From 0d2b0c67875663d0e614b8361152ec7edc14c37e Mon Sep 17 00:00:00 2001
From: Petr Cech <pcech@redhat.com>
Date: Mon, 27 Jun 2016 11:51:30 +0200
Subject: [PATCH 4/5] AD_PROVIDER: ad_enabled_domains - other then master

We can skip looking up other domains if
option ad_enabled_domains doesn't contain them.

Resolves:
https://fedorahosted.org/sssd/ticket/2828
---
 src/providers/ad/ad_subdomains.c | 49 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 45 insertions(+), 4 deletions(-)

diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
index eaa85f802dbb4022dc632cc4c05d89685eccd901..32f7d7b3b2c4917d15d516c5e8beac159ffe164f 100644
--- a/src/providers/ad/ad_subdomains.c
+++ b/src/providers/ad/ad_subdomains.c
@@ -130,6 +130,23 @@ done:
     return ret;
 }
 
+static bool is_domain_enabled (const char *domain,
+                               const char **enabled_doms)
+{
+    bool ret;
+
+    if (enabled_doms == NULL) {
+        ret = true;
+        goto done;
+    }
+
+    ret = string_in_list(domain, discard_const_p(char *, enabled_doms), true) ?
+          true : false;
+
+done:
+    return ret;
+}
+
 static errno_t
 ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
                      struct ad_id_ctx *id_ctx,
@@ -485,6 +502,7 @@ done:
 
 static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
                                      struct sss_domain_info *domain,
+                                     const char **enabled_domains_list,
                                      size_t nsd, struct sysdb_attrs **sd,
                                      struct sysdb_attrs *root,
                                      size_t *_nsd_out,
@@ -493,9 +511,10 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
     size_t i, sdi;
     struct sysdb_attrs **sd_out;
     const char *sd_name;
+    const char *root_name;
     errno_t ret;
 
-    if (root == NULL) {
+    if (root == NULL && (enabled_domains_list == NULL)) {
         /* We are connected directly to the root domain. The 'sd'
          * list is complete and we can just use it
          */
@@ -522,6 +541,13 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
             goto fail;
         }
 
+        if (is_domain_enabled(sd_name, enabled_domains_list) == false) {
+            DEBUG(SSSDBG_TRACE_FUNC, "Disabling subdomain %s\n", sd_name);
+            continue;
+        } else {
+            DEBUG(SSSDBG_TRACE_FUNC, "Enabling subdomain %s\n", sd_name);
+        }
+
         if (strcasecmp(sd_name, domain->name) == 0) {
             DEBUG(SSSDBG_TRACE_INTERNAL,
                   "Not including primary domain %s in the subdomain list\n",
@@ -534,9 +560,23 @@ static errno_t ad_subdomains_process(TALLOC_CTX *mem_ctx,
     }
 
     /* Now include the root */
-    sd_out[sdi] = talloc_steal(sd_out, root);
+    if (root != NULL) {
+        ret = sysdb_attrs_get_string(root, AD_AT_TRUST_PARTNER, &root_name);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n");
+            goto fail;
+        }
 
-    *_nsd_out = sdi+1;
+        if (is_domain_enabled(root_name, enabled_domains_list) == true) {
+            sd_out[sdi] = talloc_steal(sd_out, root);
+            sdi++;
+        } else {
+            DEBUG(SSSDBG_TRACE_FUNC, "Disabling forest root domain %s\n",
+                                     root_name);
+        }
+    }
+
+    *_nsd_out = sdi;
     *_sd_out = sd_out;
     return EOK;
 
@@ -782,6 +822,7 @@ static void ad_get_slave_domain_done(struct tevent_req *subreq)
      * subdomains.
      */
     ret = ad_subdomains_process(state, state->be_ctx->domain,
+                                state->sd_ctx->ad_enabled_domains,
                                 reply_count, reply, state->root_attrs,
                                 &nsubdoms, &subdoms);
     if (ret != EOK) {
@@ -1440,7 +1481,7 @@ errno_t ad_subdomains_init(TALLOC_CTX *mem_ctx,
 {
     struct ad_subdomains_ctx *sd_ctx;
     const char *ad_domain;
-    char **ad_enabled_domains = NULL;
+    const char **ad_enabled_domains = NULL;
     time_t period;
     errno_t ret;
 
-- 
2.7.4

