[PATCHES][PRELIMINARY] Support for multiple LDAP search bases
by Stephen Gallagher
These patches add support for multiple search bases for users and groups
in non-enumeration mode. I want to get these out for review before I
start working on the enumeration support, so if there are major issues
they will be found before I put in a lot more work.
Some notes: There is no patch adding multiple search base support for
group lookups in RFC2307bis because it's meaningless right now. Since
the group memberships are direct DNs, we do all of our searches as base
searches, ignoring group_search_base. There is a separate ticket,
https://fedorahosted.org/sssd/ticket/960 that will need to address this,
taking advantage of the multiple search base features.
Also, while working through this, I opened
https://fedorahosted.org/sssd/ticket/1006 as I noticed that we are using
far too many separate transactions while processing RFC2307bis (which is
likely the cause of the extreme slowdown that some of our users were
reporting with AD).
Thank you, and please review promptly.
Patch 0001: Remove some unused options in a struct
Patch 0002: Fix size return for split_on_separator()
It was returning the size of the array, rather than the number of
elements. (The array was NULL-terminated). This argument was only
used in one place that was actually working around this odd return
value.
Patch 0003: Make sdap_get_id_specific_filter() more strict
Just makes it take const char * instead of char *.
Patch 0004: Add parser for multiple search bases
As discussed on the list, this will the ldap_*_search_base options in
the form of:
search_base[?scope?[filter][?search_base?scope?[filter]]*]
This is backwards-compatible (just use a search base)
Patch 0005: Add support for multiple search bases for users
Patch 0006: Add support for multiple search bases for netgroups
Patch 0007: Add support for multiple search bases for RFC2307 groups
Patch 0008: Add support for multiple search bases for initgroups (user
portion)
Patch 0009: Add support for multiple search bases for initgroups
(RFC2307 group portion)
Patch 0010: Add support for multiple search bases for initgroups
(RFC2307 group portion)
This patch I'm not 100% sure of. It may need more processing. With
RFC2307, it was safe to have duplicate groups in the list, because only
the group name is important (and we guarantee that the name list has
only unique values before saving it). With RFC2307bis, I'm not sure if
it's safe to add two groups that may have the same name. Comments
welcome.
Patch 0011: Temporary patch that just disallows the use of multiple
search bases when enumeration mode is turned on. We can drop this patch
when the enumeration support is available.
12 years, 6 months
[PATCH] improve handling of users with multiple names
by Jakub Hrozek
https://fedorahosted.org/sssd/ticket/926
These patches apply on master only so far. I'll rebase them when/if they
are acked -- 1.5 has diverged and I'd like to avoid doing the same work
twice.
[PATCH 1/4] Add sysdb interface to get name aliases
This function will be used later on.
[PATCH 2/4] Add a sysdb_get_direct_parents function
We'll need the same code later so I split it into a separate function.
[PATCH 3/4] Store name aliases for users, groups
Stores aliases in a new attribute when saving users and groups
Checks fake users for aliases when storing a real users so that
getgrnam for a RFC2307 group that references a user by his secondary
name followed by getpwnam for this user by his primary name works.
When generating fake RFC2307 users, checks if there is a real user with
an alias with the same value as memberuid attribute value to catch the
case when getpwnam user would be followed by getgrnam for a group that
references a user by his secondary name
[PATCH 4/4] Return users and groups based on alias
Tweaks the getpwnam/getgrnam filters so that we always the primary name
even if secondary name is requested.
12 years, 7 months
[PATCH] Unbreak ./configure
by Marko Myllynen
Hi,
./configure at least from 1.5.13 is failing on Ubuntu Oneiric.
The node ``Conditionals'' of automake manual states:
Note that you must arrange for _every_ `AM_CONDITIONAL' to be invoked
every time `configure' is run. If `AM_CONDITIONAL' is run conditionally
(e.g., in a shell `if' statement), then the result will confuse `automake'.
So the trick is to run AM_CONDITIONAL unconditionally.
Cheers,
--
Marko Myllynen
12 years, 7 months
[PATCH] Multiline macro cleanup
by Jakub Hrozek
This is mostly a cosmetic patch.
The purpose of wrapping a multi-line macro in a do { } while(0) is to
make the macro usable as a regular statement, not a compound statement.
When the while(0) is terminated with a semicolon, the do { } while(0);
block becomes a compound statement again.
12 years, 7 months
