f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny#include "util/util.h"

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny#include "db/sysdb.h"

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny#include "providers/ldap/sdap_async_private.h"

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny#include "providers/ldap/ldap_common.h"

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher#include "providers/ldap/sdap_idmap.h"

fae99bfe4bfc8b4a12e9c2a0ad01b3684c22f934Simo Sorce#include "providers/ldap/sdap_users.h"

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Boseerrno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose struct sss_domain_info *domain,

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose struct sdap_options *opts,

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose char **groupnames,

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose struct sysdb_attrs **ldap_groups,

d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1Sumit Bose int ldap_groups_count)

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny{

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny TALLOC_CTX *tmp_ctx;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny struct ldb_message *msg;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny int i, mi, ai;

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek const char *groupname;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny const char *original_dn;

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek const char *uuid = NULL;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny char **missing;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny gid_t gid;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny int ret;

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek errno_t sret;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny bool in_transaction = false;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny bool posix;

684d1b48b5582a1bf7812b8c3c663592dc6dfed9Pavel Březina time_t now;

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose char *sid_str = NULL;

b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose bool use_id_mapping;

b9fbeb75e7a4f50f98d979a70a710f9221892483Lukas Slebodnik bool need_filter;

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose char *tmp_name;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* There are no groups in LDAP but we should add user to groups ?? */

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (ldap_groups_count == 0) return EOK;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny tmp_ctx = talloc_new(NULL);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (!tmp_ctx) return ENOMEM;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny missing = talloc_array(tmp_ctx, char *, ldap_groups_count+1);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (!missing) {

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = ENOMEM;

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek goto done;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny mi = 0;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; groupnames[i]; i++) {

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose tmp_name = sss_get_domain_name(tmp_ctx, groupnames[i], domain);

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose if (tmp_name == NULL) {

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose DEBUG(SSSDBG_OP_FAILURE,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Failed to format original name [%s]\n", groupnames[i]);

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose ret = ENOMEM;

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose goto done;

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose }

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose

4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek ret = sysdb_search_group_by_name(tmp_ctx, domain, tmp_name, NULL,

4c08db0fb0dda3d27b1184248ca5c800d7ce23f0Michal Zidek &msg);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (ret == EOK) {

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny continue;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny } else if (ret == ENOENT) {

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose missing[mi] = talloc_steal(missing, tmp_name);

83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "Group #%d [%s][%s] is not cached, " \

15b5d885e28afcd6c3c19f900eea2a8e00c3e6d3Sumit Bose "need to add a fake entry\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov i, groupnames[i], missing[mi]);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny mi++;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny continue;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny } else if (ret != ENOENT) {

83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "search for group failed [%d]: %s\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek goto done;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny missing[mi] = NULL;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* All groups are cached, nothing to do */

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (mi == 0) {

326f4fc3125e155ee2d484fe921aafddd6b5a49dPavel Březina ret = EOK;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny goto done;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose use_id_mapping = sdap_idmap_domain_has_algorithmic_mapping(opts->idmap_ctx,

fdda4b659fa3be3027df91a2b053835186ec2c59Sumit Bose domain->name,

b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose domain->domain_id);

b56b06e199f15a8a840b36bc7cb8010e39ae761dSumit Bose

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek ret = sysdb_transaction_start(sysdb);

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek if (ret != EOK) {

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek DEBUG(SSSDBG_CRIT_FAILURE,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Cannot start sysdb transaction [%d]: %s\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret, strerror(ret));

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek goto done;

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek }

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek in_transaction = true;

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek

684d1b48b5582a1bf7812b8c3c663592dc6dfed9Pavel Březina now = time(NULL);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (i=0; missing[i]; i++) {

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny /* The group is not in sysdb, need to add a fake entry */

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny for (ai=0; ai < ldap_groups_count; ai++) {

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek ret = sdap_get_group_primary_name(tmp_ctx, opts, ldap_groups[ai],

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek domain, &groupname);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (ret != EOK) {

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "The group has no name attribute\n");

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek goto done;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek if (strcmp(groupname, missing[i]) == 0) {

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny posix = true;

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose ret = sdap_attrs_get_sid_str(

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose tmp_ctx, opts->idmap_ctx, ldap_groups[ai],

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose opts->group_map[SDAP_AT_GROUP_OBJECTSID].sys_name,

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose &sid_str);

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose if (ret != EOK && ret != ENOENT) goto done;

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher if (use_id_mapping) {

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose if (sid_str == NULL) {

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "No SID for group [%s] " \

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose "while id-mapping.\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname);

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose ret = EINVAL;

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose goto done;

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose }

75dd4b05e1dacc76dc9d5f16be31978f84a71dc5Sumit Bose

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher DEBUG(SSSDBG_TRACE_LIBS,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Mapping group [%s] objectSID to unix ID\n", groupname);

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher DEBUG(SSSDBG_TRACE_INTERNAL,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has objectSID [%s]\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname, sid_str);

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher /* Convert the SID into a UNIX group ID */

8be5e4497e5008f7807178acdfcbf97365ec4e73Stephen Gallagher ret = sdap_idmap_sid_to_unix(opts->idmap_ctx, sid_str,

8be5e4497e5008f7807178acdfcbf97365ec4e73Stephen Gallagher &gid);

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher if (ret == EOK) {

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher DEBUG(SSSDBG_TRACE_INTERNAL,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] has mapped gid [%lu]\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname, (unsigned long)gid);

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher } else {

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher posix = false;

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher gid = 0;

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher DEBUG(SSSDBG_TRACE_INTERNAL,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Group [%s] cannot be mapped. "

c20a339d54b39120b4051f690ca759e6d079f177Stephen Gallagher "Treating as a non-POSIX group\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname);

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher }

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher } else {

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher ret = sysdb_attrs_get_uint32_t(ldap_groups[ai],

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher SYSDB_GIDNUM,

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher &gid);

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher if (ret == ENOENT || (ret == EOK && gid == 0)) {

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS, "The group %s gid was %s\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname, ret == ENOENT ? "missing" : "zero");

bfd59d1a2d0d45125e5164ef12c425690d519f61Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Marking group %s as non-posix and setting GID=0!\n",

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov groupname);

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher gid = 0;

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher posix = false;

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher } else if (ret) {

83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE,

83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "The GID attribute is malformed\n");

21d485184df986e1a123f70c689517386e51a5ceMichal Zidek goto done;

58d02e0d3d6d48c97fccdb2ad7212e065671ad6dStephen Gallagher }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny ret = sysdb_attrs_get_string(ldap_groups[ai],

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny SYSDB_ORIG_DN,

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny &original_dn);

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny if (ret) {

83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_FUNC_DATA,

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no original DN\n");

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny original_dn = NULL;

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny }

f26c954658dfd7461f290f0b5d924951a6db219aJan Zeleny

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose ret = sysdb_handle_original_uuid(

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose opts->group_map[SDAP_AT_GROUP_UUID].def_name,

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose ldap_groups[ai],

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose opts->group_map[SDAP_AT_GROUP_UUID].sys_name,

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose ldap_groups[ai], "uniqueIDstr");

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik if (ret != EOK) {

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik DEBUG((ret == ENOENT) ? SSSDBG_TRACE_ALL : SSSDBG_MINOR_FAILURE,

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik "Failed to retrieve UUID [%d][%s].\n",

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik ret, sss_strerror(ret));

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik }

56e88cd5f3501566778b138e4934ee8e7f3fa674Lukas Slebodnik

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek ret = sysdb_attrs_get_string(ldap_groups[ai],

1d93029624d708119bbf803e6647a2cbb271f001Sumit Bose "uniqueIDstr",

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek &uuid);

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek if (ret) {

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek DEBUG(SSSDBG_FUNC_DATA,

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek "The group has no UUID\n");

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek uuid = NULL;

108db0e3b9e06e530364ef8228634f5e3f6bd3b5Jakub Hrozek }