f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Async LDAP Helper routines - initgroups operation
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) Simo Sorce <ssorce@redhat.com> - 2009
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) 2010, Ralf Haferkamp <rhafer@suse.de>, Novell Inc.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) Jan Zeleny <jzeleny@redhat.com> - 2011
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny This program is free software; you can redistribute it and/or modify
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny it under the terms of the GNU General Public License as published by
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny the Free Software Foundation; either version 3 of the License, or
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (at your option) any later version.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny This program is distributed in the hope that it will be useful,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny but WITHOUT ANY WARRANTY; without even the implied warranty of
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny GNU General Public License for more details.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny You should have received a copy of the GNU General Public License
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny along with this program. If not, see <http://www.gnu.org/licenses/>.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny/* ==Save-fake-group-list=====================================*/
d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Boseerrno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
4a9c1047354dbe5a4ed41e5951ae623e3772e113René Genz /* There are no groups in LDAP but we should add user to groups?? */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny missing = talloc_array(tmp_ctx, char *, ldap_groups_count+1);
c03214d427ea43e7bf8255ccc79faa905c89f7f6Jakub Hrozek for (i=0; sysdb_groupnames[i]; i++) {
c03214d427ea43e7bf8255ccc79faa905c89f7f6Jakub Hrozek ret = sysdb_search_group_by_name(tmp_ctx, domain, sysdb_groupnames[i], NULL,
c03214d427ea43e7bf8255ccc79faa905c89f7f6Jakub Hrozek missing[mi] = talloc_strdup(missing, sysdb_groupnames[i]);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Group #%d [%s][%s] is not cached, " \
15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose "need to add a fake entry\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "search for group failed [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* All groups are cached, nothing to do */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (mi == 0) {
b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(opts->idmap_ctx,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Cannot start sysdb transaction [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; missing[i]; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* The group is not in sysdb, need to add a fake entry */
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_group_primary_name(tmp_ctx, opts, ldap_groups[ai],
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "The group has no name attribute\n");
75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose opts->group_map[SDAP_AT_GROUP_OBJECTSID].sys_name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "No SID for group [%s] " \
75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose "while id-mapping.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Mapping group [%s] objectSID to unix ID\n", groupname);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has objectSID [%s]\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Convert the SID into a UNIX group ID */
8be5e4497e5008f7807178acdfcbf97365ec4e73Stephen Gallagher ret = sdap_idmap_sid_to_unix(opts->idmap_ctx, sid_str,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has mapped gid [%lu]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] cannot be mapped. "
c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher "Treating as a non-POSIX group\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sysdb_attrs_get_uint32_t(ldap_groups[ai],
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher if (ret == ENOENT || (ret == EOK && gid == 0)) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "The group %s gid was %s\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname, ret == ENOENT ? "missing" : "zero");
4a9c1047354dbe5a4ed41e5951ae623e3772e113René Genz "Marking group %s as non-POSIX and setting GID=0!\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher } else if (ret) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The GID attribute is malformed\n");
108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no original DN\n");
56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik DEBUG((ret == ENOENT) ? SSSDBG_TRACE_ALL : SSSDBG_MINOR_FAILURE,
56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik "Failed to retrieve UUID [%d][%s].\n",
1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose "uniqueIDstr",
108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no UUID\n");
b9fbeb75e7a4f50f98d979a70a710f9221892483Lukas Slebodnik ret = sdap_check_ad_group_type(domain, opts, ldap_groups[ai],
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Adding fake group %s to sysdb\n", groupname);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_add_incomplete_group(domain, groupname, gid,
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio /* In case o group id-collision, do:
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio * - Delete the group from sysdb
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio * - Add the new incomplete group
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio * - Notify the NSS responder that the entry has also to be
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio * removed from the memory cache
a2e743cd23e8e2033340612c77a8dbb8ef48c1e1Fabiano Fidêncio ret = sdap_handle_id_collision_for_incomplete_groups(
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Group %s not present in LDAP\n", missing[i]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_transaction_commit failed.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
6199bd6b41e8b280e65db4b4bb17a1c5c0444aa9Stephen Gallagherint sdap_initgr_common_store(struct sysdb_ctx *sysdb,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* No groups for this user in LDAP.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * We need to ensure that there are no groups
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * in the sysdb either.
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Find the differences between the sysdb and LDAP lists
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * Groups in the sysdb only must be removed.
64175969779e51c00a78397746d4fec7ce7033a4Jakub Hrozek ldap_fqdnlist = sss_create_internal_fqname_list(
64175969779e51c00a78397746d4fec7ce7033a4Jakub Hrozek (const char * const *) ldap_grouplist,
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = diff_string_lists(tmp_ctx, ldap_fqdnlist, sysdb_grouplist,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Add fake entries for any groups the user should be added as
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * member of but that are not cached in sysdb
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_add_incomplete_groups(sysdb, domain, opts,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Adding incomplete users failed\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n", name);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (const char *const *) add_groups,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (const char *const *) del_groups);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Membership update failed [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-RFC2307===================== */
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagherstatic errno_t sdap_initgr_rfc2307_next_base(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_rfc2307_process(struct tevent_req *subreq);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystruct tevent_req *sdap_initgr_rfc2307_send(TALLOC_CTX *memctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny const char *name)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_create(memctx, &state, struct sdap_initgr_rfc2307_state);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
749cfb5d3270b5daf389d51a0dbd3fd2aec6e05dJakub Hrozek state->search_bases = opts->sdom->group_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a group search base\n");
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, opts->group_map, SDAP_OPTS_GROUP,
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot parse %s\n", name);
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_filter_sanitize(state, shortname, &clean_name);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->base_filter = talloc_asprintf(state,
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek "(&(%s=%s)(%s)(%s=*)",
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek state->base_filter = talloc_asprintf_append(state->base_filter, ")");
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek state->base_filter = talloc_asprintf_append(state->base_filter,
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek "(&(%s=*)(!(%s=0))))",
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagherstatic errno_t sdap_initgr_rfc2307_next_base(struct tevent_req *req)
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state = tevent_req_data(req, struct sdap_initgr_rfc2307_state);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->filter = sdap_combine_filters( state, state->base_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for groups with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->search_bases[state->base_iter]->basedn);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->search_bases[state->base_iter]->basedn,
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->search_bases[state->base_iter]->scope,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307_process, req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_rfc2307_process(struct tevent_req *subreq)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state = tevent_req_data(req, struct sdap_initgr_rfc2307_state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &ldap_groups);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Add this batch of groups to the list */
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Copy the new groups into the list.
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher for (i = 0; i < count; i++) {
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek state->ldap_groups[state->ldap_groups_count + i] =
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek talloc_steal(state->ldap_groups, ldap_groups[i]);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->ldap_groups[state->ldap_groups_count] = NULL;
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Check for additional search bases, and iterate
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher * through again.
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Search for all groups for which this user is a member */
2ce00e0d3896bb42db169d1e79553a81ca837a22Simo Sorce ret = get_sysdb_grouplist(state, state->sysdb, state->domain,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* There are no nested groups here so we can just update the
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * memberships */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_rfc2307_recv(struct tevent_req *req)
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek/* ==Common code for pure RFC2307bis and IPA/AD========================= */
c88e387d10104774852d54355fc17ad41761776aJakub Hrozeksdap_nested_groups_store(struct sysdb_ctx *sysdb,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek unsigned long count)
73ead5bb50130663668ded57822d9850b2dc2fffJakub Hrozek ret = sysdb_attrs_primary_fqdn_list(domain, tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_add_incomplete_groups(sysdb, domain, opts, groupnamelist,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Could not add incomplete groups [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
c88e387d10104774852d54355fc17ad41761776aJakub Hrozekbuild_membership_diff(TALLOC_CTX *mem_ctx, const char *name,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek char **ldap_parent_names, char **sysdb_parent_names,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek mdiff = talloc_zero(tmp_ctx, struct membership_diff);
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek /* Find the differences between the sysdb and ldap lists
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek * Groups in ldap only must be added to the sysdb;
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek * groups in the sysdb only must be removed.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-nested-groups=============== */
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_deref_search(struct tevent_req *req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_noderef_search(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_search(struct tevent_req *subreq);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_store(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_create(memctx, &state, struct sdap_initgr_nested_state);
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_user_primary_name(memctx, opts, user, dom, &state->username);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "User entry had no username\n");
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek ret = sysdb_attrs_get_el(state->user, SYSDB_MEMBEROF, &state->memberof);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (ret || !state->memberof || state->memberof->num_values == 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CONF_SETTINGS, "User entry lacks original memberof ?\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* We can't find any groups for this user, so we'll
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * have to assume there aren't any. Just return
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * success here.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state->groups = talloc_zero_array(state, struct sysdb_attrs *,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek deref_threshold = dp_opt_get_int(state->opts->basic,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (sdap_has_deref_support(state->sh, state->opts) &&
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek deref_threshold < state->memberof->num_values) {
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek ret = sysdb_attrs_get_string(user, SYSDB_ORIG_DN,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_noderef_search(struct tevent_req *req)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek for (i = 0; i < state->memberof->num_values; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state->group_dns[i] = talloc_strdup(state->group_dns,
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, state->opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek state->filter = talloc_asprintf(state, "(&(%s)(%s=*))", oc_list,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state->opts->group_map[SDAP_AT_GROUP_NAME].name);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_nested_search, req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic void sdap_initgr_nested_deref_done(struct tevent_req *subreq);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_deref_search(struct tevent_req *req)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek maps = talloc_array(state, struct sdap_attr_map_info, num_maps+1);
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, state->opts->group_map, SDAP_OPTS_GROUP,
f393e23f264a299868a12bec40a390a7ecd65d10Stephen Gallagher timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek subreq = sdap_deref_search_send(state, state->ev, state->opts,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state->opts->user_map[SDAP_AT_USER_MEMBEROF].name,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek tevent_req_set_callback(subreq, sdap_initgr_nested_deref_done, req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic void sdap_initgr_nested_deref_done(struct tevent_req *subreq)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek req = tevent_req_callback_data(subreq, struct tevent_req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek } else if (ret == ENOENT || deref_result == NULL) {
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek /* Nothing could be dereferenced. Done. */
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek for (i=0; i < num_results; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_search(struct tevent_req *subreq)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state = tevent_req_data(req, struct sdap_initgr_nested_state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &groups);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state->groups[state->groups_cur] = talloc_steal(state->groups,
a75266b247510719f7879f876809a1b03c31a3deJakub Hrozek "Search for group %s, returned %zu results. Skipping\n",
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek /* note that state->memberof->num_values is the count of original
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek * memberOf which might not be only groups, but permissions, etc.
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek * Use state->groups_cur for group index cap */
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (state->cur < state->memberof->num_values) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_nested_search, req);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_groups(struct sdap_initgr_nested_state *state);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_group_memberships(struct sdap_initgr_nested_state *state);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_user_memberships(struct sdap_initgr_nested_state *state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_store(struct tevent_req *req)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the groups if they are not already */
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Could not save groups [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the group memberships */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_store_group_memberships(state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not save group memberships [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the user memberships */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_store_user_memberships(state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not save user memberships [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_groups(struct sdap_initgr_nested_state *state)
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce return sdap_nested_groups_store(state->sysdb, state->dom,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_nested_get_membership_diff(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozekstatic int sdap_initgr_nested_get_direct_parents(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_group_memberships(struct sdap_initgr_nested_state *state)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Compute the diffs first in order to keep the transaction as small
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek * as possible
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_nested_get_membership_diff(tmp_ctx, state->sysdb,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not compute memberships for group %d [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, miter->name,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Failed to update memberships\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_user_memberships(struct sdap_initgr_nested_state *state)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Get direct LDAP parents */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_get_string(state->user, SYSDB_ORIG_DN, &orig_dn);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "The user has no original DN\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ldap_parentlist = talloc_zero_array(tmp_ctx, struct sysdb_attrs *,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_get_el(state->groups[i], SYSDB_MEMBER, &el);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "A group with no members during initgroups?\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek if (strcasecmp((const char *) el->values[mi].data, orig_dn) != 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The user %s is a direct member of %d LDAP groups\n",
3931c6612fae5ad32ad81a59f77d77c2d896ebe1Jakub Hrozek ret = sysdb_attrs_primary_name_list(state->dom, tmp_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state->opts->group_map[SDAP_AT_GROUP_NAME].name,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
64175969779e51c00a78397746d4fec7ce7033a4Jakub Hrozek ldap_fqdnlist = sss_create_internal_fqname_list(
64175969779e51c00a78397746d4fec7ce7033a4Jakub Hrozek (const char * const *) ldap_parent_name_list,
3dd4c3eca80e9223a65f3318821bd0fb5b45aeddSumit Bose ret = sysdb_get_direct_parents(tmp_ctx, state->dom, state->dom,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Updating memberships for %s\n", state->username);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, state->username, SYSDB_MEMBER_USER,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek (const char *const *) add_groups,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek (const char *const *) del_groups);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not update sysdb memberships for %s: %d [%s]\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_nested_get_membership_diff(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Get direct sysdb parents */
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_group_primary_name(tmp_ctx, opts, group, dom, &group_name);
3dd4c3eca80e9223a65f3318821bd0fb5b45aeddSumit Bose ret = sysdb_get_direct_parents(tmp_ctx, dom, dom, SYSDB_MEMBER_GROUP,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* For each group, filter only parents from full set */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_nested_get_direct_parents(tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Cannot get parent groups for %s [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The group %s is a direct member of %d LDAP groups\n",
5bd3bef4a655fdfacd2f5df8a2343fe7bc68a771Sumit Bose ret = sysdb_attrs_primary_fqdn_list(dom, tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = build_membership_diff(tmp_ctx, group_name, ldap_parent_names_list,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not build membership diff for %s [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_nested_get_direct_parents(TALLOC_CTX *mem_ctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny direct_groups = talloc_zero_array(tmp_ctx, struct sysdb_attrs *,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sysdb_attrs_get_string(attrs, SYSDB_ORIG_DN, &orig_dn);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Missing originalDN\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Looking up direct parents for group [%s]\n", orig_dn);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* FIXME - Filter only parents from full set to avoid searching
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * through all members of huge groups. That requires asking for memberOf
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * with the group LDAP search
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Filter only direct parents from the list of all groups */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; i < ngroups; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sysdb_attrs_get_el(groups[i], SYSDB_MEMBER, &member);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "A group with no members during initgroups?\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (strcasecmp((const char *) member->values[mi].data, orig_dn) != 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The group [%s] has %d direct parents\n", orig_dn, ndirect);
d3bdb23bec3432591acb1135a108ee9bdd5f87e0Jakub Hrozek *_direct_parents = talloc_steal(mem_ctx, direct_groups);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_nested_recv(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-RFC2307-BIS================= */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t sdap_initgr_rfc2307bis_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_process(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic struct tevent_req *sdap_initgr_rfc2307bis_send(
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny const char *name,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek req = tevent_req_create(memctx, &state, struct sdap_initgr_rfc2307bis_state);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
1b870ffa7910879f9310db453a31ab6f06392b9bJakub Hrozek state->search_bases = sdom->group_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a group search base\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = sss_hash_create(state, 32, &state->group_hash);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, opts->group_map, SDAP_OPTS_GROUP,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sss_filter_sanitize(state, orig_dn, &clean_orig_dn);
1b870ffa7910879f9310db453a31ab6f06392b9bJakub Hrozek use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek "(&(%s=%s)(%s)(%s=*)",
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher opts->group_map[SDAP_AT_GROUP_MEMBER].name,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher opts->group_map[SDAP_AT_GROUP_NAME].name);
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek /* When mapping IDs or looking for SIDs, we don't want to limit
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek * ourselves to groups with a GID value. But there must be a SID to map
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->base_filter = talloc_asprintf_append(state->base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek opts->group_map[SDAP_AT_GROUP_OBJECTSID].name);
981bf55532fbec91a106f82d7daf32094c76dfe0Pavel Reichl state->base_filter = talloc_asprintf_append(state->base_filter, ")");
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sdap_initgr_rfc2307bis_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t sdap_initgr_rfc2307bis_next_base(struct tevent_req *req)
fd21ca460115a5d51d0db6e5ac759b8aff51ab99Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->filter = sdap_combine_filters(state, state->base_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for parent groups for user [%s] with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->orig_dn, state->search_bases[state->base_iter]->basedn);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->basedn,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->scope,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307bis_process, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_process(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek state = tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Found %zu parent groups for user [%s]\n", count, state->name);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Add this batch of groups to the list */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Copy the new groups into the list.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher for (i = 0; i < count; i++) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->direct_groups[state->num_direct_parents + i] =
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek talloc_steal(state->direct_groups, ldap_groups[i]);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->direct_groups[state->num_direct_parents] = NULL;
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Check for additional search bases, and iterate
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher * through again.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sdap_initgr_rfc2307bis_next_base(req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Start a transaction to look up the groups in the sysdb
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * and update them with LDAP data
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = rfc2307bis_nested_groups_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307bis_done, req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_groups(struct sdap_initgr_rfc2307bis_state *state);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_group_memberships(struct sdap_initgr_rfc2307bis_state *state);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* save the groups if they are not cached */
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save groups memberships [%d]\n", ret);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* save the group membership */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = save_rfc2307bis_group_memberships(state);
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save group memberships [%d]\n", ret);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* save the user memberships */
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save user memberships [%d]\n", ret);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic int sdap_initgr_rfc2307bis_recv(struct tevent_req *req)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_groups(struct sdap_initgr_rfc2307bis_state *state)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek hret = hash_values(state->group_hash, &count, &values);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek groups = talloc_array(tmp_ctx, struct sysdb_attrs *, count);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek for (i = 0; i < count; i++) {
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_nested_groups_store(state->sysdb, state->dom, state->opts,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Could not save groups [%d]: %s\n",
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozekstatic bool rfc2307bis_group_memberships_build(hash_entry_t *item, void *user_data);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_group_memberships(struct sdap_initgr_rfc2307bis_state *state)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek struct rfc2307bis_group_memberships_state *membership_state;
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek membership_state->group_hash = state->group_hash;
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek DLIST_FOR_EACH(iter, membership_state->memberships) {
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek /* Create a copy of iter->add array but do not include groups outside
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek * nesting limit. This array must be NULL terminated.
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek for (grp_count = 0; iter->add[grp_count]; grp_count++);
1a54e022351a60fbfa619ef7ed6138fb892ad11aJakub Hrozek add = talloc_zero_array(tmp_ctx, char *, grp_count + 1);
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek for (i = 0; i < grp_count; i++) {
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, iter->name,
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek (const char *const *) add,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Failed to update memberships\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozekrfc2307bis_group_memberships_build(hash_entry_t *item, void *user_data)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek struct rfc2307bis_group_memberships_state *mstate = talloc_get_type(
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek user_data, struct rfc2307bis_group_memberships_state);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek group = (struct sdap_nested_group *) item->value.ptr;
3dd4c3eca80e9223a65f3318821bd0fb5b45aeddSumit Bose ret = sysdb_get_direct_parents(tmp_ctx, mstate->dom, mstate->dom,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
6a89b38c032593ed705e679c23e6a4efce9f3defJakub Hrozek ret = sysdb_attrs_primary_fqdn_list(mstate->dom, tmp_ctx,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek mstate->opts->group_map[SDAP_AT_GROUP_NAME].name,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = build_membership_diff(tmp_ctx, group_name, ldap_parents_names_list,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not build membership diff for %s [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Save parent groups to sysdb\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
3dd4c3eca80e9223a65f3318821bd0fb5b45aeddSumit Bose ret = sysdb_get_direct_parents(tmp_ctx, state->dom, state->dom,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek state->direct_groups, state->num_direct_parents,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Find the differences between the sysdb and ldap lists
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * Groups in ldap only must be added to the sysdb;
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * groups in the sysdb only must be removed.
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n", state->name);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, state->name, SYSDB_MEMBER_USER,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny (const char *const *)add_groups,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny (const char *const *)del_groups);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_step(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_options *opts, struct sysdb_ctx *sysdb,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sss_domain_info *dom, struct sdap_handle *sh,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "About to process %zu groups in nesting level %zu\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny if ((num_groups == 0) ||
93493702980e23d5b0322d16681f4ba77d6dd999Lukas Slebodnik (nesting > dp_opt_get_int(opts->basic, SDAP_NESTING_LEVEL))) {
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* No parent groups to process or too deep*/
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups nested lookup request "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "without a group search base\n");
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek while (state->group_iter < state->num_groups) {
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek /* This group had already been looked up. Continue to
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek * another group in the same level
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* All parent groups were already processed */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* EAGAIN means a lookup is in progress */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t rfc2307bis_nested_groups_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_process(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sysdb_attrs_get_string(state->groups[state->group_iter],
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose /* If there is a objectClass attribute the object is coming from the
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * cache and the name attribute of the object already has the primary
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * If the objectClass attribute is missing the object is coming from
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * LDAP and we have to find the primary name first. */
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sysdb_attrs_get_string(state->groups[state->group_iter],
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sdap_get_group_primary_name(state, state->opts,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek key.str = talloc_strdup(state, state->primary_name);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Processing group [%s]\n", state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek ret = hash_lookup(state->group_hash, &key, &value);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Group [%s] was already processed, "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "taking a shortcut\n", state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_get_type(value.ptr, struct sdap_nested_group);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Need to try to find parent groups for this group. */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_zero(state->processed_groups, struct sdap_nested_group);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek if (!state->processed_groups[state->group_iter]) {
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* this steal doesn't change much now, but will be helpful later on
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek * if we steal the whole processed_group on the hash table */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek state->processed_groups[state->group_iter]->group =
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_steal(state->processed_groups[state->group_iter],
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Get any parent groups for this group */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sysdb_attrs_get_string(state->groups[state->group_iter],
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = state->opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, state->opts->group_map, SDAP_OPTS_GROUP,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sss_filter_sanitize(tmp_ctx, state->orig_dn, &clean_orig_dn);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, state->opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny state->opts->group_map[SDAP_AT_GROUP_MEMBER].name,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny state->opts->group_map[SDAP_AT_GROUP_NAME].name);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = rfc2307bis_nested_groups_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Still processing parent groups */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t rfc2307bis_nested_groups_next_base(struct tevent_req *req)
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state = tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->filter = sdap_combine_filters(state, state->base_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for parent groups of group [%s] with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->search_bases[state->base_iter]->basedn);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->basedn,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->scope,
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichlrfc2307bis_nested_groups_iterate(struct tevent_req *req,
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl while (state->group_iter < state->num_groups) {
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* Looking up parent groups.. */
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* EOK means this group has already been processed
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl * in another nesting level */
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* All groups processed. Done. */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_process(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Found %zu parent groups of [%s]\n", count, state->orig_dn);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek ngr = state->processed_groups[state->group_iter];
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Add this batch of groups to the list */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Copy the new groups into the list.
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * They're allocated on 'state' so we need to move them
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * onto ldap_parents so that the data won't disappear when
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * we finish this nesting level.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher for (i = 0; i < count; i++) {
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_steal(ngr->ldap_parents, ldap_groups[i]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Total of %zu direct parents after this iteration\n",
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Check for additional search bases, and iterate
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher * through again.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = rfc2307bis_nested_groups_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Reset the base iterator for future lookups */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Save the group into the hash table */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek key.str = talloc_strdup(state, state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Steal the nested group entry on the group_hash context so it can
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek * outlive this request */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek hret = hash_enter(state->group_hash, &key, &value);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* No parent groups for this group in LDAP
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek * Move on to the next group
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Otherwise, recurse into the groups */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, rfc2307bis_nested_groups_done, req);
49d3f0a487d55571b2bdc9d3f8280b304b964b9dSumit Boseerrno_t rfc2307bis_nested_groups_recv(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "rfc2307bis_nested failed [%d][%s]\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)============================= */
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher struct sdap_search_base **user_search_bases;
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagherstatic errno_t sdap_get_initgr_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_user(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystruct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Retrieving info for initgroups call\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny req = tevent_req_create(memctx, &state, struct sdap_get_initgr_state);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
749cfb5d3270b5daf389d51a0dbd3fd2aec6e05dJakub Hrozek state->user_search_bases = sdom->user_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a user search base\n");
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek if (state->dom->type == DOM_TYPE_APPLICATION) {
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek search_attr = state->opts->user_map[SDAP_AT_USER_OBJECTSID].name;
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_filter_sanitize(state, state->filter_value, &clean_name);
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek search_attr = state->opts->user_map[SDAP_AT_USER_UUID].name;
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_filter_sanitize(state, state->filter_value, &clean_name);
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek if (extra_value && strcmp(extra_value, EXTRA_NAME_IS_UPN) == 0) {
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_filter_sanitize(state, state->filter_value, &clean_name);
50a7a92f92e1584702bf25e61a50cb1c09c7e260Sumit Bose ep_filter = get_enterprise_principal_string_filter(state,
50a7a92f92e1584702bf25e61a50cb1c09c7e260Sumit Bose "(&(|(%s=%s)(%s=%s)%s)(objectclass=%s)",
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek search_attr = state->opts->user_map[SDAP_AT_USER_NAME].name;
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_parse_internal_fqname(state, filter_value,
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot parse %s\n", filter_value);
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sss_filter_sanitize(state, state->shortname, &clean_name);
c88b63b2dd82f7111abc00d93fa8db2707487572Sumit Bose DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported filter type [%d].\n",
ba9ebfc49ab3bacb96213c8620411128c09f39daSumit Bose if (search_attr == NULL && state->user_base_filter == NULL) {
ba9ebfc49ab3bacb96213c8620411128c09f39daSumit Bose DEBUG(SSSDBG_OP_FAILURE, "Missing search attribute name or filter.\n");
ba9ebfc49ab3bacb96213c8620411128c09f39daSumit Bose talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)",
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek /* When mapping IDs or looking for SIDs, we don't want to limit
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek * ourselves to users with a UID value. But there must be a SID to map
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek id_ctx->opts->user_map[SDAP_AT_USER_OBJECTSID].name);
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek /* When not ID-mapping or looking up app users, make sure there
3e39806177e1cd383743ff596cb96df44a6ce8c9Jakub Hrozek * is a non-NULL UID */
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek "(&(%s=*)(!(%s=0))))",
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek id_ctx->opts->user_map[SDAP_AT_USER_UID].name);
b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose state->use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagherstatic errno_t sdap_get_initgr_next_base(struct tevent_req *req)
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state = tevent_req_data(req, struct sdap_get_initgr_state);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->filter = sdap_combine_filters(state, state->user_base_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->user_search_bases[state->user_base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for users with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->user_search_bases[state->user_base_iter]->basedn);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->user_search_bases[state->user_base_iter]->basedn,
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->user_search_bases[state->user_base_iter]->scope,
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek state->opts->user_map, state->opts->user_map_cnt,
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher tevent_req_set_callback(subreq, sdap_get_initgr_user, req);
3ee411625aee19afda7477bb10b52c3da378b6fbPetr Čechstatic int sdap_search_initgr_user_in_batch(struct sdap_get_initgr_state *state,
3ee411625aee19afda7477bb10b52c3da378b6fbPetr Čech if (sdap_object_in_domain(state->opts, users[i], state->dom) == false) {
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_user(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct tevent_req *req = tevent_req_callback_data(subreq,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_get_initgr_state *state = tevent_req_data(req,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Receiving info for the user\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &usr_attrs);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher /* No users found in this search */
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher if (state->user_search_bases[state->user_base_iter]) {
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher /* There are more search bases to try */
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce /* fallback to fetch a local user if required */
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce if ((state->opts->schema_type == SDAP_SCHEMA_RFC2307) &&
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce SDAP_RFC2307_FALLBACK_TO_LOCAL_USERS) == true)) {
c4eb21582937362e09aa34e6a18b7f33815d4940Jakub Hrozek ret = sdap_fallback_local_user(state, state->shortname, -1, &usr_attrs);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Expected one user entry and got %zu\n", count);
24d8c85fae253f988165c112af208198cf48eef6Jakub Hrozek /* When matching against a search base, it's sufficient to pick only
24d8c85fae253f988165c112af208198cf48eef6Jakub Hrozek * the first search base because all bases in a single domain would
24d8c85fae253f988165c112af208198cf48eef6Jakub Hrozek * have the same DC= components
3ee411625aee19afda7477bb10b52c3da378b6fbPetr Čech ret = sdap_search_initgr_user_in_batch(state, usr_attrs, count);
3ee411625aee19afda7477bb10b52c3da378b6fbPetr Čech "sdap_search_initgr_user_in_batch failed. "
3ee411625aee19afda7477bb10b52c3da378b6fbPetr Čech "No matching DN found.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Storing the user\n");
0bdef4fb23af3def3ca9608bb4dda46de1bd9dfbLukas Slebodnik ret = sdap_save_user(state, state->opts, state->dom, state->orig_user,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Commit change\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
9b29f86df7a29249ef8f485eedb8db515381c0deJakub Hrozek ret = sysdb_get_real_name(state, state->dom, state->filter_value, &cname);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Cannot canonicalize username\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Process user's groups\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = sdap_initgr_rfc2307_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9Jakub Hrozek if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
69994add9cd4e57d40b3b7a0b1783ef2d0aa974cPavel Reichl && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher /* Take advantage of AD's tokenGroups mechanism to look up all
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher * parent groups in a single request.
29a61bce88147872b5086278d37b1e58726032d1Pavel Březina subreq = sdap_ad_tokengroups_initgroups_send(state, state->ev,
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher } else if (state->opts->support_matching_rule
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher /* Take advantage of AD's extensibleMatch filter to look up
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher * all parent groups in a single request.
2ce00e0d3896bb42db169d1e79553a81ca837a22Simo Sorce subreq = sdap_get_ad_match_rule_initgroups_send(state, state->ev,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = sdap_initgr_nested_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bosestatic void sdap_ad_check_domain_local_groups_done(struct tevent_req *subreq);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Boseerrno_t sdap_ad_check_domain_local_groups(struct tevent_req *req)
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose struct sdap_get_initgr_state *state = tevent_req_data(req,
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose /* We only need to check for domain local groups in the AD case and if the
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * user is not from our domain, i.e. if the user comes from a sub-domain.
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose || !dp_target_enabled(state->id_ctx->be->provider, "ad", DPT_ID)) {
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose local_sdom = sdap_domain_get(state->id_ctx->opts, state->dom->parent);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose if (local_sdom == NULL || local_sdom->pvt == NULL) {
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_CRIT_FAILURE, "No ID ctx available for [%s].\n",
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sysdb_attrs_get_string(state->orig_user, SYSDB_NAME, &orig_name);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_CRIT_FAILURE, "Missing name in user object.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose sysdb_name = sss_create_internal_fqname(state, orig_name, state->dom->name);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_OP_FAILURE, "sss_create_internal_fqname failed.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sysdb_initgroups(state, state->dom, sysdb_name, &res);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_initgroups failed for user [%s].\n",
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "sysdb_initgroups returned no results for user [%s].\n",
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose /* The user object, the first entry in the res->msgs, is included as well
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * to cover the case where the remote user is directly added to
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * a domain local group. */
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sysdb_msg2attrs(state, res->count, res->msgs, &groups);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_OP_FAILURE, "sysdb_msg2attrs failed.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose subreq = sdap_ad_get_domain_local_groups_send(state, state->ev, local_sdom,
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose DEBUG(SSSDBG_OP_FAILURE, "sdap_ad_get_domain_local_groups_send failed.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose tevent_req_set_callback(subreq, sdap_ad_check_domain_local_groups_done,
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bosestatic void sdap_ad_check_domain_local_groups_done(struct tevent_req *subreq)
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose struct tevent_req *req = tevent_req_callback_data(subreq,
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose ret = sdap_ad_get_domain_local_groups_recv(subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_pgid(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct tevent_req *req = tevent_req_callback_data(subreq,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_get_initgr_state *state = tevent_req_data(req,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Initgroups done\n");
5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9Jakub Hrozek if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
69994add9cd4e57d40b3b7a0b1783ef2d0aa974cPavel Reichl && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
29a61bce88147872b5086278d37b1e58726032d1Pavel Březina ret = sdap_ad_tokengroups_initgroups_recv(subreq);
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher else if (state->opts->support_matching_rule
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher ret = sdap_get_ad_match_rule_initgroups_recv(subreq);
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher ret = sdap_initgr_rfc2307bis_recv(subreq);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Error in initgroups: [%d][%s]\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* We also need to update the user's primary group, since
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * the user may not be an explicit member of that group
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Mapping primary group to unix ID\n");
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* The primary group ID is just the RID part of the objectSID
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher * of the group. Generate the GID by adding this to the domain
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Get the user SID so we can extract the domain SID
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher tmp_ctx, opts->idmap_ctx, state->orig_user,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher opts->user_map[SDAP_AT_USER_OBJECTSID].sys_name,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Get the domain SID from the user SID */
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sdap_idmap_get_dom_sid_from_object(tmp_ctx, sid_str,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Could not parse domain SID from [%s]\n", sid_str);
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher opts->user_map[SDAP_AT_USER_PRIMARY_GROUP].sys_name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "no primary group ID provided\n");
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Add the RID to the end */
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher group_sid_str = talloc_asprintf(tmp_ctx, "%s-%lu",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher (unsigned long)primary_gid);
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Convert the SID into a UNIX group ID */
85089c1037f00c87a29f72647ece37a3b2b6481bSumit Bose ret = sdap_idmap_sid_to_unix(opts->idmap_ctx, group_sid_str,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sysdb_attrs_get_uint32_t(state->orig_user, SYSDB_GIDNUM,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Could not find user's primary GID\n");
e182d98a391b5f6d3562e442748254cdbcef0b81Sumit Bose ret = sysdb_search_group_by_gid(tmp_ctx, state->dom, primary_gid, NULL,
e182d98a391b5f6d3562e442748254cdbcef0b81Sumit Bose "Primary group already cached, nothing to do.\n");
e182d98a391b5f6d3562e442748254cdbcef0b81Sumit Bose gid = talloc_asprintf(state, "%lu", (unsigned long)primary_gid);
e182d98a391b5f6d3562e442748254cdbcef0b81Sumit Bose subreq = groups_get_send(req, state->ev, state->id_ctx,
e182d98a391b5f6d3562e442748254cdbcef0b81Sumit Bose tevent_req_set_callback(subreq, sdap_get_initgr_pgid, req);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "Checking for domain local group memberships.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "No need to check for domain local group memberships.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "sdap_ad_check_domain_local_groups failed, "
4a9c1047354dbe5a4ed41e5951ae623e3772e113René Genz "memberships to domain local groups might be missing.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose /* do not let the request fail completely because we already have at
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * least "some" groups */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_pgid(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "Checking for domain local group memberships.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "No need to check for domain local group memberships.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose "sdap_ad_check_domain_local_groups failed, "
4a9c1047354dbe5a4ed41e5951ae623e3772e113René Genz "memberships to domain local groups might be missing.\n");
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose /* do not let the request fail completely because we already have at
25699846bd1c9f8bb513b6271eb4366ab682fbd2Sumit Bose * least "some" groups */
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinastatic errno_t get_sysdb_grouplist_ex(TALLOC_CTX *mem_ctx,
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher unsigned int i;
4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek ret = sysdb_search_user_by_name(tmp_ctx, domain, name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Error searching user [%s] by name: [%s]\n",
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher groups = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher /* No groups for this user in sysdb currently */
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher sysdb_grouplist = talloc_array(tmp_ctx, char *, groups->num_values+1);
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina /* Get distinguish name */
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina sysdb_grouplist[i] = talloc_strdup(sysdb_grouplist,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina /* Get a list of the groups by groupname only */
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Could not determine group name from [%s]: [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov (const char *)groups->values[i].data, strerror(ret));
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher sysdb_grouplist[groups->num_values] = NULL;
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher *grouplist = talloc_steal(mem_ctx, sysdb_grouplist);
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinaerrno_t get_sysdb_grouplist(TALLOC_CTX *mem_ctx,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina return get_sysdb_grouplist_ex(mem_ctx, sysdb, domain,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinaerrno_t get_sysdb_grouplist_dn(TALLOC_CTX *mem_ctx,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina return get_sysdb_grouplist_ex(mem_ctx, sysdb, domain,
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidênciosdap_handle_id_collision_for_incomplete_groups(struct data_provider *dp,
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidêncio ret = sysdb_delete_group(domain, NULL, gid);
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidêncio "Due to an id collision, the new group with gid [\"%"PRIu32"\"] "
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidêncio "will not be added as the old group (with the same gid) could "
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidêncio "not be removed from the sysdb!",
a537df2ea99acb0181dc360ddf9a60b69c16faf0Fabiano Fidêncio ret = sysdb_add_incomplete_group(domain, name, gid, original_dn, sid_str,