[389-commits] Branch '389-ds-base-1.3.2' - ldap/servers
Ludwig Krispenz
lkrispen at fedoraproject.org
Fri Dec 6 08:20:39 UTC 2013
ldap/servers/plugins/memberof/memberof.c | 29 +++++++++++++++++++++
ldap/servers/plugins/memberof/memberof.h | 3 ++
ldap/servers/plugins/memberof/memberof_config.c | 32 +++++++++++++++++++++++-
3 files changed, 62 insertions(+), 2 deletions(-)
New commits:
commit 049998c2319440aa687be4b782b9d591e3683a40
Author: Ludwig Krispenz <lkrispen at redhat.com>
Date: Fri Dec 6 09:15:39 2013 +0100
Ticket 47526 - Allow memberof suffixes to be configurable
Bug Description: Request to apply referential memberof operations
to specific subtrees only
Fix Description: The fix adds a configuration parameters to the
memberof plugin:
nsslapd-memberofScope: <dn>
The logic implemented is:
If a member is added top group only if member and group
are in the defined memberof scope the memberof attribute
is updated.
If an entry is deleted and it is inside the scope, its
member references will be purged (like befoer, only apply scope)
If an entry is renamed and moved out of scope it will be handled
like a deletie and in addition its memberof attribute is removed.
https://fedorahosted.org/389/ticket/47526
Reviewed by: Thierry,Rich,Noriko -Thanks
diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c
index 5aa22fd..de90de6 100644
--- a/ldap/servers/plugins/memberof/memberof.c
+++ b/ldap/servers/plugins/memberof/memberof.c
@@ -524,6 +524,7 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn,
char *filter_str = NULL;
char *cookie = NULL;
int all_backends = memberof_config_get_all_backends();
+ Slapi_DN *entry_scope = memberof_config_get_entry_scope();
int types_name_len = 0;
int num_types = 0;
int dn_len = slapi_sdn_get_ndn_len(sdn);
@@ -531,6 +532,10 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn,
int rc = 0;
int i = 0;
+ if (entry_scope && !slapi_sdn_issuffix(sdn, entry_scope)) {
+ return (rc);
+ }
+
/* Count the number of types. */
for (num_types = 0; types && types[num_types]; num_types++)
{
@@ -599,6 +604,21 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn,
continue;
}
}
+ if (entry_scope) {
+ if (slapi_sdn_issuffix(base_sdn, entry_scope)) {
+ /* do nothing, entry scope is spanning
+ * multiple suffixes, start at suffix */
+ } else if (slapi_sdn_issuffix(entry_scope, base_sdn)) {
+ /* scope is below suffix, set search base */
+ base_sdn = entry_scope;
+ } else if(!all_backends){
+ break;
+ } else {
+ /* its ok, goto the next backend */
+ be = slapi_get_next_backend(cookie);
+ continue;
+ }
+ }
slapi_search_internal_set_pb(search_pb, slapi_sdn_get_dn(base_sdn),
LDAP_SCOPE_SUBTREE, filter_str, 0, 0, 0, 0, memberof_get_plugin_id(), 0);
@@ -628,6 +648,7 @@ int memberof_postop_modrdn(Slapi_PBlock *pb)
{
int ret = SLAPI_PLUGIN_SUCCESS;
void *caller_id = NULL;
+ Slapi_DN *entry_scope = memberof_config_get_entry_scope();
slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM,
"--> memberof_postop_modrdn\n" );
@@ -691,7 +712,13 @@ int memberof_postop_modrdn(Slapi_PBlock *pb)
* of other group entries. We need to update any member
* attributes to refer to the new name. */
if (pre_sdn && post_sdn) {
- memberof_replace_dn_from_groups(pb, &configCopy, pre_sdn, post_sdn);
+ if (entry_scope && !slapi_sdn_issuffix(post_sdn, entry_scope)) {
+ memberof_del_dn_data del_data = {0, configCopy.memberof_attr};
+ memberof_del_dn_from_groups(pb, &configCopy, pre_sdn);
+ memberof_del_dn_type_callback(post_e, &del_data);
+ } else {
+ memberof_replace_dn_from_groups(pb, &configCopy, pre_sdn, post_sdn);
+ }
}
memberof_unlock();
diff --git a/ldap/servers/plugins/memberof/memberof.h b/ldap/servers/plugins/memberof/memberof.h
index 65398aa..008ae04 100644
--- a/ldap/servers/plugins/memberof/memberof.h
+++ b/ldap/servers/plugins/memberof/memberof.h
@@ -66,6 +66,7 @@
#define MEMBEROF_GROUP_ATTR "memberOfGroupAttr"
#define MEMBEROF_ATTR "memberOfAttr"
#define MEMBEROF_BACKEND_ATTR "memberOfAllBackends"
+#define MEMBEROF_ENTRY_SCOPE_ATTR "memberOfEntryScope"
#define DN_SYNTAX_OID "1.3.6.1.4.1.1466.115.121.1.12"
#define NAME_OPT_UID_SYNTAX_OID "1.3.6.1.4.1.1466.115.121.1.34"
@@ -77,6 +78,7 @@ typedef struct memberofconfig {
char **groupattrs;
char *memberof_attr;
int allBackends;
+ Slapi_DN *entryScope;
Slapi_Filter *group_filter;
Slapi_Attr **group_slapiattrs;
} MemberOfConfig;
@@ -95,5 +97,6 @@ void memberof_rlock_config();
void memberof_wlock_config();
void memberof_unlock_config();
int memberof_config_get_all_backends();
+Slapi_DN * memberof_config_get_entry_scope();
#endif /* _MEMBEROF_H_ */
diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c
index 3fd63a9..7b7a4f4 100644
--- a/ldap/servers/plugins/memberof/memberof_config.c
+++ b/ldap/servers/plugins/memberof/memberof_config.c
@@ -79,7 +79,7 @@ static int memberof_search (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_En
/* This is the main configuration which is updated from dse.ldif. The
* config will be copied when it is used by the plug-in to prevent it
* being changed out from under a running memberOf operation. */
-static MemberOfConfig theConfig;
+static MemberOfConfig theConfig = {NULL, NULL,0, NULL, NULL, NULL};
static Slapi_RWLock *memberof_config_lock = 0;
static int inited = 0;
@@ -271,12 +271,14 @@ memberof_apply_config (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
int num_groupattrs = 0;
int groupattr_name_len = 0;
char *allBackends = NULL;
+ char *entryScope = NULL;
*returncode = LDAP_SUCCESS;
groupattrs = slapi_entry_attr_get_charray(e, MEMBEROF_GROUP_ATTR);
memberof_attr = slapi_entry_attr_get_charptr(e, MEMBEROF_ATTR);
allBackends = slapi_entry_attr_get_charptr(e, MEMBEROF_BACKEND_ATTR);
+ entryScope = slapi_entry_attr_get_charptr(e, MEMBEROF_ENTRY_SCOPE_ATTR);
/* We want to be sure we don't change the config in the middle of
* a memberOf operation, so we obtain an exclusive lock here */
@@ -386,6 +388,22 @@ memberof_apply_config (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
theConfig.allBackends = 0;
}
+ slapi_sdn_free(&theConfig.entryScope);
+ if (entryScope)
+ {
+ if (slapi_dn_syntax_check(NULL, entryScope, 1) == 1) {
+ slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM,
+ "Error: Ignoring invalid DN used as plugin entry scope: [%s]\n",
+ entryScope);
+ theConfig.entryScope = NULL;
+ slapi_ch_free_string(&entryScope);
+ } else {
+ theConfig.entryScope = slapi_sdn_new_dn_passin(entryScope);
+ }
+ } else {
+ theConfig.entryScope = NULL;
+ }
+
/* release the lock */
memberof_unlock_config();
@@ -557,3 +575,15 @@ memberof_config_get_all_backends()
return all_backends;
}
+
+Slapi_DN *
+memberof_config_get_entry_scope()
+{
+ Slapi_DN *entry_scope;
+
+ slapi_rwlock_rdlock(memberof_config_lock);
+ entry_scope = theConfig.entryScope;
+ slapi_rwlock_unlock(memberof_config_lock);
+
+ return entry_scope;
+}
More information about the 389-commits
mailing list