From ef6d1aaaa416bca3318e2961269620db7720a55b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C5=BDidek?= Date: Tue, 11 Apr 2017 19:56:37 +0200 Subject: [PATCH 117/118] SDAP: Fix handling of search bases We were rewriting the sdap_domain's search bases for only the first sdap_domain in the list, which does not work for subdomains. Also when search bases were already initialized in sdap_domain_subdom_add, we should only rewrite them when they were explicitly set in sssd.conf. Resolves: https://pagure.io/SSSD/sssd/issue/3351 Reviewed-by: Jakub Hrozek (cherry picked from commit 4c49edbd8df651b1737c59459637962c117212c6) --- src/providers/ad/ad_common.c | 39 +++++++++++++++++++++---------- src/providers/ad/ad_common.h | 3 ++- src/providers/ipa/ipa_subdomains_server.c | 2 +- src/providers/ldap/ldap_options.c | 2 -- 4 files changed, 30 insertions(+), 16 deletions(-) diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c index f893b748a2ddcff1eab6e8d919d2aa950b825446..1a9d8dc0bfdf18e76e3c97a7ac7e297c4d24fd44 100644 --- a/src/providers/ad/ad_common.c +++ b/src/providers/ad/ad_common.c @@ -29,7 +29,8 @@ struct ad_server_data { bool gc; }; -errno_t ad_set_search_bases(struct sdap_options *id_opts); +errno_t ad_set_search_bases(struct sdap_options *id_opts, + struct sdap_domain *sdap); static errno_t ad_set_sdap_options(struct ad_options *ad_opts, struct sdap_options *id_opts); @@ -1074,7 +1075,7 @@ ad_get_id_options(struct ad_options *ad_opts, } /* Set up search bases if they were assigned explicitly */ - ret = ad_set_search_bases(id_opts); + ret = ad_set_search_bases(id_opts, NULL); if (ret != EOK) { talloc_free(id_opts); return ret; @@ -1116,11 +1117,14 @@ ad_get_autofs_options(struct ad_options *ad_opts, } errno_t -ad_set_search_bases(struct sdap_options *id_opts) +ad_set_search_bases(struct sdap_options *id_opts, + struct sdap_domain *sdom) { errno_t ret; - char *default_search_base; + char *default_search_base = NULL; size_t o; + struct sdap_domain *sdap_dom; + bool has_default; const int search_base_options[] = { SDAP_USER_SEARCH_BASE, SDAP_GROUP_SEARCH_BASE, SDAP_NETGROUP_SEARCH_BASE, @@ -1132,10 +1136,21 @@ ad_set_search_bases(struct sdap_options *id_opts) * been specifically overridden. */ - default_search_base = - dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE); + if (sdom != NULL) { + sdap_dom = sdom; + } else { + /* If no specific sdom was given, use the first in the list. */ + sdap_dom = id_opts->sdom; + } - if (default_search_base) { + has_default = sdap_dom->search_bases != NULL; + + if (has_default == false) { + default_search_base = + dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE); + } + + if (default_search_base && has_default == false) { /* set search bases if they are not */ for (o = 0; search_base_options[o] != -1; o++) { if (NULL == dp_opt_get_string(id_opts->basic, @@ -1162,31 +1177,31 @@ ad_set_search_bases(struct sdap_options *id_opts) /* Default search */ ret = sdap_parse_search_base(id_opts, id_opts->basic, SDAP_SEARCH_BASE, - &id_opts->sdom->search_bases); + &sdap_dom->search_bases); if (ret != EOK && ret != ENOENT) goto done; /* User search */ ret = sdap_parse_search_base(id_opts, id_opts->basic, SDAP_USER_SEARCH_BASE, - &id_opts->sdom->user_search_bases); + &sdap_dom->user_search_bases); if (ret != EOK && ret != ENOENT) goto done; /* Group search base */ ret = sdap_parse_search_base(id_opts, id_opts->basic, SDAP_GROUP_SEARCH_BASE, - &id_opts->sdom->group_search_bases); + &sdap_dom->group_search_bases); if (ret != EOK && ret != ENOENT) goto done; /* Netgroup search */ ret = sdap_parse_search_base(id_opts, id_opts->basic, SDAP_NETGROUP_SEARCH_BASE, - &id_opts->sdom->netgroup_search_bases); + &sdap_dom->netgroup_search_bases); if (ret != EOK && ret != ENOENT) goto done; /* Service search */ ret = sdap_parse_search_base(id_opts, id_opts->basic, SDAP_SERVICE_SEARCH_BASE, - &id_opts->sdom->service_search_bases); + &sdap_dom->service_search_bases); if (ret != EOK && ret != ENOENT) goto done; ret = EOK; diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index 2981550f6c390929501ec8942e861b16ea0a5cb0..ce33b37c75f45ae72adb268858cce34759b8b02f 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -130,7 +130,8 @@ struct ad_options *ad_create_1way_trust_options(TALLOC_CTX *mem_ctx, const char *keytab, const char *sasl_authid); -errno_t ad_set_search_bases(struct sdap_options *id_opts); +errno_t ad_set_search_bases(struct sdap_options *id_opts, + struct sdap_domain *sdap); errno_t ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *ctx, diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c index e8ee30392d84f84e30bcdaa3d2110ba130b1ad73..b02ea67af964a03e5466067cdb2b3ba4498120eb 100644 --- a/src/providers/ipa/ipa_subdomains_server.c +++ b/src/providers/ipa/ipa_subdomains_server.c @@ -332,7 +332,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx, return EFAULT; } - ret = ad_set_search_bases(ad_options->id); + ret = ad_set_search_bases(ad_options->id, sdom); if (ret != EOK) { DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD search bases\n"); talloc_free(ad_options); diff --git a/src/providers/ldap/ldap_options.c b/src/providers/ldap/ldap_options.c index 15a2609f07506b6dd442b180651a7e25461976c0..eb4e177b456253ebdfa06ee52886a5dffe0d3351 100644 --- a/src/providers/ldap/ldap_options.c +++ b/src/providers/ldap/ldap_options.c @@ -581,8 +581,6 @@ errno_t sdap_parse_search_base(TALLOC_CTX *mem_ctx, char *unparsed_base; const char *old_filter = NULL; - *_search_bases = NULL; - switch (class) { case SDAP_SEARCH_BASE: class_name = "DEFAULT"; -- 2.9.3