>From c42ae154d0a94d84b662885aff33753059b0c45f Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 29 Nov 2013 11:39:09 +0100 Subject: [PATCH 2/3] AD: Add a new option to turn off GC lookups SSSD now defaults to using GC by default. For some environments, for instance those that don't or can't replicate the POSIX attributes to Global Catalog, this might not be desirable. This patch introduces a new option ad_enable_gc, that is enabled by default. Setting this option to false makes the SSSD contact only the LDAP port of AD DCs. --- src/config/etc/sssd.api.d/sssd-ad.conf | 1 + src/man/sssd-ad.5.xml | 17 +++++++++++++++++ src/providers/ad/ad_common.c | 31 ++++++++++++++++++------------- src/providers/ad/ad_common.h | 1 + src/providers/ad/ad_opts.h | 1 + src/tests/cmocka/test_ad_common.c | 20 ++++++++++++++++++++ 6 files changed, 58 insertions(+), 13 deletions(-) diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf index 9f606f6c4da65d4bfb20a97ee27801dac9307868..00e8968d2b6dab33a39005f11a497cb3e2185302 100644 --- a/src/config/etc/sssd.api.d/sssd-ad.conf +++ b/src/config/etc/sssd.api.d/sssd-ad.conf @@ -5,6 +5,7 @@ ad_backup_server = str, None, false ad_hostname = str, None, false ad_enable_dns_sites = bool, None, false ad_access_filter = str, None, false +ad_enable_gc = bool, None, false ldap_uri = str, None, false ldap_backup_uri = str, None, false ldap_search_base = str, None, false diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 0484af3e3b3e9927b280fd638dbb1c14a9060ac2..b763e42ed40954b64bc26c76f8ce601402f5cdfa 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -228,6 +228,23 @@ FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com) + ad_enable_gc (boolean) + + + By default, the SSSD connects to the Global + Catalog first to retrieve users and uses the + LDAP port to retrieve group memberships or + as a fallback. Disabling this option makes + the SSSD only connect to the LDAP port of the + current AD server. + + + Default: true + + + + + dyndns_update (boolean) diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c index af0ec839964233c7642205f4489e5b6462509848..a5ea4f587f30575a5903d8ae1a459f53512c011f 100644 --- a/src/providers/ad/ad_common.c +++ b/src/providers/ad/ad_common.c @@ -1125,26 +1125,31 @@ ad_gc_conn_list(TALLOC_CTX *mem_ctx, struct ad_id_ctx *ad_ctx, struct sss_domain_info *dom) { struct sdap_id_conn_ctx **clist; + int cindex = 0; clist = talloc_zero_array(mem_ctx, struct sdap_id_conn_ctx *, 3); if (clist == NULL) return NULL; /* Always try GC first */ - clist[0] = ad_ctx->gc_ctx; - if (IS_SUBDOMAIN(dom) == true) { - clist[0]->ignore_mark_offline = false; - /* Subdomain users are only present in GC. */ - return clist; + if (dp_opt_get_bool(ad_ctx->ad_options->basic, AD_ENABLE_GC)) { + clist[cindex] = ad_ctx->gc_ctx; + if (IS_SUBDOMAIN(dom) == true) { + clist[cindex]->ignore_mark_offline = false; + /* Subdomain users are only present in GC. */ + return clist; + } + /* fall back to ldap if gc is not available */ + clist[cindex]->ignore_mark_offline = true; + cindex++; } - /* fall back to ldap if gc is not available */ - clist[0]->ignore_mark_offline = true; - - /* With root domain users we have the option to - * fall back to LDAP in case ie POSIX attributes - * are used but not replicated to GC - */ - clist[1] = ad_ctx->ldap_ctx; + if (IS_SUBDOMAIN(dom) == false) { + /* With root domain users we have the option to + * fall back to LDAP in case ie POSIX attributes + * are used but not replicated to GC + */ + clist[cindex] = ad_ctx->ldap_ctx; + } return clist; } diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index ed5b8584dc5327a24e60985486c6155604271fd2..d370cef69124c127f41d7c4cbaa25713363e7752 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -42,6 +42,7 @@ enum ad_basic_opt { AD_KRB5_REALM, AD_ENABLE_DNS_SITES, AD_ACCESS_FILTER, + AD_ENABLE_GC, AD_OPTS_BASIC /* opts counter */ }; diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index 9055b4516c7e5834f0540f30c28f2accb3111e9f..42c7c1e9fbe6b1abe700b4a02e4510c0668deb3d 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -36,6 +36,7 @@ struct dp_option ad_basic_opts[] = { { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING}, { "ad_enable_dns_sites", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, { "ad_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING}, + { "ad_enable_gc", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, DP_OPTION_TERMINATOR }; diff --git a/src/tests/cmocka/test_ad_common.c b/src/tests/cmocka/test_ad_common.c index fe24d7cc8a02b798fd1e612a6eb5ede4bffa9e84..c7de8e9ca8e4662a5d05ec782916293c6660a645 100644 --- a/src/tests/cmocka/test_ad_common.c +++ b/src/tests/cmocka/test_ad_common.c @@ -159,6 +159,8 @@ void test_conn_list(void **state) struct ad_common_test_ctx); assert_non_null(test_ctx); + assert_true(dp_opt_get_bool(test_ctx->ad_ctx->ad_options->basic, + AD_ENABLE_GC)); conn_list = ad_gc_conn_list(test_ctx, test_ctx->ad_ctx, test_ctx->dom); assert_non_null(conn_list); @@ -177,6 +179,24 @@ void test_conn_list(void **state) assert_false(conn_list[0]->ignore_mark_offline); assert_true(conn_list[1] == NULL); talloc_free(conn_list); + + dp_opt_set_bool(test_ctx->ad_ctx->ad_options->basic, AD_ENABLE_GC, false); + assert_false(dp_opt_get_bool(test_ctx->ad_ctx->ad_options->basic, + AD_ENABLE_GC)); + + conn_list = ad_gc_conn_list(test_ctx, test_ctx->ad_ctx, test_ctx->dom); + assert_non_null(conn_list); + + assert_true(conn_list[0] == test_ctx->ad_ctx->ldap_ctx); + assert_false(conn_list[0]->ignore_mark_offline); + assert_true(conn_list[1] == NULL); + talloc_free(conn_list); + + conn_list = ad_gc_conn_list(test_ctx, test_ctx->ad_ctx, test_ctx->subdom); + assert_non_null(conn_list); + + assert_true(conn_list[0] == NULL); + talloc_free(conn_list); } int main(int argc, const char *argv[]) -- 1.8.4.2