1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include "util/util.h"

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#include "db/sysdb.h"

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include "providers/ldap/ldap_common.h"

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#include "providers/ldap/sdap_async.h"

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#include "providers/ipa/ipa_id.h"

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#include "providers/ad/ad_id.h"

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#include "providers/ipa/ipa_subdomains.h"

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#define IPA_EXT_GROUPS_FILTER "objectClass=ipaexternalgroup"

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostruct ipa_ext_groups {

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio time_t next_update;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_table_t *ext_groups;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce};

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic errno_t process_ext_groups(TALLOC_CTX *mem_ctx, size_t reply_count,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sysdb_attrs **reply,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_table_t **_ext_group_hash)

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_table_t *ext_group_hash = NULL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek hash_key_t key;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek hash_value_t value;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_table_t *m_hash = NULL;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_key_t m_key;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce hash_value_t m_value;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce size_t g;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce size_t s;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce size_t m;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek TALLOC_CTX *tmp_ctx = NULL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek const char **ext_sids;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek const char **mof;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce tmp_ctx = talloc_new(NULL);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (tmp_ctx == NULL) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ENOMEM;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = sss_hash_create(mem_ctx, reply_count, &ext_group_hash);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != HASH_SUCCESS) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce key.type = HASH_KEY_STRING;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek m_key.type = HASH_KEY_STRING;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek m_value.type = HASH_VALUE_PTR;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce m_value.ptr = NULL;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce for (g = 0; g < reply_count; g++) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sysdb_attrs_get_string_array(reply[g], "ipaExternalMember",

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce tmp_ctx, &ext_sids);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret == ENOENT) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce /* no external members, try next external group. */

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce continue;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else if (ret != EOK) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce "sysdb_attrs_get_string_array failed.\n");

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio goto done;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio }

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sysdb_attrs_get_string_array(reply[g], "memberOf",

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce tmp_ctx, &mof);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret == ENOENT) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce /* no IPA groups, try next external group. */

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce continue;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sysdb_attrs_get_string_array failed.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek for (s = 0; ext_sids[s] != NULL; s++) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek /* hash_lookup does not modify key.str. */

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek key.str = discard_const(ext_sids[s]);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = hash_lookup(ext_group_hash, &key, &value);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret == HASH_SUCCESS) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (value.type != HASH_VALUE_PTR) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "Unexpected value type.\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = EINVAL;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek for (m = 0; mof[m] != NULL; m++) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek /* hash_enter does not modify m_key.str. */

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek m_key.str = discard_const(mof[m]);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_TRACE_ALL, "Adding group [%s] to SID [%s].\n",

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce m_key.str, key.str);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = hash_enter(value.ptr, &m_key, &m_value);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret != HASH_SUCCESS) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else if (ret == HASH_ERROR_KEY_NOT_FOUND) {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio ret = sss_hash_create(ext_group_hash, 5, &m_hash);

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio if (ret != HASH_SUCCESS) {

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio goto done;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce value.type = HASH_VALUE_PTR;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce value.ptr = m_hash;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_TRACE_ALL,

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek "Adding SID [%s] to external group hash.\n", key.str);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = hash_enter(ext_group_hash, &key, &value);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != HASH_SUCCESS) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for (m = 0; mof[m] != NULL; m++) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* hash_enter does not modify m_key.str. */

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce m_key.str = discard_const(mof[m]);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_TRACE_ALL, "Adding group [%s] to SID [%s].\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce m_key.str, key.str);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = hash_enter(m_hash, &m_key, &m_value);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != HASH_SUCCESS) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "hash_lookup failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(ext_group_hash);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek *_ext_group_hash = ext_group_hash;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(tmp_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic errno_t find_ipa_ext_memberships(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *user_name,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sss_domain_info *user_dom,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio hash_table_t *ext_group_hash,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn **_user_dn,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char ***_groups)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_result *result;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **groups = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce size_t c;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const char *sid;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce hash_key_t key;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce hash_value_t value;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce hash_entry_t *entry;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct hash_iter_context_t *iter;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce hash_table_t *group_hash;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce size_t g_count;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn *user_dn = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tmp_ctx = talloc_new(NULL);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (tmp_ctx == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sysdb_initgroups(tmp_ctx, user_dom, user_name, &result);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sysdb_initgroups failed.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (result->count == 0) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_MINOR_FAILURE, "User [%s] not found in cache.\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user_name);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EOK;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = sss_hash_create(tmp_ctx, 10, &group_hash);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != HASH_SUCCESS) {

a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio }

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek key.type = HASH_KEY_STRING;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* The IPA external domains can have references to group and user SIDs.

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for (c = 0; c < result->count; c++) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce sid = ldb_msg_find_attr_as_string(result->msgs[c], SYSDB_SID_STR,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce NULL);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (sid == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_MINOR_FAILURE, "Group [%s] does not have a SID.\n",

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ldb_dn_get_linearized(result->msgs[c]->dn));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek continue;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce key.str = discard_const(sid);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = hash_lookup(ext_group_hash, &key, &value);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == HASH_ERROR_KEY_NOT_FOUND) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_ALL, "SID [%s] not found in ext group hash.\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce sid);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek } else if (ret == HASH_SUCCESS) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce iter = new_hash_iter_context(value.ptr);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (iter == NULL) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "new_hash_iter_context failed.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce while ((entry = iter->next(iter)) != NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = hash_enter(group_hash, &entry->key, &entry->value);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != HASH_SUCCESS) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Failed to add group [%s].\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce entry->key.str);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(iter);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "hash_lookup failed for SID [%s].\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce sid);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce g_count = hash_count(group_hash);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (g_count == 0) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "No external groupmemberships found.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce groups = talloc_zero_array(mem_ctx, char *, g_count + 1);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (groups == NULL) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "talloc_array failed.\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ENOMEM;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce iter = new_hash_iter_context(group_hash);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (iter == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "new_hash_iter_context failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce c = 0;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio while ((entry = iter->next(iter)) != NULL) {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio groups[c] = talloc_strdup(groups, entry->key.str);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (groups[c] == NULL) {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce c++;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce user_dn = ldb_dn_copy(mem_ctx, result->msgs[0]->dn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (user_dn == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_copy failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EOK;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekdone:

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek *_user_dn = user_dn;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *_groups = groups;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce talloc_free(tmp_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic errno_t add_ad_user_to_cached_groups(struct ldb_dn *user_dn,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sss_domain_info *user_dom,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sss_domain_info *group_dom,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **groups,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek bool *missing_groups)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce size_t c;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sysdb_attrs *user_attrs;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce size_t msgs_count;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message **msgs;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char *subfilter;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *missing_groups = false;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek tmp_ctx = talloc_new(NULL);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (tmp_ctx == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for (c = 0; groups[c] != NULL; c++) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (groups[c][0] == '\0') {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek continue;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce subfilter = talloc_asprintf(tmp_ctx, "(%s=%s)", SYSDB_ORIG_DN, groups[c]);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (subfilter == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio ret = sysdb_search_groups(tmp_ctx, group_dom, subfilter, NULL,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio &msgs_count, &msgs);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (ret == ENOENT) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_TRACE_ALL, "Group [%s] not in the cache.\n",

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce groups[c]);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce *missing_groups = true;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce continue;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce } else {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_entry failed.\n");

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio goto done;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = sysdb_mod_group_member(group_dom, user_dn, msgs[0]->dn,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce LDB_FLAG_MOD_ADD);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK && ret != EEXIST) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sysdb_mod_group_member failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce user_attrs = sysdb_new_attrs(tmp_ctx);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (user_attrs == NULL) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sysdb_new_attrs failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ENOMEM;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_MEMBEROF,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek groups[c]);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_add_string failed.\n");

a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = sysdb_set_entry_attr(user_dom->sysdb, user_dn, user_attrs,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek LDB_FLAG_MOD_ADD);

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (ret != EOK && ret != EEXIST) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sysdb_set_entry_attr failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio /* mark group as already processed */

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio groups[c][0] = '\0';

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = EOK;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciodone:

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio talloc_free(tmp_ctx);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return ret;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio}

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciostatic struct tevent_req *ipa_add_ad_memberships_send(TALLOC_CTX *mem_ctx,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct tevent_context *ev,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct sdap_id_ctx *sdap_id_ctx,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct ldb_dn *user_dn,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct sss_domain_info *user_dom,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio char **groups,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct sss_domain_info *group_dom);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciostatic void ipa_add_ad_memberships_done(struct tevent_req *subreq);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciostruct get_ad_membership_state {

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct tevent_context *ev;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct ipa_server_mode_ctx *server_mode;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct sdap_id_op *sdap_op;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct sdap_id_ctx *sdap_id_ctx;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct fo_server *srv;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio char *user_name;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct sss_domain_info *user_dom;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio int dp_error;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio const char *domain;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio size_t reply_count;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct sysdb_attrs **reply;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio};

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic void ipa_get_ad_memberships_connect_done(struct tevent_req *subreq);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic void ipa_get_ext_groups_done(struct tevent_req *subreq);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic errno_t ipa_add_ext_groups_step(struct tevent_req *req);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic errno_t ipa_add_ad_memberships_recv(struct tevent_req *req,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio int *dp_error_out);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostruct tevent_req *ipa_get_ad_memberships_send(TALLOC_CTX *mem_ctx,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct tevent_context *ev,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct be_acct_req *ar,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct ipa_server_mode_ctx *server_mode,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct sss_domain_info *user_dom,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct sdap_id_ctx *sdap_id_ctx,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio const char *domain)

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio{

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio int ret;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct tevent_req *req;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct tevent_req *subreq;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct get_ad_membership_state *state;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio req = tevent_req_create(mem_ctx, &state, struct get_ad_membership_state);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (req == NULL) {

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio return NULL;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio state->ev = ev;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->user_dom = user_dom;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->sdap_id_ctx = sdap_id_ctx;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->srv = NULL;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->domain = domain;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->dp_error = -1;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (((ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_INITGROUPS

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio && (ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_USER)

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio || ar->filter_type != BE_FILTER_NAME) {

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "Unsupported request type.\n");

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret = EINVAL;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio state->user_name = talloc_strdup(state, ar->filter_value);

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (state->user_name == NULL) {

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "talloc_Strdup failed.\n");

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret = ENOMEM;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio state->sdap_op = sdap_id_op_create(state,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio state->sdap_id_ctx->conn->conn_cache);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (state->sdap_op == NULL) {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->server_mode = server_mode;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (server_mode->ext_groups == NULL) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek server_mode->ext_groups = talloc_zero(server_mode,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct ipa_ext_groups);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (server_mode->ext_groups == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "talloc_zero failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (server_mode->ext_groups->next_update > time(NULL)) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_TRACE_FUNC, "External group information still valid.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = ipa_add_ext_groups_step(req);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else if (ret == EAGAIN) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return req;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ext_groups_step failed.\n");

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (subreq == NULL) {

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect_send failed: %d(%s).\n",

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret, strerror(ret));

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio tevent_req_set_callback(subreq, ipa_get_ad_memberships_connect_done, req);

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio return req;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorcedone:

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->dp_error = DP_ERR_FATAL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tevent_req_error(req, ret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->dp_error = DP_ERR_OK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_done(req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tevent_req_post(req, state->ev);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return req;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekstatic void ipa_get_ad_memberships_connect_done(struct tevent_req *subreq)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct tevent_req *req = tevent_req_callback_data(subreq,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct tevent_req);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct get_ad_membership_state *state = tevent_req_data(req,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct get_ad_membership_state);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek int ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek char *basedn;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sdap_id_op_connect_recv(subreq, &state->dp_error);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce talloc_zfree(subreq);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (state->dp_error == DP_ERR_OFFLINE) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "No IPA server is available, going offline\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Failed to connect to IPA server: [%d](%s)\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret, strerror(ret));

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto fail;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = domain_to_basedn(state, state->domain, &basedn);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE, "domain_to_basedn failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto fail;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek subreq = sdap_get_generic_send(state, state->ev, state->sdap_id_ctx->opts,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek sdap_id_op_handle(state->sdap_op), basedn,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek LDAP_SCOPE_SUBTREE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek IPA_EXT_GROUPS_FILTER, NULL, NULL, 0,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek dp_opt_get_int(state->sdap_id_ctx->opts->basic,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek SDAP_ENUM_SEARCH_TIMEOUT),

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek false);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (subreq == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto fail;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_set_callback(subreq, ipa_get_ext_groups_done, req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcefail:

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio tevent_req_error(req, ret);

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio return;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidênciostatic void ipa_get_ext_groups_done(struct tevent_req *subreq)

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio{

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct tevent_req *req = tevent_req_callback_data(subreq,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct get_ad_membership_state *state = tevent_req_data(req,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct get_ad_membership_state);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek int ret;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio hash_table_t *ext_group_hash;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = sdap_get_generic_recv(subreq, state,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek &state->reply_count, &state->reply);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek talloc_zfree(subreq);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "ipa_get_ext_groups request failed.\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek tevent_req_error(req, ret);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "[%zu] external groups found.\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->reply_count);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = process_ext_groups(state->server_mode->ext_groups,

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio state->reply_count, state->reply, &ext_group_hash);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "process_ext_groups failed.\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto fail;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->server_mode->ext_groups->ext_groups = ext_group_hash;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek /* Do we have to make the update timeout configurable? */

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->server_mode->ext_groups->next_update = time(NULL) + 10;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = ipa_add_ext_groups_step(req);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (ret == EOK) {

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio tevent_req_done(req);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio return;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio } else if (ret == EAGAIN) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio } else {

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ext_groups_step failed.\n");

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio goto fail;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekfail:

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tevent_req_error(req, ret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekstatic errno_t ipa_add_ext_groups_step(struct tevent_req *req)

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio{

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct get_ad_membership_state *state = tevent_req_data(req,

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct get_ad_membership_state);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct ldb_dn *user_dn;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **groups = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *subreq;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio ret = find_ipa_ext_memberships(state, state->user_name, state->user_dom,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->server_mode->ext_groups->ext_groups,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce &user_dn, &groups);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "find_ipa_ext_memberships failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto fail;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (groups == NULL) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_TRACE_ALL, "No external groups memberships found.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce state->dp_error = DP_ERR_OK;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce return EOK;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce subreq = ipa_add_ad_memberships_send(state, state->ev, state->sdap_id_ctx,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce user_dn, state->user_dom, groups,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce state->sdap_id_ctx->be->domain);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (subreq == NULL) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ad_memberships_send failed.\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = ENOMEM;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto fail;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce tevent_req_set_callback(subreq, ipa_add_ad_memberships_done, req);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return EAGAIN;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciofail:

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce tevent_req_error(req, ret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekstatic void ipa_add_ad_memberships_done(struct tevent_req *subreq)

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek{

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct tevent_req *req = tevent_req_callback_data(subreq,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct tevent_req);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct get_ad_membership_state *state = tevent_req_data(req,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct get_ad_membership_state);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek int ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = ipa_add_ad_memberships_recv(subreq, &state->dp_error);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek talloc_zfree(subreq);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "ipa_add_ad_memberships request failed.\n");

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce tevent_req_error(req, ret);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce return;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek state->dp_error = DP_ERR_OK;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tevent_req_done(req);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekerrno_t ipa_get_ad_memberships_recv(struct tevent_req *req, int *dp_error_out)

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek{

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct get_ad_membership_state *state = tevent_req_data(req,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct get_ad_membership_state);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce TEVENT_REQ_RETURN_ON_ERROR(req);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (dp_error_out) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce *dp_error_out = state->dp_error;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce return EOK;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekstruct add_ad_membership_state {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct tevent_context *ev;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct sdap_id_ctx *sdap_id_ctx;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sdap_id_op *sdap_op;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn *user_dn;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct sss_domain_info *user_dom;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct sss_domain_info *group_dom;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **groups;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int dp_error;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce size_t iter;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sdap_domain *group_sdom;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce};

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic void ipa_add_ad_memberships_connect_done(struct tevent_req *subreq);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic void ipa_add_ad_memberships_get_next(struct tevent_req *req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic void ipa_add_ad_memberships_get_group_done(struct tevent_req *subreq);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic struct tevent_req *ipa_add_ad_memberships_send(TALLOC_CTX *mem_ctx,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_context *ev,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sdap_id_ctx *sdap_id_ctx,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn *user_dn,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sss_domain_info *user_dom,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **groups,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sss_domain_info *group_dom)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *req;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *subreq;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct add_ad_membership_state *state;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce bool missing_groups = false;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce req = tevent_req_create(mem_ctx, &state, struct add_ad_membership_state);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (req == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "tevent_req_create failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return NULL;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->ev = ev;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->user_dom = user_dom;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->sdap_id_ctx = sdap_id_ctx;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->user_dn = user_dn;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->group_dom = group_dom;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->groups = groups;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->dp_error = -1;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->iter = 0;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->group_sdom = sdap_domain_get(sdap_id_ctx->opts, group_dom);

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek if (state->group_sdom == NULL) {

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek ret = EIO;

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek goto done;

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek }

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = add_ad_user_to_cached_groups(user_dn, user_dom, group_dom, groups,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek &missing_groups);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "add_ad_user_to_cached_groups failed.\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!missing_groups) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_ALL, "All groups found in cache.\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->sdap_op = sdap_id_op_create(state,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->sdap_id_ctx->conn->conn_cache);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (state->sdap_op == NULL) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (subreq == NULL) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_connect_send failed: %d(%s).\n",

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret, strerror(ret));

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_set_callback(subreq, ipa_add_ad_memberships_connect_done, req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return req;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio state->dp_error = DP_ERR_FATAL;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio tevent_req_error(req, ret);

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio } else {

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio state->dp_error = DP_ERR_OK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_done(req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_post(req, state->ev);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return req;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce}

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekstatic void ipa_add_ad_memberships_connect_done(struct tevent_req *subreq)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *req = tevent_req_callback_data(subreq,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct add_ad_membership_state *state = tevent_req_data(req,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct add_ad_membership_state);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sdap_id_op_connect_recv(subreq, &state->dp_error);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_zfree(subreq);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (state->dp_error == DP_ERR_OFFLINE) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_MINOR_FAILURE,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce "No IPA server is available, going offline\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Failed to connect to IPA server: [%d](%s)\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret, strerror(ret));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tevent_req_error(req, ret);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce return;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce state->iter = 0;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ipa_add_ad_memberships_get_next(req);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce}

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorcestatic void ipa_add_ad_memberships_get_next(struct tevent_req *req)

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce{

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct add_ad_membership_state *state = tevent_req_data(req,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce struct add_ad_membership_state);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce struct tevent_req *subreq;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce struct ldb_dn *group_dn;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek int ret;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce const struct ldb_val *val;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek bool missing_groups;

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek while (state->groups[state->iter] != NULL

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek && state->groups[state->iter][0] == '\0') {

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek state->iter++;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (state->groups[state->iter] == NULL) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = add_ad_user_to_cached_groups(state->user_dn, state->user_dom,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek state->group_dom, state->groups,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek &missing_groups);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "add_ad_user_to_cached_groups failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto fail;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (missing_groups) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE, "There are unresolved external group "

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "memberships even after all groups "

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "have been looked up on the LDAP "

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek "server.\n");

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce tevent_req_done(req);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce return;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce group_dn = ldb_dn_new(state, sysdb_ctx_get_ldb(state->group_dom->sysdb),

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce state->groups[state->iter]);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (group_dn == NULL) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_new failed.\n");

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto fail;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce val = ldb_dn_get_rdn_val(group_dn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (val == NULL || val->data == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE,

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek "Invalid group DN [%s].\n", state->groups[state->iter]);

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek ret = EINVAL;

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek goto fail;

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek }

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce subreq = groups_get_send(state, state->ev,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce state->sdap_id_ctx, state->group_sdom,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce state->sdap_id_ctx->conn,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce (const char *) val->data,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce BE_FILTER_NAME, BE_ATTR_CORE,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce false, false);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (subreq == NULL) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce DEBUG(SSSDBG_OP_FAILURE, "groups_get_send failed.\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto fail;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_set_callback(subreq, ipa_add_ad_memberships_get_group_done, req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekfail:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_error(req, ret);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorcestatic void ipa_add_ad_memberships_get_group_done(struct tevent_req *subreq)

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek{

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct tevent_req *req = tevent_req_callback_data(subreq,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct tevent_req);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct add_ad_membership_state *state = tevent_req_data(req,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct add_ad_membership_state);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int ret;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = groups_get_recv(subreq, &state->dp_error, NULL);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek talloc_zfree(subreq);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Failed to read group [%s] from LDAP [%d](%s)\n",

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce state->groups[state->iter], ret, strerror(ret));

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce tevent_req_error(req, ret);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->iter++;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ipa_add_ad_memberships_get_next(req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorcestatic errno_t ipa_add_ad_memberships_recv(struct tevent_req *req,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int *dp_error_out)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct add_ad_membership_state *state = tevent_req_data(req,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct add_ad_membership_state);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TEVENT_REQ_RETURN_ON_ERROR(req);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (dp_error_out) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek *dp_error_out = state->dp_error;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EOK;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic errno_t

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcesearch_user_or_group_by_sid_str(TALLOC_CTX *mem_ctx,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sss_domain_info *domain,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek const char *sid_str,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce enum sysdb_member_type *_member_type,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message **_msg)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce errno_t ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message *msg = NULL;

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *attrs[] = { SYSDB_NAME,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce SYSDB_SID_STR,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce SYSDB_ORIG_DN,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce SYSDB_OBJECTCLASS,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce SYSDB_CACHE_EXPIRE,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce NULL };

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce TALLOC_CTX *tmp_ctx = NULL;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *sanitized_sid = NULL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek tmp_ctx = talloc_new(NULL);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (tmp_ctx == NULL) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ENOMEM;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce /* In theory SID shouldn't contain any special LDAP characters, but let's

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = sss_filter_sanitize(tmp_ctx, sid_str, &sanitized_sid);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sysdb_search_user_by_sid_str(tmp_ctx, domain,

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek sid_str, attrs, &msg);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret == EOK) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *_member_type = SYSDB_MEMBER_USER;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else if (ret == ENOENT) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = sysdb_search_group_by_sid_str(tmp_ctx, domain,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek sid_str, attrs, &msg);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek *_member_type = SYSDB_MEMBER_GROUP;

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik }

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik }

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik

bc7991db97482eb2ac77f7105ee4bb3d329acff7Lukas Slebodnik switch (ret) {

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik case EOK:

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik DEBUG(SSSDBG_TRACE_FUNC, "Found %s in sysdb\n", sid_str);

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik *_msg = talloc_steal(mem_ctx, msg);

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik break;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce case ENOENT:

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_TRACE_FUNC,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce "Could not find %s in sysdb", sid_str);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce break;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce default:

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce "Error looking for %s in sysdb [%d]: %s\n",

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce sid_str, ret, sss_strerror(ret));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce }

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorcedone:

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce talloc_free(tmp_ctx);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce return ret;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestatic errno_t

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozekipa_ext_group_member_check(TALLOC_CTX *mem_ctx,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct sss_domain_info *member_dom,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *ext_member,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce enum sysdb_member_type *_member_type,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sysdb_attrs **_member)

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce{

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce TALLOC_CTX *tmp_ctx = NULL;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce errno_t ret;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce uint64_t expire;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce time_t now = time(NULL);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message *msg;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce struct sysdb_attrs **members;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce tmp_ctx = talloc_new(NULL);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (tmp_ctx == NULL) {

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new() failed\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ENOMEM;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = search_user_or_group_by_sid_str(tmp_ctx, member_dom, ext_member,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce _member_type, &msg);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret != EOK) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_OP_FAILURE,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio "Error looking up sid %s: [%d]: %s\n",

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ext_member, ret, sss_strerror(ret));

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio }

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = sysdb_msg2attrs(tmp_ctx, 1, &msg, &members);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret != EOK) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce DEBUG(SSSDBG_OP_FAILURE,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce "Could not convert result to sysdb_attrs [%d]: %s\n",

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret, sss_strerror(ret));

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce /* Return the member both expired and valid */

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce *_member = talloc_steal(mem_ctx, members[0]);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce expire = ldb_msg_find_attr_as_uint64(msg, SYSDB_CACHE_EXPIRE, 0);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (expire != 0 && expire <= now) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "%s is expired", ext_member);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EAGAIN;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozekdone:

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek talloc_free(tmp_ctx);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek}

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestruct ipa_ext_member_state {

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *ext_member;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek struct sss_domain_info *dom;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce enum sysdb_member_type member_type;

struct sysdb_attrs *member;

};

static void ipa_ext_group_member_done(struct tevent_req *subreq);

struct tevent_req *ipa_ext_group_member_send(TALLOC_CTX *mem_ctx,

struct tevent_context *ev,

const char *ext_member,

void *pvt)

{

struct ipa_id_ctx *ipa_ctx;

struct ipa_ext_member_state *state;

struct tevent_req *req;

struct tevent_req *subreq;

struct be_acct_req *ar;

errno_t ret;

req = tevent_req_create(mem_ctx, &state, struct ipa_ext_member_state);

if (req == NULL) {

return NULL;

}

state->ext_member = ext_member;

ipa_ctx = talloc_get_type(pvt, struct ipa_id_ctx);

if (ipa_ctx == NULL) {

DEBUG(SSSDBG_CRIT_FAILURE, "Wrong private context!\n");

ret = EINVAL;

goto immediate;

}

state->dom = find_domain_by_sid(ipa_ctx->sdap_id_ctx->be->domain,

ext_member);

if (state->dom == NULL) {

DEBUG(SSSDBG_MINOR_FAILURE,

"Cannot find domain of SID [%s]\n", ext_member);

ret = ENOENT;

goto immediate;

}

ret = ipa_ext_group_member_check(state, state->dom, ext_member,

&state->member_type, &state->member);

if (ret == EOK) {

DEBUG(SSSDBG_TRACE_INTERNAL,

"external member %s already cached\n", ext_member);

goto immediate;

}

ret = get_be_acct_req_for_sid(state, ext_member, state->dom->name, &ar);

if (ret != EOK) {

DEBUG(SSSDBG_MINOR_FAILURE,

"Cannot create the account request for [%s]\n", ext_member);

goto immediate;

}

subreq = be_get_account_info_send(state, ev, NULL,

ipa_ctx->sdap_id_ctx->be, ar);

if (subreq == NULL) {

ret = ENOMEM;

goto immediate;

}

tevent_req_set_callback(subreq, ipa_ext_group_member_done, req);

return req;

immediate:

if (ret != EOK) {

tevent_req_error(req, ret);

} else {

tevent_req_done(req);

}

tevent_req_post(req, ev);

return req;

}

static void ipa_ext_group_member_done(struct tevent_req *subreq)

{

struct tevent_req *req = tevent_req_callback_data(subreq,

struct tevent_req);

struct ipa_ext_member_state *state = tevent_req_data(req,

struct ipa_ext_member_state);

errno_t ret;

int err_maj;

int err_min;

const char *err_msg;

struct ldb_message *msg;

struct sysdb_attrs **members;

ret = be_get_account_info_recv(subreq, state,

&err_maj, &err_min, &err_msg);

talloc_free(subreq);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE,

"be request failed %d:%d: %s\n", err_maj, err_min, err_msg);

tevent_req_error(req, ret);

return;

}

ret = search_user_or_group_by_sid_str(state,

state->dom,

state->ext_member,

&state->member_type,

&msg);

if (ret != EOK) {

DEBUG(ret == ENOENT ? SSSDBG_TRACE_FUNC : SSSDBG_OP_FAILURE,

"Could not find %s in sysdb [%d]: %s\n",

state->ext_member, ret, sss_strerror(ret));

tevent_req_error(req, ret);

return;

}

ret = sysdb_msg2attrs(state, 1, &msg, &members);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE,

"Could not convert result to sysdb_attrs [%d]: %s\n",

ret, sss_strerror(ret));

tevent_req_error(req, ret);

return;

}

state->member = members[0];

tevent_req_done(req);

}

errno_t ipa_ext_group_member_recv(TALLOC_CTX *mem_ctx,

struct tevent_req *req,

enum sysdb_member_type *_member_type,

struct sss_domain_info **_dom,

struct sysdb_attrs **_member)

{

struct ipa_ext_member_state *state = tevent_req_data(req,

struct ipa_ext_member_state);

TEVENT_REQ_RETURN_ON_ERROR(req);

if (_member_type != NULL) {

*_member_type = state->member_type;

}

if (_dom) {

*_dom = state->dom;

}

if (_member != NULL) {

*_member = talloc_steal(mem_ctx, state->member);

}

return EOK;

}