caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose/*
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose SSSD
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose IPA Identity Backend Module for sub-domains - evaluate external group
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose memberships
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose Authors:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose Sumit Bose <sbose@redhat.com>
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose Copyright (C) 2013 Red Hat
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose This program is free software; you can redistribute it and/or modify
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose it under the terms of the GNU General Public License as published by
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose the Free Software Foundation; either version 3 of the License, or
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose (at your option) any later version.
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose This program is distributed in the hope that it will be useful,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose but WITHOUT ANY WARRANTY; without even the implied warranty of
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose GNU General Public License for more details.
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose You should have received a copy of the GNU General Public License
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose along with this program. If not, see <http://www.gnu.org/licenses/>.
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose*/
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "util/util.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "db/sysdb.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "providers/ldap/ldap_common.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "providers/ldap/sdap_async.h"
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek#include "providers/ldap/sdap_ops.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "providers/ipa/ipa_id.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "providers/ad/ad_id.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#include "providers/ipa/ipa_subdomains.h"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose#define IPA_EXT_GROUPS_FILTER "objectClass=ipaexternalgroup"
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestruct ipa_ext_groups {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose time_t next_update;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *ext_groups;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose};
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t process_ext_groups(TALLOC_CTX *mem_ctx, size_t reply_count,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sysdb_attrs **reply,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t **_ext_group_hash)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *ext_group_hash = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_key_t key;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_value_t value;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *m_hash = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_key_t m_key;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_value_t m_value;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t g;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t s;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t m;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose TALLOC_CTX *tmp_ctx = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char **ext_sids;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char **mof;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tmp_ctx = talloc_new(NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (tmp_ctx == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sss_hash_create(mem_ctx, reply_count, &ext_group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose key.type = HASH_KEY_STRING;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose m_key.type = HASH_KEY_STRING;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose m_value.type = HASH_VALUE_PTR;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose m_value.ptr = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (g = 0; g < reply_count; g++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sysdb_attrs_get_string_array(reply[g], "ipaExternalMember",
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tmp_ctx, &ext_sids);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == ENOENT) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* no external members, try next external group. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose continue;
401d8b0600dd2d36f6d62ee1d72f56a245cc3158Jakub Hrozek } else if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_OP_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "sysdb_attrs_get_string_array failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sysdb_attrs_get_string_array(reply[g], "memberOf",
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tmp_ctx, &mof);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == ENOENT) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* no IPA groups, try next external group. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose continue;
401d8b0600dd2d36f6d62ee1d72f56a245cc3158Jakub Hrozek } else if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_OP_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "sysdb_attrs_get_string_array failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (s = 0; ext_sids[s] != NULL; s++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* hash_lookup does not modify key.str. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose key.str = discard_const(ext_sids[s]);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_lookup(ext_group_hash, &key, &value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == HASH_SUCCESS) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (value.type != HASH_VALUE_PTR) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Unexpected value type.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EINVAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (m = 0; mof[m] != NULL; m++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* hash_enter does not modify m_key.str. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose m_key.str = discard_const(mof[m]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Adding group [%s] to SID [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov m_key.str, key.str);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_enter(value.ptr, &m_key, &m_value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else if (ret == HASH_ERROR_KEY_NOT_FOUND) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sss_hash_create(ext_group_hash, 5, &m_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose value.type = HASH_VALUE_PTR;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose value.ptr = m_hash;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_TRACE_ALL,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Adding SID [%s] to external group hash.\n", key.str);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_enter(ext_group_hash, &key, &value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (m = 0; mof[m] != NULL; m++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* hash_enter does not modify m_key.str. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose m_key.str = discard_const(mof[m]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Adding group [%s] to SID [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov m_key.str, key.str);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_enter(m_hash, &m_key, &m_value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "hash_lookup failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosedone:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_free(ext_group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *_ext_group_hash = ext_group_hash;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_free(tmp_ctx);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t find_ipa_ext_memberships(TALLOC_CTX *mem_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char *user_name,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *ext_group_hash,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn **_user_dn,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char ***_groups)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose TALLOC_CTX *tmp_ctx = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_result *result;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t c;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char *sid;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_key_t key;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_value_t value;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_entry_t *entry;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct hash_iter_context_t *iter;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *group_hash;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t g_count;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *user_dn = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tmp_ctx = talloc_new(NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (tmp_ctx == NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
b3292840ebaa747a9fd596ff47cc5d18198361d0Michal Zidek ret = sysdb_initgroups(tmp_ctx, user_dom, user_name, &result);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_initgroups failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (result->count == 0) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "User [%s] not found in cache.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov user_name);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sss_hash_create(tmp_ctx, 10, &group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose key.type = HASH_KEY_STRING;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* The IPA external domains can have references to group and user SIDs.
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose * This means that we not only want to look up the group SIDs but the SID
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose * of the user (first element of result) as well. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (c = 0; c < result->count; c++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose sid = ldb_msg_find_attr_as_string(result->msgs[c], SYSDB_SID_STR,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (sid == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Group [%s] does not have a SID.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ldb_dn_get_linearized(result->msgs[c]->dn));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose continue;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose key.str = discard_const(sid);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_lookup(ext_group_hash, &key, &value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == HASH_ERROR_KEY_NOT_FOUND) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "SID [%s] not found in ext group hash.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov sid);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else if (ret == HASH_SUCCESS) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose iter = new_hash_iter_context(value.ptr);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (iter == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "new_hash_iter_context failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EINVAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose while ((entry = iter->next(iter)) != NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = hash_enter(group_hash, &entry->key, &entry->value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != HASH_SUCCESS) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Failed to add group [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov entry->key.str);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_free(iter);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "hash_lookup failed for SID [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov sid);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose g_count = hash_count(group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (g_count == 0) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "No external groupmemberships found.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose groups = talloc_zero_array(mem_ctx, char *, g_count + 1);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (groups == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose iter = new_hash_iter_context(group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (iter == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "new_hash_iter_context failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EINVAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose c = 0;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose while ((entry = iter->next(iter)) != NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose groups[c] = talloc_strdup(groups, entry->key.str);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (groups[c] == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose c++;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose user_dn = ldb_dn_copy(mem_ctx, result->msgs[0]->dn);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (user_dn == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_copy failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosedone:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *_user_dn = user_dn;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *_groups = groups;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_free(tmp_ctx);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t add_ad_user_to_cached_groups(struct ldb_dn *user_dn,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *group_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose bool *missing_groups)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t c;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sysdb_attrs *user_attrs;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t msgs_count;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_message **msgs;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose TALLOC_CTX *tmp_ctx;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *missing_groups = false;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tmp_ctx = talloc_new(NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (tmp_ctx == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose for (c = 0; groups[c] != NULL; c++) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (groups[c][0] == '\0') {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose continue;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
59db26782d052ddbec633279d08e8627ca57fd41Fabiano Fidêncio ret = sysdb_search_groups_by_orig_dn(tmp_ctx, group_dom, groups[c],
59db26782d052ddbec633279d08e8627ca57fd41Fabiano Fidêncio NULL, &msgs_count, &msgs);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == ENOENT) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Group [%s] not in the cache.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groups[c]);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *missing_groups = true;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose continue;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_entry failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose/* TODO? Do we have to remove members as well? I think not because the AD
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose * query before removes all memberships. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_mod_group_member(group_dom, user_dn, msgs[0]->dn,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose LDB_FLAG_MOD_ADD);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK && ret != EEXIST) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_mod_group_member failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose user_attrs = sysdb_new_attrs(tmp_ctx);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (user_attrs == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_new_attrs failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose groups[c]);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_add_string failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sysdb_set_entry_attr(user_dom->sysdb, user_dn, user_attrs,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose LDB_FLAG_MOD_ADD);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK && ret != EEXIST) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_set_entry_attr failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* mark group as already processed */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose groups[c][0] = '\0';
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosedone:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_free(tmp_ctx);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic struct tevent_req *ipa_add_ad_memberships_send(TALLOC_CTX *mem_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_context *ev,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_ctx *sdap_id_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *user_dn,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *group_dom);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_done(struct tevent_req *subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestruct get_ad_membership_state {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_context *ev;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ipa_server_mode_ctx *server_mode;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_op *sdap_op;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_ctx *sdap_id_ctx;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct fo_server *srv;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char *user_name;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int dp_error;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char *domain;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t reply_count;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sysdb_attrs **reply;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose};
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_get_ad_memberships_connect_done(struct tevent_req *subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_get_ext_groups_done(struct tevent_req *subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t ipa_add_ext_groups_step(struct tevent_req *req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t ipa_add_ad_memberships_recv(struct tevent_req *req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int *dp_error_out);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestruct tevent_req *ipa_get_ad_memberships_send(TALLOC_CTX *mem_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_context *ev,
3d29430867cf92b2d71afa95abb679711231117cPavel Březina struct dp_id_data *ar,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ipa_server_mode_ctx *server_mode,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_ctx *sdap_id_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const char *domain)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *subreq;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose req = tevent_req_create(mem_ctx, &state, struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (req == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->ev = ev;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->user_dom = user_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx = sdap_id_ctx;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->srv = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->domain = domain;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = -1;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
63748c69a2c6785d949c82f94749704e0408e5a7Sumit Bose if (((ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_INITGROUPS
63748c69a2c6785d949c82f94749704e0408e5a7Sumit Bose && (ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_USER)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose || ar->filter_type != BE_FILTER_NAME) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Unsupported request type.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EINVAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->user_name = talloc_strdup(state, ar->filter_value);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->user_name == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_Strdup failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_op = sdap_id_op_create(state,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx->conn->conn_cache);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->sdap_op == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->server_mode = server_mode;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (server_mode->ext_groups == NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose server_mode->ext_groups = talloc_zero(server_mode,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ipa_ext_groups);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (server_mode->ext_groups == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_zero failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (server_mode->ext_groups->next_update > time(NULL)) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "External group information still valid.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ipa_add_ext_groups_step(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else if (ret == EAGAIN) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ext_groups_step failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect_send failed: %d(%s).\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_set_callback(subreq, ipa_get_ad_memberships_connect_done, req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosedone:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_FATAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_OK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_done(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_post(req, state->ev);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_get_ad_memberships_connect_done(struct tevent_req *subreq)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sdap_id_op_connect_recv(subreq, &state->dp_error);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_zfree(subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->dp_error == DP_ERR_OFFLINE) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_MINOR_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "No IPA server is available, going offline\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_OP_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Failed to connect to IPA server: [%d](%s)\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek subreq = sdap_search_bases_send(state, state->ev, state->sdap_id_ctx->opts,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek sdap_id_op_handle(state->sdap_op),
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek state->sdap_id_ctx->opts->sdom->group_search_bases,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek NULL, false,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek dp_opt_get_int(state->sdap_id_ctx->opts->basic,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek SDAP_ENUM_SEARCH_TIMEOUT),
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek IPA_EXT_GROUPS_FILTER,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_set_callback(subreq, ipa_get_ext_groups_done, req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosefail:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_get_ext_groups_done(struct tevent_req *subreq)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose hash_table_t *ext_group_hash;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek ret = sdap_search_bases_recv(subreq,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek state,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek &state->reply_count,
337dd8a87cd774ac20d15c16ec3d9a6c4d2defc7Jakub Hrozek &state->reply);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_zfree(subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ext_groups request failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "[%zu] external groups found.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->reply_count);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = process_ext_groups(state->server_mode->ext_groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->reply_count, state->reply, &ext_group_hash);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "process_ext_groups failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->server_mode->ext_groups->ext_groups = ext_group_hash;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose /* Do we have to make the update timeout configurable? */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->server_mode->ext_groups->next_update = time(NULL) + 10;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ipa_add_ext_groups_step(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret == EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_done(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else if (ret == EAGAIN) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ext_groups_step failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosefail:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t ipa_add_ext_groups_step(struct tevent_req *req)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *user_dn;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups = NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *subreq;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = find_ipa_ext_memberships(state, state->user_name, state->user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->server_mode->ext_groups->ext_groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose &user_dn, &groups);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "find_ipa_ext_memberships failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (groups == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "No external groups memberships found.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_OK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose subreq = ipa_add_ad_memberships_send(state, state->ev, state->sdap_id_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose user_dn, state->user_dom, groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx->be->domain);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ad_memberships_send failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_set_callback(subreq, ipa_add_ad_memberships_done, req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return EAGAIN;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosefail:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_done(struct tevent_req *subreq)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ipa_add_ad_memberships_recv(subreq, &state->dp_error);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_zfree(subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ad_memberships request failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_OK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_done(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Boseerrno_t ipa_get_ad_memberships_recv(struct tevent_req *req, int *dp_error_out)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct get_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose TEVENT_REQ_RETURN_ON_ERROR(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (dp_error_out) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *dp_error_out = state->dp_error;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestruct add_ad_membership_state {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_context *ev;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_ctx *sdap_id_ctx;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_op *sdap_op;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *user_dn;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *group_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int dp_error;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose size_t iter;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_domain *group_sdom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose};
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_connect_done(struct tevent_req *subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_get_next(struct tevent_req *req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_get_group_done(struct tevent_req *subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic struct tevent_req *ipa_add_ad_memberships_send(TALLOC_CTX *mem_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_context *ev,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sdap_id_ctx *sdap_id_ctx,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *user_dn,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose char **groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct sss_domain_info *group_dom)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *subreq;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state *state;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose bool missing_groups = false;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose req = tevent_req_create(mem_ctx, &state, struct add_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (req == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return NULL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->ev = ev;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->user_dom = user_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx = sdap_id_ctx;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->user_dn = user_dn;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->group_dom = group_dom;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->groups = groups;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = -1;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->iter = 0;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->group_sdom = sdap_domain_get(sdap_id_ctx->opts, group_dom);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->group_sdom == NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EIO;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = add_ad_user_to_cached_groups(user_dn, user_dom, group_dom, groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose &missing_groups);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "add_ad_user_to_cached_groups failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (!missing_groups) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "All groups found in cache.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_op = sdap_id_op_create(state,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx->conn->conn_cache);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->sdap_op == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect_send failed: %d(%s).\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto done;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_set_callback(subreq, ipa_add_ad_memberships_connect_done, req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosedone:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_FATAL;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->dp_error = DP_ERR_OK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_done(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_post(req, state->ev);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return req;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_connect_done(struct tevent_req *subreq)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = sdap_id_op_connect_recv(subreq, &state->dp_error);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_zfree(subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->dp_error == DP_ERR_OFFLINE) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_MINOR_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "No IPA server is available, going offline\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose } else {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose DEBUG(SSSDBG_OP_FAILURE,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Failed to connect to IPA server: [%d](%s)\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->iter = 0;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ipa_add_ad_memberships_get_next(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_get_next(struct tevent_req *req)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *subreq;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct ldb_dn *group_dn;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose const struct ldb_val *val;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose bool missing_groups;
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose const char *fq_name;
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose char *tmp_str;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose while (state->groups[state->iter] != NULL
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose && state->groups[state->iter][0] == '\0') {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->iter++;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (state->groups[state->iter] == NULL) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = add_ad_user_to_cached_groups(state->user_dn, state->user_dom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->group_dom, state->groups,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose &missing_groups);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "add_ad_user_to_cached_groups failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (missing_groups) {
b07a3b729892d2bc2ffa73d93de95e19003cc6c8Pavel Reichl DEBUG(SSSDBG_CRIT_FAILURE, "There are unresolved external group "
b07a3b729892d2bc2ffa73d93de95e19003cc6c8Pavel Reichl "memberships even after all groups "
b07a3b729892d2bc2ffa73d93de95e19003cc6c8Pavel Reichl "have been looked up on the LDAP "
b07a3b729892d2bc2ffa73d93de95e19003cc6c8Pavel Reichl "server.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_done(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose group_dn = ldb_dn_new(state, sysdb_ctx_get_ldb(state->group_dom->sysdb),
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->groups[state->iter]);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (group_dn == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_new failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik val = ldb_dn_get_rdn_val(group_dn);
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik if (val == NULL || val->data == NULL) {
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik DEBUG(SSSDBG_OP_FAILURE,
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik "Invalid group DN [%s].\n", state->groups[state->iter]);
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik ret = EINVAL;
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik goto fail;
22eead9590e11c7adab33ec5ab8b46d3c3cb4406Lukas Slebodnik }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose fq_name = (const char *) val->data;
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose if (strchr(fq_name, '@') == NULL) {
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose tmp_str = sss_create_internal_fqname(state, fq_name,
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose state->group_dom->name);
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose /* keep using val->data if sss_create_internal_fqname() fails */
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose if (tmp_str != NULL) {
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose fq_name = tmp_str;
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose }
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose }
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose/* TODO: here is would be useful for have a filter type like BE_FILTER_DN to
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose * directly fetch the group with the corresponding DN. */
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose subreq = groups_get_send(state, state->ev,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx, state->group_sdom,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->sdap_id_ctx->conn,
e3d447a682164d1f6490227af2df6864ee7d6e1dSumit Bose fq_name,
823d8292c4658b51821514adf21939e04b7423edLukas Slebodnik BE_FILTER_NAME,
d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose false, false);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "groups_get_send failed.\n");
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = ENOMEM;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose goto fail;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_set_callback(subreq, ipa_add_ad_memberships_get_group_done, req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosefail:
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic void ipa_add_ad_memberships_get_group_done(struct tevent_req *subreq)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct tevent_req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int ret;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ret = groups_get_recv(subreq, &state->dp_error, NULL);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose talloc_zfree(subreq);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Failed to read group [%s] from LDAP [%d](%s)\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->groups[state->iter], ret, strerror(ret));
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose tevent_req_error(req, ret);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose state->iter++;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose ipa_add_ad_memberships_get_next(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bosestatic errno_t ipa_add_ad_memberships_recv(struct tevent_req *req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose int *dp_error_out)
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose{
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state *state = tevent_req_data(req,
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose struct add_ad_membership_state);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose TEVENT_REQ_RETURN_ON_ERROR(req);
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose if (dp_error_out) {
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose *dp_error_out = state->dp_error;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose }
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose return EOK;
caee9828ee30609e9f433957dbb3d0163390a207Sumit Bose}
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstatic errno_t
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozeksearch_user_or_group_by_sid_str(TALLOC_CTX *mem_ctx,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sss_domain_info *domain,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek const char *sid_str,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek enum sysdb_member_type *_member_type,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ldb_message **_msg)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek{
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek errno_t ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ldb_message *msg = NULL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek const char *attrs[] = { SYSDB_NAME,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek SYSDB_SID_STR,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek SYSDB_ORIG_DN,
0e238c259c066cf997aaa940d33d6bda96c15925Sumit Bose SYSDB_OBJECTCATEGORY,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek SYSDB_CACHE_EXPIRE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek NULL };
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek TALLOC_CTX *tmp_ctx = NULL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek char *sanitized_sid = NULL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tmp_ctx = talloc_new(NULL);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (tmp_ctx == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return ENOMEM;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek /* In theory SID shouldn't contain any special LDAP characters, but let's
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek * be paranoid
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek */
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = sss_filter_sanitize(tmp_ctx, sid_str, &sanitized_sid);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto done;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = sysdb_search_user_by_sid_str(tmp_ctx, domain,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek sid_str, attrs, &msg);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret == EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_member_type = SYSDB_MEMBER_USER;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek } else if (ret == ENOENT) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = sysdb_search_group_by_sid_str(tmp_ctx, domain,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek sid_str, attrs, &msg);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret == EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_member_type = SYSDB_MEMBER_GROUP;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek switch (ret) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek case EOK:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Found %s in sysdb\n", sid_str);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_msg = talloc_steal(mem_ctx, msg);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek break;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek case ENOENT:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Could not find %s in sysdb", sid_str);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek break;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek default:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Error looking for %s in sysdb [%d]: %s\n",
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek sid_str, ret, sss_strerror(ret));
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek break;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekdone:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek talloc_free(tmp_ctx);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek}
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstatic errno_t
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekipa_ext_group_member_check(TALLOC_CTX *mem_ctx,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sss_domain_info *member_dom,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek const char *ext_member,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek enum sysdb_member_type *_member_type,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sysdb_attrs **_member)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek{
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek TALLOC_CTX *tmp_ctx = NULL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek errno_t ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek uint64_t expire;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek time_t now = time(NULL);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ldb_message *msg;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sysdb_attrs **members;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tmp_ctx = talloc_new(NULL);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (tmp_ctx == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return ENOMEM;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = search_user_or_group_by_sid_str(tmp_ctx, member_dom, ext_member,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek _member_type, &msg);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Error looking up sid %s: [%d]: %s\n",
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ext_member, ret, sss_strerror(ret));
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto done;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = sysdb_msg2attrs(tmp_ctx, 1, &msg, &members);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Could not convert result to sysdb_attrs [%d]: %s\n",
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret, sss_strerror(ret));
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto done;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek /* Return the member both expired and valid */
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_member = talloc_steal(mem_ctx, members[0]);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek expire = ldb_msg_find_attr_as_uint64(msg, SYSDB_CACHE_EXPIRE, 0);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (expire != 0 && expire <= now) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "%s is expired", ext_member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = EAGAIN;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto done;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekdone:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek talloc_free(tmp_ctx);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek}
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek/* For the IPA external member resolution, we expect a SID as the input.
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek * The _recv() function output is the member and a type (user/group)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek * since nothing else can be a group member.
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek */
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstruct ipa_ext_member_state {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek const char *ext_member;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sss_domain_info *dom;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek enum sysdb_member_type member_type;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sysdb_attrs *member;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek};
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstatic void ipa_ext_group_member_done(struct tevent_req *subreq);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstruct tevent_req *ipa_ext_group_member_send(TALLOC_CTX *mem_ctx,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_context *ev,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek const char *ext_member,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek void *pvt)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek{
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_id_ctx *ipa_ctx;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_ext_member_state *state;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_req *req;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_req *subreq;
3d29430867cf92b2d71afa95abb679711231117cPavel Březina struct dp_id_data *ar;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek errno_t ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek req = tevent_req_create(mem_ctx, &state, struct ipa_ext_member_state);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (req == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return NULL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->ext_member = ext_member;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ipa_ctx = talloc_get_type(pvt, struct ipa_id_ctx);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ipa_ctx == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "Wrong private context!\n");
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = EINVAL;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto immediate;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->dom = find_domain_by_sid(ipa_ctx->sdap_id_ctx->be->domain,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ext_member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (state->dom == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Cannot find domain of SID [%s]\n", ext_member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = ENOENT;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto immediate;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
b4456f3944e7d02f2976ac77f74aa379a7b06032Lukas Slebodnik ret = ipa_ext_group_member_check(state, state->dom, ext_member,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek &state->member_type, &state->member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret == EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "external member %s already cached\n", ext_member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto immediate;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
3d29430867cf92b2d71afa95abb679711231117cPavel Březina ret = get_dp_id_data_for_sid(state, ext_member, state->dom->name, &ar);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Cannot create the account request for [%s]\n", ext_member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto immediate;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina subreq = dp_req_send(state, ipa_ctx->sdap_id_ctx->be->provider, NULL,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina ar->domain, "External Member",
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina DPT_ID, DPM_ACCOUNT_HANDLER, 0, ar, NULL);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (subreq == NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = ENOMEM;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek goto immediate;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_set_callback(subreq, ipa_ext_group_member_done, req);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return req;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekimmediate:
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_error(req, ret);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek } else {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_done(req);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_post(req, ev);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return req;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek}
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekstatic void ipa_ext_group_member_done(struct tevent_req *subreq)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek{
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_req *req = tevent_req_callback_data(subreq,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_req);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_ext_member_state *state = tevent_req_data(req,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_ext_member_state);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek errno_t ret;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ldb_message *msg;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sysdb_attrs **members;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina struct dp_reply_std *reply;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina ret = dp_req_recv_ptr(state, subreq, struct dp_reply_std, &reply);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek talloc_free(subreq);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina DEBUG(SSSDBG_OP_FAILURE, "dp_req_recv failed\n");
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_error(req, ret);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return;
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina } else if (reply->dp_error != DP_ERR_OK) {
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina DEBUG(SSSDBG_MINOR_FAILURE,
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina "Cannot refresh data from DP: %u,%u: %s\n",
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina reply->dp_error, reply->error, reply->message);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina tevent_req_error(req, EIO);
dea636af4d1902a081ee891f1b19ee2f8729d759Pavel Březina return;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = search_user_or_group_by_sid_str(state,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->dom,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->ext_member,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek &state->member_type,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek &msg);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(ret == ENOENT ? SSSDBG_TRACE_FUNC : SSSDBG_OP_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Could not find %s in sysdb [%d]: %s\n",
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->ext_member, ret, sss_strerror(ret));
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_error(req, ret);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret = sysdb_msg2attrs(state, 1, &msg, &members);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (ret != EOK) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek "Could not convert result to sysdb_attrs [%d]: %s\n",
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek ret, sss_strerror(ret));
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_error(req, ret);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek state->member = members[0];
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek tevent_req_done(req);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek}
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozekerrno_t ipa_ext_group_member_recv(TALLOC_CTX *mem_ctx,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct tevent_req *req,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek enum sysdb_member_type *_member_type,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sss_domain_info **_dom,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct sysdb_attrs **_member)
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek{
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_ext_member_state *state = tevent_req_data(req,
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek struct ipa_ext_member_state);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek TEVENT_REQ_RETURN_ON_ERROR(req);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (_member_type != NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_member_type = state->member_type;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (_dom) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_dom = state->dom;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek if (_member != NULL) {
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek *_member = talloc_steal(mem_ctx, state->member);
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek }
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek return EOK;
e2d96566aeb881bd89e5c9236d663f6a9a88019aJakub Hrozek}