posix_checked == false) { return true; diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index fa7cda4df9d7334f6f0f5baccae0cba0478bfbea..44dbc3fb0678412f46366321e0be836313380949 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -305,6 +305,7 @@ char *get_enterprise_principal_string_filter(TALLOC_CTX *mem_ctx, struct dp_option *sdap_basic_opts); bool should_run_posix_check(struct sdap_id_ctx *ctx, + struct sdap_id_conn_ctx *conn, bool id_mapping, bool posix_request); diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index 6ab9e0aa1db3eed32deb75211ded30a4cb48ca30..47969a9749253721334a20f46230f7aecea64882 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -412,6 +412,7 @@ static void users_get_connect_done(struct tevent_req *subreq) * have no idea about POSIX attributes support, run a one-time check */ if (should_run_posix_check(state->ctx, + state->conn, state->use_id_mapping, !state->non_posix)) { subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts, @@ -957,6 +958,7 @@ static void groups_get_connect_done(struct tevent_req *subreq) * have no idea about POSIX attributes support, run a one-time check */ if (should_run_posix_check(state->ctx, + state->conn, state->use_id_mapping, !state->non_posix)) { subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts, diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c index 2cef4eb886f982ba388a34955bdd38468fe68200..baa039d63c71cc5054e6af6538d34d04cde6b858 100644 --- a/src/providers/ldap/sdap_async_enum.c +++ b/src/providers/ldap/sdap_async_enum.c @@ -197,6 +197,7 @@ static void sdap_dom_enum_ex_get_users(struct tevent_req *subreq) * have no idea about POSIX attributes support, run a one-time check */ if (should_run_posix_check(state->ctx, + state->user_conn, use_id_mapping, true)) { subreq = sdap_posix_check_send(state, state->ev, state->ctx->opts, -- 2.14.3