sdap_async_initgroups.c revision 56e88cd5f3501566778b138e4934ee8e7f3fa674
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Async LDAP Helper routines - initgroups operation
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) Simo Sorce <ssorce@redhat.com> - 2009
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) 2010, Ralf Haferkamp <rhafer@suse.de>, Novell Inc.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny Copyright (C) Jan Zeleny <jzeleny@redhat.com> - 2011
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny This program is free software; you can redistribute it and/or modify
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny it under the terms of the GNU General Public License as published by
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny the Free Software Foundation; either version 3 of the License, or
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (at your option) any later version.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny This program is distributed in the hope that it will be useful,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny but WITHOUT ANY WARRANTY; without even the implied warranty of
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny GNU General Public License for more details.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny You should have received a copy of the GNU General Public License
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny along with this program. If not, see <http://www.gnu.org/licenses/>.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny/* ==Save-fake-group-list=====================================*/
d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Boseerrno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* There are no groups in LDAP but we should add user to groups ?? */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny missing = talloc_array(tmp_ctx, char *, ldap_groups_count+1);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; groupnames[i]; i++) {
15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose tmp_name = sss_get_domain_name(tmp_ctx, groupnames[i], domain);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Failed to format original name [%s]\n", groupnames[i]);
4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek ret = sysdb_search_group_by_name(tmp_ctx, domain, tmp_name, NULL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Group #%d [%s][%s] is not cached, " \
15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose "need to add a fake entry\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "search for group failed [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* All groups are cached, nothing to do */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (mi == 0) {
b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(opts->idmap_ctx,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Cannot start sysdb transaction [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; missing[i]; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* The group is not in sysdb, need to add a fake entry */
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_group_primary_name(tmp_ctx, opts, ldap_groups[ai],
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "The group has no name attribute\n");
75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose opts->group_map[SDAP_AT_GROUP_OBJECTSID].sys_name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "No SID for group [%s] " \
75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose "while id-mapping.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Mapping group [%s] objectSID to unix ID\n", groupname);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has objectSID [%s]\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Convert the SID into a UNIX group ID */
8be5e4497e5008f7807178acdfcbf97365ec4e73Stephen Gallagher ret = sdap_idmap_sid_to_unix(opts->idmap_ctx, sid_str,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has mapped gid [%lu]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] cannot be mapped. "
c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher "Treating as a non-POSIX group\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sysdb_attrs_get_uint32_t(ldap_groups[ai],
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher if (ret == ENOENT || (ret == EOK && gid == 0)) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "The group %s gid was %s\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname, ret == ENOENT ? "missing" : "zero");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Marking group %s as non-posix and setting GID=0!\n",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher } else if (ret) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The GID attribute is malformed\n");
108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no original DN\n");
56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik DEBUG((ret == ENOENT) ? SSSDBG_TRACE_ALL : SSSDBG_MINOR_FAILURE,
56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik "Failed to retrieve UUID [%d][%s].\n",
1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose "uniqueIDstr",
108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no UUID\n");
b9fbeb75e7a4f50f98d979a70a710f9221892483Lukas Slebodnik ret = sdap_check_ad_group_type(domain, opts, ldap_groups[ai],
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Adding fake group %s to sysdb\n", groupname);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_add_incomplete_group(domain, groupname, gid,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Group %s not present in LDAP\n", missing[i]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_transaction_commit failed.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
6199bd6b41e8b280e65db4b4bb17a1c5c0444aa9Stephen Gallagherint sdap_initgr_common_store(struct sysdb_ctx *sysdb,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* No groups for this user in LDAP.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * We need to ensure that there are no groups
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * in the sysdb either.
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Find the differences between the sysdb and LDAP lists
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * Groups in the sysdb only must be removed.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = diff_string_lists(tmp_ctx, ldap_grouplist, sysdb_grouplist,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Add fake entries for any groups the user should be added as
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * member of but that are not cached in sysdb
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_add_incomplete_groups(sysdb, domain, opts,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Adding incomplete users failed\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n", name);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (const char *const *) add_groups,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny (const char *const *) del_groups);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Membership update failed [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-RFC2307===================== */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny const char *name;
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagherstatic errno_t sdap_initgr_rfc2307_next_base(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_rfc2307_process(struct tevent_req *subreq);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystruct tevent_req *sdap_initgr_rfc2307_send(TALLOC_CTX *memctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny const char *name)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_create(memctx, &state, struct sdap_initgr_rfc2307_state);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
749cfb5d3270b5daf389d51a0dbd3fd2aec6e05dJakub Hrozek state->search_bases = opts->sdom->group_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a group search base\n");
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, opts->group_map, SDAP_OPTS_GROUP,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sss_filter_sanitize(state, name, &clean_name);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->base_filter = talloc_asprintf(state,
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek "(&(%s=%s)(%s)(%s=*)(&(%s=*)(!(%s=0))))",
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagherstatic errno_t sdap_initgr_rfc2307_next_base(struct tevent_req *req)
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state = tevent_req_data(req, struct sdap_initgr_rfc2307_state);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->filter = sdap_get_id_specific_filter(
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for groups with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->search_bases[state->base_iter]->basedn);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->search_bases[state->base_iter]->basedn,
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->search_bases[state->base_iter]->scope,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307_process, req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_rfc2307_process(struct tevent_req *subreq)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state = tevent_req_data(req, struct sdap_initgr_rfc2307_state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &ldap_groups);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Add this batch of groups to the list */
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Copy the new groups into the list.
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher for (i = 0; i < count; i++) {
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek state->ldap_groups[state->ldap_groups_count + i] =
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek talloc_steal(state->ldap_groups, ldap_groups[i]);
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher state->ldap_groups[state->ldap_groups_count] = NULL;
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher /* Check for additional search bases, and iterate
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher * through again.
38e1ee5d65ade946f1322efa96f69c05e041c57fStephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Search for all groups for which this user is a member */
2ce00e0d3896bb42db169d1e79553a81ca837a22Simo Sorce ret = get_sysdb_grouplist(state, state->sysdb, state->domain,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* There are no nested groups here so we can just update the
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * memberships */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_rfc2307_recv(struct tevent_req *req)
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek/* ==Common code for pure RFC2307bis and IPA/AD========================= */
c88e387d10104774852d54355fc17ad41761776aJakub Hrozeksdap_nested_groups_store(struct sysdb_ctx *sysdb,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek unsigned long count)
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek ret = sysdb_attrs_primary_name_list(sysdb, tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_add_incomplete_groups(sysdb, domain, opts, groupnamelist,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Could not add incomplete groups [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek const char *name;
c88e387d10104774852d54355fc17ad41761776aJakub Hrozekbuild_membership_diff(TALLOC_CTX *mem_ctx, const char *name,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek char **ldap_parent_names, char **sysdb_parent_names,
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek mdiff = talloc_zero(tmp_ctx, struct membership_diff);
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek /* Find the differences between the sysdb and ldap lists
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek * Groups in ldap only must be added to the sysdb;
c88e387d10104774852d54355fc17ad41761776aJakub Hrozek * groups in the sysdb only must be removed.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-nested-groups=============== */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny const char **grp_attrs;
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_deref_search(struct tevent_req *req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_noderef_search(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_search(struct tevent_req *subreq);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_store(struct tevent_req *req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_create(memctx, &state, struct sdap_initgr_nested_state);
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_user_primary_name(memctx, opts, user, dom, &state->username);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "User entry had no username\n");
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek ret = sysdb_attrs_get_el(state->user, SYSDB_MEMBEROF, &state->memberof);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (ret || !state->memberof || state->memberof->num_values == 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CONF_SETTINGS, "User entry lacks original memberof ?\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* We can't find any groups for this user, so we'll
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * have to assume there aren't any. Just return
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * success here.
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state->groups = talloc_zero_array(state, struct sysdb_attrs *,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek deref_threshold = dp_opt_get_int(state->opts->basic,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (sdap_has_deref_support(state->sh, state->opts) &&
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek deref_threshold < state->memberof->num_values) {
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek ret = sysdb_attrs_get_string(user, SYSDB_ORIG_DN,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_noderef_search(struct tevent_req *req)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek for (i = 0; i < state->memberof->num_values; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state->group_dns[i] = talloc_strdup(state->group_dns,
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, state->opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek state->filter = talloc_asprintf(state, "(&(%s)(%s=*))", oc_list,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state->opts->group_map[SDAP_AT_GROUP_NAME].name);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_nested_search, req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic void sdap_initgr_nested_deref_done(struct tevent_req *subreq);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic errno_t sdap_initgr_nested_deref_search(struct tevent_req *req)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek maps = talloc_array(state, struct sdap_attr_map_info, num_maps+1);
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, state->opts->group_map, SDAP_OPTS_GROUP,
f393e23f264a299868a12bec40a390a7ecd65d10Stephen Gallagher timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek subreq = sdap_deref_search_send(state, state->ev, state->opts,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state->opts->user_map[SDAP_AT_USER_MEMBEROF].name,
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek tevent_req_set_callback(subreq, sdap_initgr_nested_deref_done, req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozekstatic void sdap_initgr_nested_deref_done(struct tevent_req *subreq)
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek req = tevent_req_callback_data(subreq, struct tevent_req);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek } else if (ret == ENOENT || deref_result == NULL) {
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek /* Nothing could be dereferenced. Done. */
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek for (i=0; i < num_results; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_search(struct tevent_req *subreq)
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny state = tevent_req_data(req, struct sdap_initgr_nested_state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &groups);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state->groups[state->groups_cur] = talloc_steal(state->groups,
a75266b247510719f7879f876809a1b03c31a3deJakub Hrozek "Search for group %s, returned %zu results. Skipping\n",
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek /* note that state->memberof->num_values is the count of original
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek * memberOf which might not be only groups, but permissions, etc.
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek * Use state->groups_cur for group index cap */
f46b9fd64ef09aae23220c5adb2fe4d3e4adc553Jakub Hrozek if (state->cur < state->memberof->num_values) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tevent_req_set_callback(subreq, sdap_initgr_nested_search, req);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_groups(struct sdap_initgr_nested_state *state);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_group_memberships(struct sdap_initgr_nested_state *state);
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_user_memberships(struct sdap_initgr_nested_state *state);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic void sdap_initgr_nested_store(struct tevent_req *req)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state = tevent_req_data(req, struct sdap_initgr_nested_state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the groups if they are not already */
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Could not save groups [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the group memberships */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_store_group_memberships(state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not save group memberships [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* save the user memberships */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_store_user_memberships(state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not save user memberships [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_groups(struct sdap_initgr_nested_state *state)
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce return sdap_nested_groups_store(state->sysdb, state->dom,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_nested_get_membership_diff(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozekstatic int sdap_initgr_nested_get_direct_parents(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_group_memberships(struct sdap_initgr_nested_state *state)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Compute the diffs first in order to keep the transaction as small
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek * as possible
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_nested_get_membership_diff(tmp_ctx, state->sysdb,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not compute memberships for group %d [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, miter->name,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Failed to update memberships\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_store_user_memberships(struct sdap_initgr_nested_state *state)
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Get direct LDAP parents */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_get_string(state->user, SYSDB_ORIG_DN, &orig_dn);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "The user has no original DN\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ldap_parentlist = talloc_zero_array(tmp_ctx, struct sysdb_attrs *,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_get_el(state->groups[i], SYSDB_MEMBER, &el);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "A group with no members during initgroups?\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek if (strcasecmp((const char *) el->values[mi].data, orig_dn) != 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The user %s is a direct member of %d LDAP groups\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_primary_name_list(state->sysdb, tmp_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek state->opts->group_map[SDAP_AT_GROUP_NAME].name,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
b3292840ebaa747a9fd596ff47cc5d18198361d0Michal Zidek ret = sysdb_get_direct_parents(tmp_ctx, state->dom, SYSDB_MEMBER_USER,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Updating memberships for %s\n", state->username);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, state->username, SYSDB_MEMBER_USER,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek (const char *const *) add_groups,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek (const char *const *) del_groups);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not update sysdb memberships for %s: %d [%s]\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozeksdap_initgr_nested_get_membership_diff(TALLOC_CTX *mem_ctx,
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* Get direct sysdb parents */
bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_group_primary_name(tmp_ctx, opts, group, dom, &group_name);
b3292840ebaa747a9fd596ff47cc5d18198361d0Michal Zidek ret = sysdb_get_direct_parents(tmp_ctx, dom, SYSDB_MEMBER_GROUP,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek /* For each group, filter only parents from full set */
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sdap_initgr_nested_get_direct_parents(tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Cannot get parent groups for %s [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The group %s is a direct member of %d LDAP groups\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = sysdb_attrs_primary_name_list(sysdb, tmp_ctx,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "sysdb_attrs_primary_name_list failed [%d]: %s\n",
707ddc7de4d43a96a372880c50cb20b9672c9cdfJakub Hrozek ret = build_membership_diff(tmp_ctx, group_name, ldap_parent_names_list,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not build membership diff for %s [%d]: %s\n",
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_nested_get_direct_parents(TALLOC_CTX *mem_ctx,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny direct_groups = talloc_zero_array(tmp_ctx, struct sysdb_attrs *,
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sysdb_attrs_get_string(attrs, SYSDB_ORIG_DN, &orig_dn);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Missing originalDN\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Looking up direct parents for group [%s]\n", orig_dn);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* FIXME - Filter only parents from full set to avoid searching
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * through all members of huge groups. That requires asking for memberOf
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny * with the group LDAP search
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* Filter only direct parents from the list of all groups */
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; i < ngroups; i++) {
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sysdb_attrs_get_el(groups[i], SYSDB_MEMBER, &member);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "A group with no members during initgroups?\n");
f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (strcasecmp((const char *) member->values[mi].data, orig_dn) != 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The group [%s] has %d direct parents\n", orig_dn, ndirect);
d3bdb23bec3432591acb1135a108ee9bdd5f87e0Jakub Hrozek *_direct_parents = talloc_steal(mem_ctx, direct_groups);
f26c954658dfd7461f290f0b5d924951a6db219aJan Zelenystatic int sdap_initgr_nested_recv(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)-RFC2307-BIS================= */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek const char *name;
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t sdap_initgr_rfc2307bis_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_process(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_options *opts, struct sysdb_ctx *sysdb,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sss_domain_info *dom, struct sdap_handle *sh,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_recv(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic struct tevent_req *sdap_initgr_rfc2307bis_send(
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny const char *name,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek req = tevent_req_create(memctx, &state, struct sdap_initgr_rfc2307bis_state);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
1b870ffa7910879f9310db453a31ab6f06392b9bJakub Hrozek state->search_bases = sdom->group_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a group search base\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = sss_hash_create(state, 32, &state->group_hash);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, opts->group_map, SDAP_OPTS_GROUP,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sss_filter_sanitize(state, orig_dn, &clean_orig_dn);
1b870ffa7910879f9310db453a31ab6f06392b9bJakub Hrozek use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek "(&(%s=%s)(%s)(%s=*)",
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher opts->group_map[SDAP_AT_GROUP_MEMBER].name,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher opts->group_map[SDAP_AT_GROUP_NAME].name);
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek /* When mapping IDs or looking for SIDs, we don't want to limit
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek * ourselves to groups with a GID value. But there must be a SID to map
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->base_filter = talloc_asprintf_append(state->base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek opts->group_map[SDAP_AT_GROUP_OBJECTSID].name);
981bf55532fbec91a106f82d7daf32094c76dfe0Pavel Reichl state->base_filter = talloc_asprintf_append(state->base_filter, ")");
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sdap_initgr_rfc2307bis_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t sdap_initgr_rfc2307bis_next_base(struct tevent_req *req)
fd21ca460115a5d51d0db6e5ac759b8aff51ab99Jakub Hrozek state = tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->filter = sdap_get_id_specific_filter(
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for parent groups for user [%s] with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->orig_dn, state->search_bases[state->base_iter]->basedn);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->basedn,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->scope,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307bis_process, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_process(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny req = tevent_req_callback_data(subreq, struct tevent_req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek state = tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Found %zu parent groups for user [%s]\n", count, state->name);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Add this batch of groups to the list */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Copy the new groups into the list.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher for (i = 0; i < count; i++) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->direct_groups[state->num_direct_parents + i] =
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek talloc_steal(state->direct_groups, ldap_groups[i]);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->direct_groups[state->num_direct_parents] = NULL;
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Check for additional search bases, and iterate
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher * through again.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sdap_initgr_rfc2307bis_next_base(req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Start a transaction to look up the groups in the sysdb
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * and update them with LDAP data
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = rfc2307bis_nested_groups_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_initgr_rfc2307bis_done, req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_groups(struct sdap_initgr_rfc2307bis_state *state);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_group_memberships(struct sdap_initgr_rfc2307bis_state *state);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_initgr_rfc2307bis_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek tevent_req_data(req, struct sdap_initgr_rfc2307bis_state);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* save the groups if they are not cached */
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save groups memberships [%d]\n", ret);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* save the group membership */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = save_rfc2307bis_group_memberships(state);
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save group memberships [%d]\n", ret);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* save the user memberships */
87f8bee53ee1b4ca87b602ff8536bc5fd5b5b595Lukas Slebodnik "Could not save user memberships [%d]\n", ret);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic int sdap_initgr_rfc2307bis_recv(struct tevent_req *req)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_groups(struct sdap_initgr_rfc2307bis_state *state)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek unsigned long count;
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek hret = hash_values(state->group_hash, &count, &values);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek groups = talloc_array(tmp_ctx, struct sysdb_attrs *, count);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek for (i = 0; i < count; i++) {
b23539e420b9962ad3bfd8f305b9d5acf47e7efbSimo Sorce ret = sdap_nested_groups_store(state->sysdb, state->dom, state->opts,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Could not save groups [%d]: %s\n",
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozekstatic bool rfc2307bis_group_memberships_build(hash_entry_t *item, void *user_data);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozeksave_rfc2307bis_group_memberships(struct sdap_initgr_rfc2307bis_state *state)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek struct rfc2307bis_group_memberships_state *membership_state;
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek membership_state->group_hash = state->group_hash;
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek DLIST_FOR_EACH(iter, membership_state->memberships) {
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek /* Create a copy of iter->add array but do not include groups outside
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek * nesting limit. This array must be NULL terminated.
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek for (grp_count = 0; iter->add[grp_count]; grp_count++);
1a54e022351a60fbfa619ef7ed6138fb892ad11aJakub Hrozek add = talloc_zero_array(tmp_ctx, char *, grp_count + 1);
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek for (i = 0; i < grp_count; i++) {
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, iter->name,
fb5abb2a7abf63974d8db444c66f50a2dd74901fMichal Zidek (const char *const *) add,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Failed to update memberships\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozekrfc2307bis_group_memberships_build(hash_entry_t *item, void *user_data)
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek struct rfc2307bis_group_memberships_state *mstate = talloc_get_type(
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek user_data, struct rfc2307bis_group_memberships_state);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek group = (struct sdap_nested_group *) item->value.ptr;
b3292840ebaa747a9fd596ff47cc5d18198361d0Michal Zidek ret = sysdb_get_direct_parents(tmp_ctx, mstate->dom, SYSDB_MEMBER_GROUP,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = sysdb_attrs_primary_name_list(mstate->sysdb, tmp_ctx,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek mstate->opts->group_map[SDAP_AT_GROUP_NAME].name,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek ret = build_membership_diff(tmp_ctx, group_name, ldap_parents_names_list,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not build membership diff for %s [%d]: %s\n",
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Save parent groups to sysdb\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
b3292840ebaa747a9fd596ff47cc5d18198361d0Michal Zidek ret = sysdb_get_direct_parents(tmp_ctx, state->dom, SYSDB_MEMBER_USER,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Could not get direct sysdb parents for %s: %d [%s]\n",
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek state->direct_groups, state->num_direct_parents,
fd04fbbf93d33db729404cdc4408f59226025ea6Sumit Bose tmp_str = sss_tc_fqname(ldap_grouplist, state->dom->names,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sss_tc_fqname failed.\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Find the differences between the sysdb and ldap lists
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * Groups in ldap only must be added to the sysdb;
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * groups in the sysdb only must be removed.
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Updating memberships for %s\n", state->name);
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_update_members(state->dom, state->name, SYSDB_MEMBER_USER,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny (const char *const *)add_groups,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny (const char *const *)del_groups);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_step(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_options *opts, struct sysdb_ctx *sysdb,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sss_domain_info *dom, struct sdap_handle *sh,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "About to process %zu groups in nesting level %zu\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny if ((num_groups == 0) ||
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny (nesting > dp_opt_get_int(opts->basic, SDAP_NESTING_LEVEL))) {
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* No parent groups to process or too deep*/
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups nested lookup request "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "without a group search base\n");
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek while (state->group_iter < state->num_groups) {
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek /* This group had already been looked up. Continue to
9356e8f50436724e985d9a8f5d4f2bc0f5b837bcJakub Hrozek * another group in the same level
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* All parent groups were already processed */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* EAGAIN means a lookup is in progress */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t rfc2307bis_nested_groups_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_process(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
9615f4c3c6f6dcc50ee7d4e50020549a2ff720c0Sumit Bose ret = sdap_get_group_primary_name(state, state->opts,
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek key.str = talloc_strdup(state, state->primary_name);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Processing group [%s]\n", state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek ret = hash_lookup(state->group_hash, &key, &value);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Group [%s] was already processed, "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "taking a shortcut\n", state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_get_type(value.ptr, struct sdap_nested_group);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Need to try to find parent groups for this group. */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_zero(state->processed_groups, struct sdap_nested_group);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek if (!state->processed_groups[state->group_iter]) {
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* this steal doesn't change much now, but will be helpful later on
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek * if we steal the whole processed_group on the hash table */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek state->processed_groups[state->group_iter]->group =
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_steal(state->processed_groups[state->group_iter],
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Get any parent groups for this group */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sysdb_attrs_get_string(state->groups[state->group_iter],
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter = talloc_array(state, const char *, 2);
6b81b6ada1010e65b447fc74453e236fb8791813Jan Zeleny attr_filter[0] = state->opts->group_map[SDAP_AT_GROUP_MEMBER].name;
64ddff90c7fcc02ccb06824ac93af7d5f361a88fJan Zeleny ret = build_attrs_from_map(state, state->opts->group_map, SDAP_OPTS_GROUP,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = sss_filter_sanitize(tmp_ctx, state->orig_dn, &clean_orig_dn);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek oc_list = sdap_make_oc_list(state, state->opts->group_map);
7ba70236daccb48432350147d0560b3302518ceeMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny state->opts->group_map[SDAP_AT_GROUP_MEMBER].name,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny state->opts->group_map[SDAP_AT_GROUP_NAME].name);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = rfc2307bis_nested_groups_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Still processing parent groups */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagherstatic errno_t rfc2307bis_nested_groups_next_base(struct tevent_req *req)
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state = tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->filter = sdap_get_id_specific_filter(
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for parent groups of group [%s] with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->search_bases[state->base_iter]->basedn);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->basedn,
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher state->search_bases[state->base_iter]->scope,
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichlrfc2307bis_nested_groups_iterate(struct tevent_req *req,
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl while (state->group_iter < state->num_groups) {
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* Looking up parent groups.. */
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* EOK means this group has already been processed
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl * in another nesting level */
b53f1e74acee48c5f22f7532829e1934c68d4637Pavel Reichl /* All groups processed. Done. */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_process(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Found %zu parent groups of [%s]\n", count, state->orig_dn);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek ngr = state->processed_groups[state->group_iter];
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Add this batch of groups to the list */
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Copy the new groups into the list.
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * They're allocated on 'state' so we need to move them
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * onto ldap_parents so that the data won't disappear when
3a0522759a7e71b40cc88dba0f5c545b049cf9bfJakub Hrozek * we finish this nesting level.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher for (i = 0; i < count; i++) {
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek talloc_steal(ngr->ldap_parents, ldap_groups[i]);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Total of %zu direct parents after this iteration\n",
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Check for additional search bases, and iterate
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher * through again.
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher if (state->search_bases[state->base_iter] != NULL) {
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher ret = rfc2307bis_nested_groups_next_base(req);
9fcfe80902655f495b7258218fc8114aa5d2c023Stephen Gallagher /* Reset the base iterator for future lookups */
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Save the group into the hash table */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek key.str = talloc_strdup(state, state->primary_name);
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek /* Steal the nested group entry on the group_hash context so it can
1c386aa2c11d1bdbb3f42f722ec4599ce9f278c8Jakub Hrozek * outlive this request */
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek hret = hash_enter(state->group_hash, &key, &value);
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek /* No parent groups for this group in LDAP
95470076a26745f65d087be7cdf79c0373df21caJakub Hrozek * Move on to the next group
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* Otherwise, recurse into the groups */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, rfc2307bis_nested_groups_done, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic errno_t rfc2307bis_nested_groups_recv(struct tevent_req *req)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void rfc2307bis_nested_groups_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_data(req, struct sdap_rfc2307bis_nested_ctx);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "rfc2307bis_nested failed [%d][%s]\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny/* ==Initgr-call-(groups-a-user-is-member-of)============================= */
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny const char *name;
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny const char **grp_attrs;
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher struct sdap_search_base **user_search_bases;
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagherstatic errno_t sdap_get_initgr_next_base(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_user(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_done(struct tevent_req *subreq);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystruct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny const char *name,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Retrieving info for initgroups call\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny req = tevent_req_create(memctx, &state, struct sdap_get_initgr_state);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
749cfb5d3270b5daf389d51a0dbd3fd2aec6e05dJakub Hrozek state->user_search_bases = sdom->user_search_bases;
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Initgroups lookup request without a user search base\n");
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sss_filter_sanitize(state, name, &clean_name);
25a387c2e90c74b27a26ea207503df8e4b6a1a76Sumit Bose if (extra_value && strcmp(extra_value, EXTRA_NAME_IS_UPN) == 0) {
25a387c2e90c74b27a26ea207503df8e4b6a1a76Sumit Bose search_attr = state->opts->user_map[SDAP_AT_USER_PRINC].name;
0f9c28eb52d2b45c8a97f709308dc11377831b8cSumit Bose search_attr = state->opts->user_map[SDAP_AT_USER_OBJECTSID].name;
0f9c28eb52d2b45c8a97f709308dc11377831b8cSumit Bose search_attr = state->opts->user_map[SDAP_AT_USER_UUID].name;
0f9c28eb52d2b45c8a97f709308dc11377831b8cSumit Bose search_attr = state->opts->user_map[SDAP_AT_USER_NAME].name;
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)",
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->opts->user_map[SDAP_OC_USER].name);
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek /* When mapping IDs or looking for SIDs, we don't want to limit
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek * ourselves to users with a UID value. But there must be a SID to map
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek id_ctx->opts->user_map[SDAP_AT_USER_OBJECTSID].name);
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek /* When not ID-mapping, make sure there is a non-NULL UID */
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek state->user_base_filter = talloc_asprintf_append(state->user_base_filter,
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek "(&(%s=*)(!(%s=0))))",
d3e1d88ce7de3216a862b9fe78dc5aa94dcbc14bJakub Hrozek id_ctx->opts->user_map[SDAP_AT_USER_UID].name);
b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose state->use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagherstatic errno_t sdap_get_initgr_next_base(struct tevent_req *req)
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state = tevent_req_data(req, struct sdap_get_initgr_state);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->filter = sdap_get_id_specific_filter(
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->user_search_bases[state->user_base_iter]->filter);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Searching for users with base [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->user_search_bases[state->user_base_iter]->basedn);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->user_search_bases[state->user_base_iter]->basedn,
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher state->user_search_bases[state->user_base_iter]->scope,
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek state->opts->user_map, state->opts->user_map_cnt,
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher tevent_req_set_callback(subreq, sdap_get_initgr_user, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_user(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct tevent_req *req = tevent_req_callback_data(subreq,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_get_initgr_state *state = tevent_req_data(req,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Receiving info for the user\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny ret = sdap_get_generic_recv(subreq, state, &count, &usr_attrs);
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher /* No users found in this search */
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher if (state->user_search_bases[state->user_base_iter]) {
14742d2cf50774ffd94b37a398238e4ce0e4a740Stephen Gallagher /* There are more search bases to try */
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce /* fallback to fetch a local user if required */
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce if ((state->opts->schema_type == SDAP_SCHEMA_RFC2307) &&
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce SDAP_RFC2307_FALLBACK_TO_LOCAL_USERS) == true)) {
fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce ret = sdap_fallback_local_user(state, state->opts,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Expected one user entry and got %zu\n", count);
008e1ee835602023891ac45408483d87f41e4d5cSumit Bose ret = domain_to_basedn(state, state->dom->name, &expected_basedn);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "domain_to_basedn failed.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "talloc_append failed.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Expected BaseDN is [%s].\n", expected_basedn);
008e1ee835602023891ac45408483d87f41e4d5cSumit Bose for (c = 0; c < count; c++) {
008e1ee835602023891ac45408483d87f41e4d5cSumit Bose ret = sysdb_attrs_get_string(usr_attrs[c], SYSDB_ORIG_DN, &orig_dn);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n");
008e1ee835602023891ac45408483d87f41e4d5cSumit Bose && strcasecmp(orig_dn + (dn_len - expected_basedn_len),
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "No matching DN found.\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to start transaction\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Storing the user\n");
0bdef4fb23af3def3ca9608bb4dda46de1bd9dfbLukas Slebodnik ret = sdap_save_user(state, state->opts, state->dom, state->orig_user,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Commit change\n");
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to commit transaction\n");
e2ac9be4f293b96f3c8992f1171e44bc1da5cfcaMichal Zidek ret = sysdb_get_real_name(state, state->dom, state->name, &cname);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_OP_FAILURE, "Cannot canonicalize username\n");
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Process user's groups\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = sdap_initgr_rfc2307_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9Jakub Hrozek if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
69994add9cd4e57d40b3b7a0b1783ef2d0aa974cPavel Reichl && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher /* Take advantage of AD's tokenGroups mechanism to look up all
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher * parent groups in a single request.
29a61bce88147872b5086278d37b1e58726032d1Pavel Březina subreq = sdap_ad_tokengroups_initgroups_send(state, state->ev,
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher } else if (state->opts->support_matching_rule
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher /* Take advantage of AD's extensibleMatch filter to look up
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher * all parent groups in a single request.
2ce00e0d3896bb42db169d1e79553a81ca837a22Simo Sorce subreq = sdap_get_ad_match_rule_initgroups_send(state, state->ev,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny subreq = sdap_initgr_nested_send(state, state->ev, state->opts,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_done, req);
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Failed to cancel transaction\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_pgid(struct tevent_req *req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_done(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct tevent_req *req = tevent_req_callback_data(subreq,
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny struct sdap_get_initgr_state *state = tevent_req_data(req,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Initgroups done\n");
5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9Jakub Hrozek if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003
69994add9cd4e57d40b3b7a0b1783ef2d0aa974cPavel Reichl && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
29a61bce88147872b5086278d37b1e58726032d1Pavel Březina ret = sdap_ad_tokengroups_initgroups_recv(subreq);
d0e0e73e86f2afdb7f8fefbed70fda8d77b1c25aStephen Gallagher else if (state->opts->support_matching_rule
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher ret = sdap_get_ad_match_rule_initgroups_recv(subreq);
d42d371c00c83ae44b9d1c3e88ecbe0e01b112e6Stephen Gallagher ret = sdap_initgr_rfc2307bis_recv(subreq);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_ALL, "Error in initgroups: [%d][%s]\n",
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny /* We also need to update the user's primary group, since
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny * the user may not be an explicit member of that group
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Mapping primary group to unix ID\n");
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* The primary group ID is just the RID part of the objectSID
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher * of the group. Generate the GID by adding this to the domain
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Get the user SID so we can extract the domain SID
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher tmp_ctx, opts->idmap_ctx, state->orig_user,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher opts->user_map[SDAP_AT_USER_OBJECTSID].sys_name,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Get the domain SID from the user SID */
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sdap_idmap_get_dom_sid_from_object(tmp_ctx, sid_str,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Could not parse domain SID from [%s]\n", sid_str);
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher opts->user_map[SDAP_AT_USER_PRIMARY_GROUP].sys_name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "no primary group ID provided\n");
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Add the RID to the end */
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher group_sid_str = talloc_asprintf(tmp_ctx, "%s-%lu",
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher (unsigned long)primary_gid);
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Convert the SID into a UNIX group ID */
85089c1037f00c87a29f72647ece37a3b2b6481bSumit Bose ret = sdap_idmap_sid_to_unix(opts->idmap_ctx, group_sid_str,
58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sysdb_attrs_get_uint32_t(state->orig_user, SYSDB_GIDNUM,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Could not find user's primary GID\n");
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny gid = talloc_asprintf(state, "%lu", (unsigned long)primary_gid);
749cfb5d3270b5daf389d51a0dbd3fd2aec6e05dJakub Hrozek subreq = groups_get_send(req, state->ev, state->id_ctx,
d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose gid, BE_FILTER_IDNUM, BE_ATTR_ALL, false, false);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_set_callback(subreq, sdap_get_initgr_pgid, req);
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zelenystatic void sdap_get_initgr_pgid(struct tevent_req *subreq)
9091fdea936f7d21584682b7f3d58f49b1e7b013Jan Zeleny tevent_req_callback_data(subreq, struct tevent_req);
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinastatic errno_t get_sysdb_grouplist_ex(TALLOC_CTX *mem_ctx,
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher unsigned int i;
4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek ret = sysdb_search_user_by_name(tmp_ctx, domain, name,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Error searching user [%s] by name: [%s]\n",
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher groups = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher /* No groups for this user in sysdb currently */
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher sysdb_grouplist = talloc_array(tmp_ctx, char *, groups->num_values+1);
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina /* Get distinguish name */
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina sysdb_grouplist[i] = talloc_strdup(sysdb_grouplist,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina /* Get a list of the groups by groupname only */
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Could not determine group name from [%s]: [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov (const char *)groups->values[i].data, strerror(ret));
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher sysdb_grouplist[groups->num_values] = NULL;
1ed3a0d1d98ae410fcd716ec5c7202de2c082597Stephen Gallagher *grouplist = talloc_steal(mem_ctx, sysdb_grouplist);
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinaerrno_t get_sysdb_grouplist(TALLOC_CTX *mem_ctx,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březina return get_sysdb_grouplist_ex(mem_ctx, sysdb, domain,
9cc66028cb6e497588a088ff2953e2ca7ed6ca6dPavel Březinaerrno_t get_sysdb_grouplist_dn(TALLOC_CTX *mem_ctx,