From 5817d4a0f971a8d5740bbb32fce1b26d7578d4b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Tue, 29 Oct 2013 15:20:10 +0100 Subject: [PATCH 2/2] sdap_save_group: try to determine domain by SID GC contains objects from both parent domain and subdomain. Lets say we have group with UID 5000 that belongs to a subdomain and overlapping search bases dc=ad,dc=pb and dc=sub,dc=ad,dc=pb. Now we call 'getent group 5000' and this request goes through data provider, searching in parent domain first. Even though this group does not belong to this domain it is found and stored as ad.pb group. With this patch we look at group's SID and put it into correct domain. --- src/providers/ldap/sdap_async_groups.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c index 4abd3b71ca20417df6ac289fdd584d771ec4b610..7a8f3e2a5c83c5b320497a76c363a90620315dcf 100644 --- a/src/providers/ldap/sdap_async_groups.c +++ b/src/providers/ldap/sdap_async_groups.c @@ -464,13 +464,6 @@ static int sdap_save_group(TALLOC_CTX *memctx, goto done; } - ret = sdap_get_group_primary_name(tmpctx, opts, attrs, dom, &group_name); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, ("Failed to get group name\n")); - goto done; - } - DEBUG(SSSDBG_TRACE_FUNC, ("Processing group %s\n", group_name)); - /* Always store SID string if available */ ret = sdap_attrs_get_sid_str(tmpctx, opts->idmap_ctx, attrs, opts->group_map[SDAP_AT_GROUP_OBJECTSID].sys_name, @@ -492,6 +485,24 @@ static int sdap_save_group(TALLOC_CTX *memctx, sid_str = NULL; } + /* If this object has a SID available, we will determine the correct + * domain by its SID. */ + if (sid_str != NULL) { + dom = find_subdomain_by_sid(get_domains_head(dom), sid_str); + if (dom == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("SID %s does not belong to any known " + "domain\n", sid_str)); + return ERR_DOMAIN_NOT_FOUND; + } + } + + ret = sdap_get_group_primary_name(tmpctx, opts, attrs, dom, &group_name); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Failed to get group name\n")); + goto done; + } + DEBUG(SSSDBG_TRACE_FUNC, ("Processing group %s\n", group_name)); + use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(opts->idmap_ctx, dom->name, sid_str); -- 1.7.11.7