>From db78f427bcde3982984d1143ade342f48226a59d Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 31 Jul 2013 10:59:43 +0200 Subject: [PATCH 3/5] LDAP: Make it possible to extend an attribute map MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce Reviewed-by: Pavel Březina --- src/config/SSSDConfig/__init__.py.in | 1 + src/config/etc/sssd.api.d/sssd-ldap.conf | 1 + src/man/sssd-ldap.5.xml | 48 +++++++++++ src/providers/ad/ad_common.c | 9 ++ src/providers/ad/ad_opts.h | 1 + src/providers/ipa/ipa_common.c | 9 ++ src/providers/ipa/ipa_netgroups.c | 3 +- src/providers/ipa/ipa_opts.h | 1 + src/providers/ldap/ldap_common.c | 45 ++++++++++ src/providers/ldap/ldap_id.c | 3 +- src/providers/ldap/ldap_opts.h | 1 + src/providers/ldap/sdap.c | 116 ++++++++++++++++++++++++++ src/providers/ldap/sdap.h | 9 ++ src/providers/ldap/sdap_async_enum.c | 3 +- src/providers/ldap/sdap_async_groups.c | 6 +- src/providers/ldap/sdap_async_groups_ad.c | 4 +- src/providers/ldap/sdap_async_initgroups.c | 6 +- src/providers/ldap/sdap_async_nested_groups.c | 5 +- src/providers/ldap/sdap_async_users.c | 6 +- src/util/util_errors.c | 2 + src/util/util_errors.h | 2 + 21 files changed, 266 insertions(+), 15 deletions(-) diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in index 7029f5bc18dbaa1426d1baa48a7b035eac984340..de0348b1de0f2f4a8e91a6567300440d25eec8d6 100644 --- a/src/config/SSSDConfig/__init__.py.in +++ b/src/config/SSSDConfig/__init__.py.in @@ -272,6 +272,7 @@ option_strings = { 'ldap_user_nds_login_expiration_time' : _('loginExpirationTime attribute of NDS'), 'ldap_user_nds_login_allowed_time_map' : _('loginAllowedTimeMap attribute of NDS'), 'ldap_user_ssh_public_key' : _('SSH public key attribute'), + 'ldap_user_extra_attrs' : _('A list of extra attributes to download along with the user entry'), 'ldap_group_search_base' : _('Base DN for group lookups'), # not used # 'ldap_group_search_scope' : _('Scope of group lookups'), diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 91eeadf3e0dfbd763b91698adde84c96a66bddbf..af9dfa841654904692998e7283aa38026418174e 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -48,6 +48,7 @@ ldap_id_mapping = bool, None, false ldap_user_search_base = str, None, false ldap_user_search_scope = str, None, false ldap_user_search_filter = str, None, false +ldap_user_extra_attrs = str, None, false ldap_user_object_class = str, None, false ldap_user_name = str, None, false ldap_user_uid_number = str, None, false diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 06511d202de1c28319755a7d060e971a18cb87a5..6306b26199884f2f17c71eb93af10c96c6a704a7 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -616,6 +616,54 @@ + + ldap_user_extra_attrs (string) + + + Comma-separated list of LDAP attributes that SSSD + would fetch along with the usual set of user + attributes. + + + The list can either contain LDAP attribute names + only, or colon-separated tuples of SSSD cache + attribute name and LDAP attribute name. In + case only LDAP attribute name is specified, + the attribute is saved to the cache verbatim. + Using a custom SSSD attribute name might be + required by environments that configure several + SSSD domains with different LDAP schemas. + + + Please note that several attribute names are + reserved by SSSD, notably the name + attribute. SSSD would report an error if any of + the reserved attribute names is used as an extra + attribute name. + + + Examples: + + + ldap_user_extra_attrs = telephoneNumber + + + Save the telephoneNumber attribute from LDAP + as telephoneNumber to the cache. + + + ldap_user_extra_attrs = phone:telephoneNumber + + + Save the telephoneNumber attribute from LDAP + as phone to the cache. + + + Default: not set + + + + ldap_user_ssh_public_key (string) diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c index f5b01def208129c26339bd2d6a48e08ffac3fd47..af738bc82ba016759dd9a951a4b7b1832b61489d 100644 --- a/src/providers/ad/ad_common.c +++ b/src/providers/ad/ad_common.c @@ -201,6 +201,15 @@ ad_create_sdap_options(TALLOC_CTX *mem_ctx, goto done; } + ret = sdap_extend_map(id_opts, + id_opts->user_map, + SDAP_OPTS_USER, NULL, + &id_opts->user_map, + &id_opts->user_map_cnt); + if (ret != EOK) { + goto done; + } + /* Group map */ ret = sdap_get_map(id_opts, cdb, conf_path, diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index 2657f728eb89c178439d5a8568e20cc0e71c69e8..feb7ba124fbcb5e2f506d157c0efba2722aa24ea 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -54,6 +54,7 @@ struct dp_option ad_def_ldap_opts[] = { { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_user_extra_attrs", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c index f84748267d65bedbadf39db3466d28502bfa0e3e..19de10d8bb92a4b3d0c8353eae128f3b4709a7af 100644 --- a/src/providers/ipa/ipa_common.c +++ b/src/providers/ipa/ipa_common.c @@ -547,6 +547,15 @@ int ipa_get_id_options(struct ipa_options *ipa_opts, goto done; } + ret = sdap_extend_map(ipa_opts->id, + ipa_opts->id->user_map, + SDAP_OPTS_USER, NULL, + &ipa_opts->id->user_map, + &ipa_opts->id->user_map_cnt); + if (ret != EOK) { + goto done; + } + ret = sdap_get_map(ipa_opts->id, cdb, conf_path, ipa_group_map, diff --git a/src/providers/ipa/ipa_netgroups.c b/src/providers/ipa/ipa_netgroups.c index 9be8eae00c824e97118bf0d764ea21b199aadba0..89bb098dc7978edab51b2a0fe6d5d4657de7df82 100644 --- a/src/providers/ipa/ipa_netgroups.c +++ b/src/providers/ipa/ipa_netgroups.c @@ -493,7 +493,8 @@ static int ipa_netgr_fetch_users(struct ipa_get_netgroups_state *state, SDAP_USER_SEARCH_BASE), LDAP_SCOPE_SUBTREE, filter, attrs, state->opts->user_map, - SDAP_OPTS_USER, state->timeout, true); + state->opts->user_map_cnt, + state->timeout, true); state->current_entity = ENTITY_USER; if (subreq == NULL) { diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h index 71bcfb2b2192de0ce4f933b4aecc8e5efde519b3..2b97044b405fa2d7a93c2b33cb04271e0f2dc98b 100644 --- a/src/providers/ipa/ipa_opts.h +++ b/src/providers/ipa/ipa_opts.h @@ -77,6 +77,7 @@ struct dp_option ipa_def_ldap_opts[] = { { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_user_extra_attrs", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 59487dec1ceaa21e18b55373575e4133248aa1ff..49468bf4bb8a0d5cecda9b8eca886293583ef8a9 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -215,6 +215,44 @@ sdap_domain_remove(struct sdap_options *opts, DLIST_REMOVE(*(sdom->head), sdom); } +static int sdap_extend_map_with_list(TALLOC_CTX *mem_ctx, + struct sdap_options *opts, + int extra_attr_index, + struct sdap_attr_map *src_map, + size_t num_entries, + struct sdap_attr_map **_map, + size_t *_new_size) +{ + const char *extra_attrs; + char **extra_attrs_list; + errno_t ret; + + extra_attrs = dp_opt_get_string(opts->basic, extra_attr_index); + if (extra_attrs == NULL) { + *_map = src_map; + *_new_size = num_entries; + return EOK; + } + + /* split server parm into a list */ + ret = split_on_separator(mem_ctx, extra_attrs, ',', true, true, + &extra_attrs_list, NULL); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "Failed to parse server list!\n"); + return ret; + } + + ret = sdap_extend_map(mem_ctx, src_map, + num_entries, extra_attrs_list, + _map, _new_size); + talloc_free(extra_attrs_list); + if (ret != EOK) { + return ret; + } + + return EOK; +} + int ldap_get_options(TALLOC_CTX *memctx, struct sss_domain_info *dom, struct confdb_ctx *cdb, @@ -449,6 +487,13 @@ int ldap_get_options(TALLOC_CTX *memctx, goto done; } + ret = sdap_extend_map_with_list(opts, opts, SDAP_USER_EXTRA_ATTRS, + opts->user_map, SDAP_OPTS_USER, + &opts->user_map, &opts->user_map_cnt); + if (ret != EOK) { + goto done; + } + ret = sdap_get_map(opts, cdb, conf_path, default_group_map, SDAP_OPTS_GROUP, diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index 9dd682de277a4e92b883e06011751b93d32c3525..2d1ba5b5ac6c5b9d7306985ed56dc1d512a82b96 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -216,7 +216,8 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx, } /* TODO: handle attrs_type */ - ret = build_attrs_from_map(state, ctx->opts->user_map, SDAP_OPTS_USER, + ret = build_attrs_from_map(state, ctx->opts->user_map, + ctx->opts->user_map_cnt, NULL, &state->attrs, NULL); if (ret != EOK) goto fail; diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h index 5552c22cfed17a1cb07c8c6b77f1c501bc7273a3..3da5274746741c9ee3e975958555028d056729c9 100644 --- a/src/providers/ldap/ldap_opts.h +++ b/src/providers/ldap/ldap_opts.h @@ -43,6 +43,7 @@ struct dp_option default_basic_opts[] = { { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "ldap_user_extra_attrs", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING }, { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING }, diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c index b303547a4524f5dc90eaf16dc6ca0e579a8240ae..37a187436a6e17e9e41f981970b9c5ab5e685f46 100644 --- a/src/providers/ldap/sdap.c +++ b/src/providers/ldap/sdap.c @@ -71,6 +71,122 @@ int sdap_copy_map(TALLOC_CTX *memctx, return EOK; } +static errno_t split_extra_attr(TALLOC_CTX *mem_ctx, + char *conf_attr, + char **_sysdb_attr, + char **_ldap_attr) +{ + char *ldap_attr; + char *sysdb_attr; + char *sep; + + ldap_attr = conf_attr; + + sep = strchr(conf_attr, ':'); + if (sep == NULL) { + sysdb_attr = talloc_strdup(mem_ctx, conf_attr); + ldap_attr = talloc_strdup(mem_ctx, conf_attr); + } else { + if (sep == conf_attr || *(sep + 1) == '\0') { + return ERR_INVALID_EXTRA_ATTR; + } + + sysdb_attr = talloc_strndup(mem_ctx, ldap_attr, + sep - ldap_attr); + ldap_attr = talloc_strdup(mem_ctx, sep+1); + } + + if (sysdb_attr == NULL || ldap_attr == NULL) { + return ENOMEM; + } + + *_sysdb_attr = sysdb_attr; + *_ldap_attr = ldap_attr; + return EOK; +} + +static bool is_sysdb_duplicate(struct sdap_attr_map *map, + int num_entries, + const char *sysdb_attr) +{ + int i; + + for (i = 0; i < num_entries; i++) { + if (strcmp(map[i].sys_name, sysdb_attr) == 0) { + return true; + } + } + + return false; +} + +int sdap_extend_map(TALLOC_CTX *memctx, + struct sdap_attr_map *src_map, + size_t num_entries, + char **extra_attrs, + struct sdap_attr_map **_map, + size_t *_new_size) +{ + struct sdap_attr_map *map; + size_t nextra = 0; + size_t i; + char *ldap_attr; + char *sysdb_attr; + errno_t ret; + + if (extra_attrs == NULL) { + DEBUG(SSSDBG_FUNC_DATA, "No extra attributes\n"); + *_map = src_map; + *_new_size = num_entries; + return EOK; + } + + for (nextra = 0; extra_attrs[nextra]; nextra++) ; + DEBUG(SSSDBG_FUNC_DATA, "%zu extra attributes\n", nextra); + + map = talloc_realloc(memctx, src_map, struct sdap_attr_map, + num_entries + nextra + 1); + if (map == NULL) { + return ENOMEM; + } + + for (i = 0; extra_attrs[i]; i++) { + ret = split_extra_attr(map, extra_attrs[i], &sysdb_attr, &ldap_attr); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, "Cannot split %s\n", extra_attrs[i]); + continue; + } + + if (is_sysdb_duplicate(map, num_entries, sysdb_attr)) { + DEBUG(SSSDBG_FATAL_FAILURE, + "Attribute %s (%s in LDAP) is already used by SSSD, please " + "choose a different cache name\n", sysdb_attr, ldap_attr); + return ERR_DUP_EXTRA_ATTR; + } + + map[num_entries+i].name = ldap_attr; + map[num_entries+i].sys_name = sysdb_attr; + map[num_entries+i].opt_name = talloc_strdup(map, + map[num_entries+i].name); + map[num_entries+i].def_name = talloc_strdup(map, + map[num_entries+i].name); + if (map[num_entries+i].opt_name == NULL || + map[num_entries+i].sys_name == NULL || + map[num_entries+i].name == NULL || + map[num_entries+i].def_name == NULL) { + return ENOMEM; + } + DEBUG(SSSDBG_TRACE_FUNC, "Extending map with %s\n", extra_attrs[i]); + } + + /* Sentinel */ + memset(&map[num_entries+nextra], 0, sizeof(struct sdap_attr_map)); + + *_map = map; + *_new_size = num_entries + nextra; + return EOK; +} + int sdap_get_map(TALLOC_CTX *memctx, struct confdb_ctx *cdb, const char *conf_path, diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 460f400563b81a522e078d758a7dfc5b02ec5c96..7f8911744a8a9877ef2e48c66f36505c949349c5 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -159,6 +159,7 @@ enum sdap_basic_opt { SDAP_USER_SEARCH_BASE, SDAP_USER_SEARCH_SCOPE, SDAP_USER_SEARCH_FILTER, + SDAP_USER_EXTRA_ATTRS, SDAP_GROUP_SEARCH_BASE, SDAP_GROUP_SEARCH_SCOPE, SDAP_GROUP_SEARCH_FILTER, @@ -412,6 +413,7 @@ struct sdap_options { struct dp_option *basic; struct sdap_attr_map *gen_map; struct sdap_attr_map *user_map; + size_t user_map_cnt; struct sdap_attr_map *group_map; struct sdap_attr_map *netgroup_map; struct sdap_attr_map *service_map; @@ -467,6 +469,13 @@ int sdap_copy_map(TALLOC_CTX *memctx, int num_entries, struct sdap_attr_map **_map); +int sdap_extend_map(TALLOC_CTX *memctx, + struct sdap_attr_map *src_map, + size_t num_entries, + char **extra_attrs, + struct sdap_attr_map **_map, + size_t *_new_size); + int sdap_get_map(TALLOC_CTX *memctx, struct confdb_ctx *cdb, const char *conf_path, diff --git a/src/providers/ldap/sdap_async_enum.c b/src/providers/ldap/sdap_async_enum.c index 73169052ebb4b9f5be6cf873618fbb8c28505757..16ba953bbf8d6f5755bc0689d0e6542526c0e1dd 100644 --- a/src/providers/ldap/sdap_async_enum.c +++ b/src/providers/ldap/sdap_async_enum.c @@ -617,7 +617,8 @@ static struct tevent_req *enum_users_send(TALLOC_CTX *memctx, } /* TODO: handle attrs_type */ - ret = build_attrs_from_map(state, ctx->opts->user_map, SDAP_OPTS_USER, + ret = build_attrs_from_map(state, ctx->opts->user_map, + ctx->opts->user_map_cnt, NULL, &state->attrs, NULL); if (ret != EOK) goto fail; diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c index d40c1eaa198ff49106f149ffa2a016a695e7816a..2f568c472cc1eab10c69794cd12c10faf53ed8b1 100644 --- a/src/providers/ldap/sdap_async_groups.c +++ b/src/providers/ldap/sdap_async_groups.c @@ -1057,7 +1057,7 @@ struct tevent_req *sdap_process_group_send(TALLOC_CTX *memctx, struct sdap_process_group_state); if (!req) return NULL; - ret = build_attrs_from_map(grp_state, opts->user_map, SDAP_OPTS_USER, + ret = build_attrs_from_map(grp_state, opts->user_map, opts->user_map_cnt, NULL, &attrs, NULL); if (ret) { goto done; @@ -1207,7 +1207,7 @@ sdap_process_missing_member_2307bis(struct tevent_req *req, grp_state->filter, grp_state->attrs, grp_state->opts->user_map, - SDAP_OPTS_USER, + grp_state->opts->user_map_cnt, dp_opt_get_int(grp_state->opts->basic, SDAP_SEARCH_TIMEOUT), false); @@ -1528,7 +1528,7 @@ next: state->filter, state->attrs, state->opts->user_map, - SDAP_OPTS_USER, + state->opts->user_map_cnt, dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT), false); diff --git a/src/providers/ldap/sdap_async_groups_ad.c b/src/providers/ldap/sdap_async_groups_ad.c index 9bb21d29bdde4bb9402d8b49f69b184969c94550..8db587c96d569fc691486b252ff8f2c7d96e29c2 100644 --- a/src/providers/ldap/sdap_async_groups_ad.c +++ b/src/providers/ldap/sdap_async_groups_ad.c @@ -72,7 +72,7 @@ sdap_get_ad_match_rule_members_send(TALLOC_CTX *mem_ctx, state->search_bases = opts->sdom->user_search_bases; /* Request all of the user attributes that we know about. */ - ret = build_attrs_from_map(state, opts->user_map, SDAP_OPTS_USER, + ret = build_attrs_from_map(state, opts->user_map, opts->user_map_cnt, NULL, &state->attrs, NULL); if (ret != EOK) { DEBUG(SSSDBG_MINOR_FAILURE, @@ -157,7 +157,7 @@ sdap_get_ad_match_rule_members_next_base(struct tevent_req *req) state->search_bases[state->base_iter]->basedn, state->search_bases[state->base_iter]->scope, state->filter, state->attrs, - state->opts->user_map, SDAP_OPTS_USER, + state->opts->user_map, state->opts->user_map_cnt, state->timeout, true); if (!subreq) { return ENOMEM; diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c index b1dd2f514e52ca6263a32ea8f85f30a5c7d81a9f..712811f83210bbde55760b13b959d7167e6e3e5c 100644 --- a/src/providers/ldap/sdap_async_initgroups.c +++ b/src/providers/ldap/sdap_async_initgroups.c @@ -2705,7 +2705,9 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx, return NULL; } - ret = build_attrs_from_map(state, state->opts->user_map, SDAP_OPTS_USER, + ret = build_attrs_from_map(state, + state->opts->user_map, + state->opts->user_map_cnt, NULL, &state->user_attrs, NULL); if (ret) { talloc_zfree(req); @@ -2753,7 +2755,7 @@ static errno_t sdap_get_initgr_next_base(struct tevent_req *req) state->user_search_bases[state->user_base_iter]->basedn, state->user_search_bases[state->user_base_iter]->scope, state->filter, state->user_attrs, - state->opts->user_map, SDAP_OPTS_USER, + state->opts->user_map, state->opts->user_map_cnt, state->timeout, false); if (!subreq) { diff --git a/src/providers/ldap/sdap_async_nested_groups.c b/src/providers/ldap/sdap_async_nested_groups.c index 8095eb6d5b517dbafd64dd5c93a92ad652bbabc0..3dc2a9fd3c3759be0958b55de78284634bf3e8c0 100644 --- a/src/providers/ldap/sdap_async_nested_groups.c +++ b/src/providers/ldap/sdap_async_nested_groups.c @@ -1586,7 +1586,8 @@ sdap_nested_group_lookup_user_send(TALLOC_CTX *mem_ctx, /* search */ subreq = sdap_get_generic_send(state, ev, group_ctx->opts, group_ctx->sh, member->dn, LDAP_SCOPE_BASE, filter, attrs, - group_ctx->opts->user_map, SDAP_OPTS_USER, + group_ctx->opts->user_map, + group_ctx->opts->user_map_cnt, dp_opt_get_int(group_ctx->opts->basic, SDAP_SEARCH_TIMEOUT), false); @@ -2028,7 +2029,7 @@ sdap_nested_group_deref_send(TALLOC_CTX *mem_ctx, } maps[0].map = opts->user_map; - maps[0].num_attrs = SDAP_OPTS_USER; + maps[0].num_attrs = opts->user_map_cnt; maps[1].map = opts->group_map; maps[1].num_attrs = SDAP_OPTS_GROUP; diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c index ea9e858d9722c89fd0041968aacebeac423ad5df..1ef082ed0873a9685c462da8757cc3622873b373 100644 --- a/src/providers/ldap/sdap_async_users.c +++ b/src/providers/ldap/sdap_async_users.c @@ -431,7 +431,7 @@ int sdap_save_user(TALLOC_CTX *memctx, } } - for (i = SDAP_FIRST_EXTRA_USER_AT; i < SDAP_OPTS_USER; i++) { + for (i = SDAP_FIRST_EXTRA_USER_AT; i < opts->user_map_cnt; i++) { ret = sdap_attrs_add_list(attrs, opts->user_map[i].sys_name, NULL, user_name, user_attrs); if (ret) { @@ -459,7 +459,7 @@ int sdap_save_user(TALLOC_CTX *memctx, /* Make sure that any attributes we requested from LDAP that we * did not receive are also removed from the sysdb */ - ret = list_missing_attrs(user_attrs, opts->user_map, SDAP_OPTS_USER, + ret = list_missing_attrs(user_attrs, opts->user_map, opts->user_map_cnt, attrs, &missing); if (ret != EOK) { goto done; @@ -679,7 +679,7 @@ static errno_t sdap_search_user_next_base(struct tevent_req *req) state->search_bases[state->base_iter]->basedn, state->search_bases[state->base_iter]->scope, state->filter, state->attrs, - state->opts->user_map, SDAP_OPTS_USER, + state->opts->user_map, state->opts->user_map_cnt, state->timeout, state->enumeration); /* If we're enumerating, we need paging */ if (subreq == NULL) { diff --git a/src/util/util_errors.c b/src/util/util_errors.c index 8dd4380b423ef75cd246933ec739e232094e9b37..d27d20b0a511cfd9090707c62064c7d11ebc68cc 100644 --- a/src/util/util_errors.c +++ b/src/util/util_errors.c @@ -54,6 +54,8 @@ struct err_string error_to_str[] = { { "Missing configuration file" }, /* ERR_MISSING_CONF */ { "Malformed search filter" }, /* ERR_INVALID_FILTER, */ { "No POSIX attributes detected" }, /* ERR_NO_POSIX */ + { "Extra attribute is a duplicate" }, /* ERR_DUP_EXTRA_ATTR */ + { "Malformed extra attribute" }, /* ERR_INVALID_EXTRA_ATTR */ }; diff --git a/src/util/util_errors.h b/src/util/util_errors.h index 23048990da1e101397ae6bc9d5957133c1ea65af..f03fc16b1444d7e1370c22044b248585f076f32a 100644 --- a/src/util/util_errors.h +++ b/src/util/util_errors.h @@ -76,6 +76,8 @@ enum sssd_errors { ERR_MISSING_CONF, ERR_INVALID_FILTER, ERR_NO_POSIX, + ERR_DUP_EXTRA_ATTR, + ERR_INVALID_EXTRA_ATTR, ERR_LAST /* ALWAYS LAST */ }; -- 1.9.0