From bf4580b2f893cfb29d804a9fe6bb2d6247bb5cf2 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sun, 8 Jul 2018 22:17:41 +0200 Subject: [PATCH] SDAP: Detect schemaNamingContext from the rootDSE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Whether an attribute is replicated to the Global Catalog or not can be detected by checking the value of the isMemberOfPartialAttributeSet attribute: https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-ismemberofpartialattributeset This attribute is present in all objects with the objectClass attributeSchema in AD: https://docs.microsoft.com/en-us/windows/desktop/AD/characteristics-of-attributes And finally, the attributeSchema objects in AD are present in a schema naming context. The schema naming context is replicated to all DCs in the forest even though their own naming context might be different: https://docs.microsoft.com/en-us/windows/desktop/ad/naming-contexts-and-partitions Where the schema naming context is located is given by the schemaNamingContext attribute of the rootDSE. This patch is trivial on its own and just reads schemaNamingContext from the rootDSE and stores it in the sdap_options structure for later use. Related: https://pagure.io/SSSD/sssd/issue/3755 Reviewed-by: Pavel Březina (cherry picked from commit c8d1c1b734a1763b3e1233f060cc5c8d6db078e9) --- src/providers/ldap/sdap.c | 10 ++++++++++ src/providers/ldap/sdap.h | 3 +++ 2 files changed, 13 insertions(+) diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c index 0241a99e49e94345753399d5d62639c99b95ee77..5c9d0a45dfb96e8901467aa6a3391b8df84f6d42 100644 --- a/src/providers/ldap/sdap.c +++ b/src/providers/ldap/sdap.c @@ -1284,6 +1284,7 @@ int sdap_get_server_opts_from_rootdse(TALLOC_CTX *memctx, const char *last_usn_name; const char *last_usn_value; const char *entry_usn_name; + const char *schema_nc = NULL; char *endptr = NULL; int ret; int i; @@ -1400,6 +1401,15 @@ int sdap_get_server_opts_from_rootdse(TALLOC_CTX *memctx, "(%s). Continuing without AD performance enhancements\n", strerror(ret)); } + + ret = sysdb_attrs_get_string(rootdse, + SDAP_ROOTDSE_ATTR_AD_SCHEMA_NC, + &schema_nc); + if (ret == EOK) { + DEBUG(SSSDBG_CONF_SETTINGS, + "Will look for schema at [%s]\n", schema_nc); + opts->schema_basedn = talloc_strdup(opts, schema_nc); + } } if (!last_usn_name) { diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 0790544818633e26ee5a8fbdca556b8230b1df3f..31c25c32f059b4290a7511600cee638ee7a269e8 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -130,6 +130,7 @@ struct sdap_ppolicy_data { #define SDAP_ROOTDSE_ATTR_NAMING_CONTEXTS "namingContexts" #define SDAP_ROOTDSE_ATTR_DEFAULT_NAMING_CONTEXT "defaultNamingContext" #define SDAP_ROOTDSE_ATTR_AD_VERSION "domainControllerFunctionality" +#define SDAP_ROOTDSE_ATTR_AD_SCHEMA_NC "schemaNamingContext" #define SDAP_IPA_USN "entryUSN" #define SDAP_IPA_LAST_USN "lastUSN" @@ -496,8 +497,10 @@ struct sdap_options { /* The search bases for the domain or its subdomain */ struct sdap_domain *sdom; + /* The options below are normally only used with AD */ bool support_matching_rule; enum dc_functional_level dc_functional_level; + const char *schema_basedn; /* Certificate mapping support */ struct sdap_certmap_ctx *sdap_certmap_ctx; -- 2.17.1