URL: https://github.com/SSSD/sssd/pull/475 Author: jhrozek Title: #475: LDAP: Only add a sdap_domain instance for the current domain when instantiating a new ad_id_ctx Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/475/head:pr475 git checkout pr475
From b0f7243053b098eb24ee6f6738e3aa8c0ca3ac8a Mon Sep 17 00:00:00 2001 From: Jakub Hrozek <[email protected]> Date: Wed, 17 Jan 2018 21:59:24 +0100 Subject: [PATCH] AD: Use the right sdap_domain for the forest root Resolves: https://pagure.io/SSSD/sssd/issue/3594 Each ad_id_ctx structure which represents a trusted AD domain contains a list of sdap_domain structures representing all the other domains. This is used to e.g. be able to reach another domain's ad_id_ctx and use its LDAP connection. However, the sdap search call that was searching for trusted domains in the forest that the root domain knows about, was unconditionally using the first sdap_domain structure in the list linked from the root_domain's ad_id_ctx structure. It should be noted that this search only happens in case the machine is joined to one of the non-root domains in the forest and searches the root domain explicitly. In case sdap_domain structures linked from the ad_id_ctx representing the root domain were ordered so that the first sdap_domain in the list was representing a different domain than the one linked from the ad_id_ctx, the sdap search would have used a wrong search base derived from the unexpected sdap_domain which would result in a referral being returned. This patch explicitly looks up the sdap_domain structure that corresponds to the root domain. --- src/providers/ad/ad_subdomains.c | 80 +++++++++++++++++++++++----------------- 1 file changed, 47 insertions(+), 33 deletions(-) diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c index 3fb9b950f..a111d40b6 100644 --- a/src/providers/ad/ad_subdomains.c +++ b/src/providers/ad/ad_subdomains.c @@ -57,6 +57,38 @@ /* do not refresh more often than every 5 seconds for now */ #define AD_SUBDOMAIN_REFRESH_LIMIT 5 +static struct sss_domain_info * +ads_get_root_domain(struct be_ctx *be_ctx, struct sysdb_attrs *attrs) +{ + struct sss_domain_info *dom; + const char *name; + errno_t ret; + + ret = sysdb_attrs_get_string(attrs, AD_AT_TRUST_PARTNER, &name); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n"); + return NULL; + } + + /* With a subsequent run, the root should already be known */ + for (dom = be_ctx->domain; dom != NULL; + dom = get_next_domain(dom, SSS_GND_ALL_DOMAINS)) { + + if (strcasecmp(dom->name, name) == 0) { + /* The forest root is special, although it might be disabled for + * general lookups we still want to try to get the domains in the + * forest from a DC of the forest root */ + if (sss_domain_get_state(dom) == DOM_DISABLED + && !sss_domain_is_forest_root(dom)) { + return NULL; + } + return dom; + } + } + + return NULL; +} + static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx, struct ad_id_ctx *ad_id_ctx, const char *ad_domain, @@ -826,6 +858,8 @@ static errno_t ad_get_slave_domain_retry(struct tevent_req *req) static void ad_get_slave_domain_connect_done(struct tevent_req *subreq) { + struct sss_domain_info *root_dom; + struct sdap_domain *root_sdom; struct ad_get_slave_domain_state *state; struct tevent_req *req = NULL; int dp_error; @@ -852,9 +886,21 @@ static void ad_get_slave_domain_connect_done(struct tevent_req *subreq) return; } + root_dom = ads_get_root_domain(state->be_ctx, state->root_attrs); + if (root_dom == NULL) { + tevent_req_error(req, ERR_DOMAIN_NOT_FOUND); + return; + } + + root_sdom = sdap_domain_get(state->opts, root_dom); + if (root_sdom == NULL) { + tevent_req_error(req, ERR_DOMAIN_NOT_FOUND); + return; + } + subreq = sdap_search_bases_send(state, state->ev, state->opts, sdap_id_op_handle(state->sdap_op), - state->opts->sdom->search_bases, + root_sdom->search_bases, NULL, false, 0, SLAVE_DOMAIN_FILTER, attrs); if (subreq == NULL) { @@ -958,38 +1004,6 @@ static errno_t ad_get_slave_domain_recv(struct tevent_req *req) return EOK; } -static struct sss_domain_info * -ads_get_root_domain(struct be_ctx *be_ctx, struct sysdb_attrs *attrs) -{ - struct sss_domain_info *dom; - const char *name; - errno_t ret; - - ret = sysdb_attrs_get_string(attrs, AD_AT_TRUST_PARTNER, &name); - if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n"); - return NULL; - } - - /* With a subsequent run, the root should already be known */ - for (dom = be_ctx->domain; dom != NULL; - dom = get_next_domain(dom, SSS_GND_ALL_DOMAINS)) { - - if (strcasecmp(dom->name, name) == 0) { - /* The forest root is special, although it might be disabled for - * general lookups we still want to try to get the domains in the - * forest from a DC of the forest root */ - if (sss_domain_get_state(dom) == DOM_DISABLED - && !sss_domain_is_forest_root(dom)) { - return NULL; - } - return dom; - } - } - - return NULL; -} - static struct ad_id_ctx * ads_get_root_id_ctx(struct be_ctx *be_ctx, struct ad_id_ctx *ad_id_ctx,
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
