From 0e560c77761e581c7bcfeb728f28ba1045ff1597 Mon Sep 17 00:00:00 2001 From: Nalin Dahyabhai Date: Thu, 19 Sep 2013 11:51:41 -0400 Subject: Add ignore-subtree and restrict-subtree settings Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees out of which we ignore contents and updates, if set) settings, and default the former to "cn=tasks,cn=config". This should avoid cases where we're looking through the ldbm backend for entries which have a dangling reference to a newly-added task (which, because it's in the DSE, means we acquire an ldbm lock after acquiring our internal lock) while also updating a compat entry after its source entry is modified (for example, by the memberOf plugin, which results in us attempting to acquire our lock while the ldbm lock is already held). --- configure.ac | 13 +- doc/nis-configuration.txt | 29 ++- doc/sch-configuration.txt | 21 +- src/back-nis.c | 27 ++- src/back-sch.c | 21 +- src/back-shr.c | 113 ++++++---- src/back-shr.h | 1 + src/backend.h | 10 +- src/format.c | 231 +++++++++++++++++++-- src/format.h | 4 + tests/test37-schema-ignore/after.sh | 5 + tests/test37-schema-ignore/after.txt | 20 ++ tests/test37-schema-ignore/before.sh | 2 + tests/test37-schema-ignore/before.txt | 7 + tests/test37-schema-ignore/change.sh | 15 ++ tests/test37-schema-ignore/change.txt | 4 + tests/test37-schema-ignore/description.txt | 1 + tests/test37-schema-ignore/dse.ldif | 37 ++++ tests/test37-schema-ignore/plugin-process-all.txt | 1 + tests/test37-schema-ignore/userRoot.ldif | 87 ++++++++ tests/test38-schema-restrict/after.sh | 5 + tests/test38-schema-restrict/after.txt | 20 ++ tests/test38-schema-restrict/before.sh | 2 + tests/test38-schema-restrict/before.txt | 7 + tests/test38-schema-restrict/change.sh | 15 ++ tests/test38-schema-restrict/change.txt | 4 + tests/test38-schema-restrict/description.txt | 1 + tests/test38-schema-restrict/dse.ldif | 37 ++++ .../test38-schema-restrict/plugin-process-all.txt | 1 + tests/test38-schema-restrict/userRoot.ldif | 87 ++++++++ tests/test39-schema-restrictignore/after.sh | 5 + tests/test39-schema-restrictignore/after.txt | 20 ++ tests/test39-schema-restrictignore/before.sh | 2 + tests/test39-schema-restrictignore/before.txt | 7 + tests/test39-schema-restrictignore/change.sh | 15 ++ tests/test39-schema-restrictignore/change.txt | 4 + tests/test39-schema-restrictignore/description.txt | 1 + tests/test39-schema-restrictignore/dse.ldif | 38 ++++ .../plugin-process-all.txt | 1 + tests/test39-schema-restrictignore/userRoot.ldif | 87 ++++++++ tests/test40-schema-ignoredefault/after.sh | 3 + tests/test40-schema-ignoredefault/after.txt | 8 + tests/test40-schema-ignoredefault/before.sh | 2 + tests/test40-schema-ignoredefault/before.txt | 7 + tests/test40-schema-ignoredefault/change.sh | 18 ++ tests/test40-schema-ignoredefault/change.txt | 2 + tests/test40-schema-ignoredefault/description.txt | 1 + tests/test40-schema-ignoredefault/dse.ldif | 16 ++ .../plugin-process-all.txt | 1 + tests/test40-schema-ignoredefault/userRoot.ldif | 86 ++++++++ 50 files changed, 1056 insertions(+), 96 deletions(-) create mode 100755 tests/test37-schema-ignore/after.sh create mode 100644 tests/test37-schema-ignore/after.txt create mode 100755 tests/test37-schema-ignore/before.sh create mode 100644 tests/test37-schema-ignore/before.txt create mode 100755 tests/test37-schema-ignore/change.sh create mode 100644 tests/test37-schema-ignore/change.txt create mode 100644 tests/test37-schema-ignore/description.txt create mode 100644 tests/test37-schema-ignore/dse.ldif create mode 100644 tests/test37-schema-ignore/plugin-process-all.txt create mode 100644 tests/test37-schema-ignore/userRoot.ldif create mode 100755 tests/test38-schema-restrict/after.sh create mode 100644 tests/test38-schema-restrict/after.txt create mode 100755 tests/test38-schema-restrict/before.sh create mode 100644 tests/test38-schema-restrict/before.txt create mode 100755 tests/test38-schema-restrict/change.sh create mode 100644 tests/test38-schema-restrict/change.txt create mode 100644 tests/test38-schema-restrict/description.txt create mode 100644 tests/test38-schema-restrict/dse.ldif create mode 100644 tests/test38-schema-restrict/plugin-process-all.txt create mode 100644 tests/test38-schema-restrict/userRoot.ldif create mode 100755 tests/test39-schema-restrictignore/after.sh create mode 100644 tests/test39-schema-restrictignore/after.txt create mode 100755 tests/test39-schema-restrictignore/before.sh create mode 100644 tests/test39-schema-restrictignore/before.txt create mode 100755 tests/test39-schema-restrictignore/change.sh create mode 100644 tests/test39-schema-restrictignore/change.txt create mode 100644 tests/test39-schema-restrictignore/description.txt create mode 100644 tests/test39-schema-restrictignore/dse.ldif create mode 100644 tests/test39-schema-restrictignore/plugin-process-all.txt create mode 100644 tests/test39-schema-restrictignore/userRoot.ldif create mode 100755 tests/test40-schema-ignoredefault/after.sh create mode 100644 tests/test40-schema-ignoredefault/after.txt create mode 100755 tests/test40-schema-ignoredefault/before.sh create mode 100644 tests/test40-schema-ignoredefault/before.txt create mode 100755 tests/test40-schema-ignoredefault/change.sh create mode 100644 tests/test40-schema-ignoredefault/change.txt create mode 100644 tests/test40-schema-ignoredefault/description.txt create mode 100644 tests/test40-schema-ignoredefault/dse.ldif create mode 100644 tests/test40-schema-ignoredefault/plugin-process-all.txt create mode 100644 tests/test40-schema-ignoredefault/userRoot.ldif diff --git a/configure.ac b/configure.ac index 28d5ca4..e24405c 100644 --- a/configure.ac +++ b/configure.ac @@ -420,14 +420,15 @@ AC_SUBST(groups) AC_DEFINE(DEFAULT_MAX_DGRAM_SIZE,YPMAXRECORD,[Define to the default maximum datagram reply size.]) AC_DEFINE(DEFAULT_MAX_VALUE_SIZE,(256 * 1024),[Define to the default maximum map entry key and value size.]) AC_DEFINE(DEFAULT_TARGET_REPLY_SIZE,(4 * 1024),[Define to the default target size for a connected reply fragment.]) +AC_DEFINE_UNQUOTED(DEFAULT_IGNORE_SUBTREE,["cn=tasks,cn=config"],[Define to the default subtree to ignore if no value is explicitly configured for the map.]) AM_CONDITIONAL(NIS,true) nisbaseattr=nis-base AC_DEFINE_UNQUOTED(NIS_MAP_CONFIGURATION_BASE_ATTR,"$nisbaseattr", [Define to name of the attribute which lists the containers for entries for a given map.]) -nisrelevantsubtreeattr=nis-relevant-subtree -AC_DEFINE_UNQUOTED(NIS_MAP_CONFIGURATION_RELEVANT_SUBTREES_ATTR,"$nisrelevantsubtreeattr", - [Define to name of the attribute which lists the only subtrees which are relevant when locating entries and reading data to be used for constructing entries for a given container.]) +nisrestrictsubtreeattr=nis-restrict-subtree +AC_DEFINE_UNQUOTED(NIS_MAP_CONFIGURATION_RESTRICT_SUBTREES_ATTR,"$nisrestrictsubtreeattr", + [Define to name of the attribute which lists the only subtrees which we care about when locating entries and reading data to be used for constructing entries for a given container.]) nisignoresubtreeattr=nis-ignore-subtree AC_DEFINE_UNQUOTED(NIS_MAP_CONFIGURATION_IGNORE_SUBTREES_ATTR,"$nisignoresubtreeattr", [Define to name of the attribute which lists the subtrees to ignore when locating entries and reading data to be used for constructing entries for a given container.]) @@ -472,9 +473,9 @@ AC_DEFINE_UNQUOTED(SCH_CONTAINER_CONFIGURATION_ACCESS_ATTR,"$checkaciattr", schbaseattr=schema-compat-search-base AC_DEFINE_UNQUOTED(SCH_CONTAINER_CONFIGURATION_BASE_ATTR,"$schbaseattr", [Define to name of the attribute which lists the containers to search when locating entries to be used for constructing entries for a given container.]) -schrelevantsubtreeattr=schema-compat-relevant-subtree -AC_DEFINE_UNQUOTED(SCH_CONTAINER_CONFIGURATION_RELEVANT_SUBTREES_ATTR,"$schrelevantsubtreeattr", - [Define to name of the attribute which lists the only subtrees which are relevant when locating entries and reading data to be used for constructing entries for a given container.]) +schrestrictsubtreeattr=schema-compat-restrict-subtree +AC_DEFINE_UNQUOTED(SCH_CONTAINER_CONFIGURATION_RESTRICT_SUBTREES_ATTR,"$schrestrictsubtreeattr", + [Define to name of the attribute which lists the only subtrees which we care about when locating entries and reading data to be used for constructing entries for a given container.]) schignoresubtreeattr=schema-compat-ignore-subtree AC_DEFINE_UNQUOTED(SCH_CONTAINER_CONFIGURATION_IGNORE_SUBTREES_ATTR,"$schignoresubtreeattr", [Define to name of the attribute which lists the subtrees to ignore when locating entries and reading data to be used for constructing entries for a given container.]) diff --git a/doc/nis-configuration.txt b/doc/nis-configuration.txt index 577a051..8f8df9f 100644 --- a/doc/nis-configuration.txt +++ b/doc/nis-configuration.txt @@ -58,37 +58,37 @@ look like this: Configuration for individual maps should be stored in entries directly beneath the plugin's entry. These attributes are recognized: - * nis-domain + * nis-domain (required, multivalued) The NIS domain in which this map appears. The server will claim to support any domain for which it has at least one map configured. There is no default value, and a single map will appear in multiple domains if this attribute has multiple values. - * nis-map + * nis-map (required, multivalued) The name of this map in the domain. There is no default value, and a single map will appear with multiple names if this attribute has multiple values. - * nis-base + * nis-base (required, multivalued) The entry under which directory server entries which should be converted into NIS map entries can be found. There is no default setting. If this attribute has more than one value, the resulting NIS map will include every entry which can be found by searching under all of the specified entries. - * nis-secure + * nis-secure (optional) Indicates that the contents of this map should only be visible to clients whose queries originated from port numbers below 1024. The default setting for all maps is "no". - * nis-filter + * nis-filter (optional) The filter which is used to select entries for conversion, given as an LDAP search filter. A default value, which varies based on the name of the map, is used if none is specified. - * nis-key-format + * nis-key-format (required if nis-keys-format is not set) A format specifier which the plugin will use to convert the contents of the directory server entry into a key for the NIS map. If the expression fails to evaluate, or evaluates to more than one value, the entry will be ignored. This can be used to ensure a 1-to-1 mapping between entries in the directory server and a NIS map. The syntax of format specifiers is described in "format-specifiers.txt". - * nis-keys-format + * nis-keys-format (required if nis-key-format is not set, multivalued) A format specifier which the plugin will use to convert the contents of the directory server entry into a set of keys for the NIS map. The resulting NIS map will include a key for each value to which the @@ -96,12 +96,12 @@ beneath the plugin's entry. These attributes are recognized: number of NIS map entries to be created for a given directory server entry. The syntax of format specifiers is described in "format-specifiers.txt". - * nis-value-format + * nis-value-format (required if nis-values-format is not set) A format specifier which the plugin will use to convert the contents of the directory server entry into a NIS map entry's value. If the entry will have multiple keys, each key will use the same value. The syntax of format specifiers is described in "format-specifiers.txt". - * nis-values-format + * nis-values-format (required if nis-value-format is not set) A format specifier which the plugin will use to convert the contents of the directory server entry into values for NIS map entries. Typically this will be used in combination with a "nis-keys-format" @@ -109,10 +109,19 @@ beneath the plugin's entry. These attributes are recognized: server entry. If there are fewer values than keys, the values will be reused. The syntax of format specifiers is described in "format-specifiers.txt". - * nis-disallowed-chars + * nis-disallowed-chars (optional) A list of characters which, if found in an attribute value, will cause that attribute value to be ignored when evaluating keys and values. + * nis-ignore-subtree (optional, multivalued) + An optional set of subtrees under which the plugin will ignore all + content and updates. By default, this is set to "cn=tasks,cn=config". + * nis-restrict-subtree (optional, multivalued) + An optional set of subtrees from under which the plugin will only + consider content and updates. If you have a large DIT and many + maps, using this setting may reduce the amount of work the plugin + has to do, by short-circuiting possibly-expensive checks to see if + an entry being modified affects the contents of various maps. The nis-filter, nis-key-format, nis-keys-format, nis-value-format, and nis-values-format settings all have defaults which vary based on the diff --git a/doc/sch-configuration.txt b/doc/sch-configuration.txt index 93e5298..e07a4af 100644 --- a/doc/sch-configuration.txt +++ b/doc/sch-configuration.txt @@ -20,24 +20,33 @@ look like this: Configuration for individual sets should be stored in entries directly beneath the plugin's entry. These attributes are recognized: - * schema-compat-container-group + * schema-compat-container-group (required) The top-level container DN under which this container's entry appears. This level of grouping is primarily useful when using the ''referred'' function. - * schema-compat-container-rdn + * schema-compat-container-rdn (optional) The RDN of this particular container. If it's omitted, generated entries will show up directly in the container group. - * schema-compat-search-base + * schema-compat-search-base (required, multivalued) One or more locations in the directory where candidate entries can be found. - * schema-compat-search-filter + * schema-compat-search-filter (required) A filter used to select which candidate entries should have new entries created for them in this container. - * schema-compat-entry-rdn + * schema-compat-entry-rdn (required) The RDN to give to generated entries, which will be stored as children of this container. - * schema-compat-entry-attribute + * schema-compat-entry-attribute (optional, multivalued) Additional attributes to add to each entry in this container. + * schema-compat-ignore-subtree (optional, multivalued) + An optional set of subtrees under which the plugin will ignore all + content and updates. By default, this is set to "cn=tasks,cn=config". + * schema-compat-restrict-subtree (optional, multivalued) + An optional set of subtrees from under which the plugin will only + consider content and updates. If you have a large DIT and many + maps, using this setting may reduce the amount of work the plugin + has to do, by short-circuiting possibly-expensive checks to see if + an entry being modified affects the contents of various maps. An pair of example definitions might look like this: diff --git a/src/back-nis.c b/src/back-nis.c index 8a8f89c..be6bb6a 100644 --- a/src/back-nis.c +++ b/src/back-nis.c @@ -87,7 +87,7 @@ backend_free_set_data_contents(void *data) free(set_data->common.group); free(set_data->common.set); backend_shr_free_strlist(set_data->common.bases); - backend_shr_free_sdnlist(set_data->common.relevant_subtrees); + backend_shr_free_sdnlist(set_data->common.restrict_subtrees); backend_shr_free_sdnlist(set_data->common.ignore_subtrees); format_free_attr_list(set_data->common.rel_attrs); free(set_data->common.rel_attr_list); @@ -123,7 +123,7 @@ backend_copy_set_data(const struct backend_set_data *data) ret->common.set = strdup(data->common.set); ret->common.bases = backend_shr_dup_strlist(data->common.bases); ret->common.entry_filter = strdup(data->common.entry_filter); - ret->common.relevant_subtrees = backend_shr_dup_sdnlist(data->common.relevant_subtrees); + ret->common.restrict_subtrees = backend_shr_dup_sdnlist(data->common.restrict_subtrees); ret->common.ignore_subtrees = backend_shr_dup_sdnlist(data->common.ignore_subtrees); ret->common.rel_attrs = data->common.rel_attrs ? format_dup_attr_list(data->common.rel_attrs) : @@ -199,6 +199,8 @@ backend_gather_data(struct plugin_state *state, const char *domain, const char *map, char **single_formats, char **group_formats, const char *disallowed_chars, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, @@ -259,6 +261,8 @@ backend_gather_data(struct plugin_state *state, singles[i] = format_get_data(state, pb, e, domain, map, single_formats[i], disallowed_chars, + restrict_subtrees, + ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &single_lengths[i]); @@ -287,6 +291,8 @@ backend_gather_data(struct plugin_state *state, groups[j] = format_get_data_set(state, pb, e, domain, map, group_formats[i], disallowed_chars, + restrict_subtrees, + ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &group_lengths[j]); @@ -365,6 +371,8 @@ backend_set_entry(Slapi_PBlock *pb, Slapi_Entry *e, data->key_formats, data->keys_formats, data->disallowed_chars, + data->common.restrict_subtrees, + data->common.ignore_subtrees, &data->common.rel_attrs, &data->common.ref_attrs, &data->common.inref_attrs, @@ -382,6 +390,8 @@ backend_set_entry(Slapi_PBlock *pb, Slapi_Entry *e, data->value_formats, data->values_formats, data->disallowed_chars, + data->common.restrict_subtrees, + data->common.ignore_subtrees, &data->common.rel_attrs, &data->common.ref_attrs, &data->common.inref_attrs, @@ -517,7 +527,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, char **use_bases, *use_entry_filter; char **use_key_formats, **use_keys_formats; char **use_value_formats, **use_values_formats, *use_disallowed_chars; - const Slapi_DN **relevant_subtrees, **ignore_subtrees; + const Slapi_DN **restrict_subtrees, **ignore_subtrees; int i, j; /* Read the hard-coded defaults for a map with this name. */ @@ -528,10 +538,13 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, /* Read the values from the configuration entry. */ bases = backend_shr_get_vattr_strlist(state, e, NIS_MAP_CONFIGURATION_BASE_ATTR); - relevant_subtrees = backend_shr_get_vattr_sdnlist(state, e, - NIS_MAP_CONFIGURATION_RELEVANT_SUBTREES_ATTR); + restrict_subtrees = backend_shr_get_vattr_sdnlist(state, e, + NIS_MAP_CONFIGURATION_RESTRICT_SUBTREES_ATTR); ignore_subtrees = backend_shr_get_vattr_sdnlist(state, e, NIS_MAP_CONFIGURATION_IGNORE_SUBTREES_ATTR); + if (ignore_subtrees == NULL) { + backend_shr_add_sdnlist(&ignore_subtrees, DEFAULT_IGNORE_SUBTREE); + } entry_filter = backend_shr_get_vattr_filter(state, e, NIS_MAP_CONFIGURATION_FILTER_ATTR); key_formats = backend_shr_get_vattr_strlist(state, e, @@ -613,7 +626,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, ret.common.group = strdup(domain); ret.common.set = strdup(map); ret.common.bases = use_bases; - ret.common.relevant_subtrees = relevant_subtrees; + ret.common.restrict_subtrees = restrict_subtrees; ret.common.ignore_subtrees = ignore_subtrees; ret.common.entry_filter = use_entry_filter; ret.common.rel_attrs = NULL; @@ -716,7 +729,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, free(ret.common.group); free(ret.common.set); backend_shr_free_strlist(ret.common.bases); - backend_shr_free_sdnlist(ret.common.relevant_subtrees); + backend_shr_free_sdnlist(ret.common.restrict_subtrees); free(ret.disallowed_chars); free(ret.common.entry_filter); backend_shr_free_strlist(ret.key_formats); diff --git a/src/back-sch.c b/src/back-sch.c index 3130fbc..e5a6937 100644 --- a/src/back-sch.c +++ b/src/back-sch.c @@ -79,7 +79,7 @@ backend_set_config_free_config_contents(void *data) free(set_data->common.group); free(set_data->common.set); free(set_data->common.bases); - backend_shr_free_sdnlist(set_data->common.relevant_subtrees); + backend_shr_free_sdnlist(set_data->common.restrict_subtrees); backend_shr_free_sdnlist(set_data->common.ignore_subtrees); format_free_attr_list(set_data->common.rel_attrs); free(set_data->common.rel_attr_list); @@ -112,7 +112,7 @@ backend_copy_set_config(const struct backend_set_data *data) ret->common.group = strdup(data->common.group); ret->common.set = strdup(data->common.set); ret->common.bases = backend_shr_dup_strlist(data->common.bases); - ret->common.relevant_subtrees = backend_shr_dup_sdnlist(data->common.relevant_subtrees); + ret->common.restrict_subtrees = backend_shr_dup_sdnlist(data->common.restrict_subtrees); ret->common.ignore_subtrees = backend_shr_dup_sdnlist(data->common.ignore_subtrees); ret->common.rel_attrs = data->common.rel_attrs ? format_dup_attr_list(data->common.rel_attrs) : @@ -164,15 +164,18 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, bool_t check_access; struct backend_set_data ret; Slapi_DN *tmp_sdn; - const Slapi_DN **relevant_subtrees, **ignore_subtrees; + const Slapi_DN **restrict_subtrees, **ignore_subtrees; /* Read the values from the configuration entry. */ bases = backend_shr_get_vattr_strlist(state, e, SCH_CONTAINER_CONFIGURATION_BASE_ATTR); - relevant_subtrees = backend_shr_get_vattr_sdnlist(state, e, - SCH_CONTAINER_CONFIGURATION_RELEVANT_SUBTREES_ATTR); + restrict_subtrees = backend_shr_get_vattr_sdnlist(state, e, + SCH_CONTAINER_CONFIGURATION_RESTRICT_SUBTREES_ATTR); ignore_subtrees = backend_shr_get_vattr_sdnlist(state, e, SCH_CONTAINER_CONFIGURATION_IGNORE_SUBTREES_ATTR); + if (ignore_subtrees == NULL) { + backend_shr_add_sdnlist(&ignore_subtrees, DEFAULT_IGNORE_SUBTREE); + } entry_filter = backend_shr_get_vattr_filter(state, e, SCH_CONTAINER_CONFIGURATION_FILTER_ATTR); rdn_format = backend_shr_get_vattr_str(state, e, @@ -193,7 +196,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, slapi_sdn_free(&tmp_sdn); ret.common.set = strdup(container); ret.common.bases = bases; - ret.common.relevant_subtrees = relevant_subtrees; + ret.common.restrict_subtrees = restrict_subtrees; ret.common.ignore_subtrees = ignore_subtrees; ret.common.entry_filter = entry_filter; ret.common.rel_attrs = NULL; @@ -259,7 +262,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e, free(ret.common.group); free(ret.common.set); backend_shr_free_strlist(ret.common.bases); - backend_shr_free_sdnlist(ret.common.relevant_subtrees); + backend_shr_free_sdnlist(ret.common.restrict_subtrees); backend_shr_free_sdnlist(ret.common.ignore_subtrees); free(ret.common.entry_filter); slapi_sdn_free(&ret.container_sdn); @@ -429,6 +432,8 @@ backend_set_entry_from(Slapi_PBlock *pb, enum backend_entry_source source, rdn = format_get_data(data->common.state, pb, e, data->common.group, data->common.set, data->rdn_format, NULL, + data->common.restrict_subtrees, + data->common.ignore_subtrees, &data->common.rel_attrs, &data->common.ref_attrs, &data->common.inref_attrs, @@ -512,6 +517,8 @@ backend_set_entry_from(Slapi_PBlock *pb, enum backend_entry_source source, data->common.set, data->attribute_format[i], NULL, + data->common.restrict_subtrees, + data->common.ignore_subtrees, &data->common.rel_attrs, &data->common.ref_attrs, &data->common.inref_attrs, diff --git a/src/back-shr.c b/src/back-shr.c index 00ca097..63ed700 100644 --- a/src/back-shr.c +++ b/src/back-shr.c @@ -284,6 +284,30 @@ backend_shr_set_entry_cb(Slapi_Entry *e, void *callback_data) backend_shr_set_entry(cbdata->pb, e, cbdata->set_data); return 0; } +void +backend_shr_add_sdnlist(const Slapi_DN ***sdnlist, const char *dn) +{ + const Slapi_DN **ret; + int i = 0; + if (dn == NULL) { + return NULL; + } + if ((sdnlist != NULL) && (*sdnlist != NULL)) { + for (i = 0; (*sdnlist)[i] != NULL; i++) { + continue; + } + } + ret = calloc(i + 2, sizeof(ret[0])); + if (ret != NULL) { + if ((sdnlist != NULL) && (*sdnlist != NULL)) { + memcpy(ret, *sdnlist, (i + 1) * sizeof(ret[0])); + free(*sdnlist); + } + ret[i] = slapi_sdn_new_dn_byval(dn); + ret[i + 1] = NULL; + *sdnlist = ret; + } +} static const Slapi_DN ** backend_shr_dup_sdnlist_n(const Slapi_DN **sdnlist, int n) { @@ -791,48 +815,54 @@ static bool_t backend_shr_entry_matches_set(struct backend_shr_set_data *set_data, Slapi_PBlock *pb, Slapi_Entry *e) { - const Slapi_DN **relevant_subtrees, **ignore_subtrees; + const Slapi_DN **restrict_subtrees, **ignore_subtrees; char **set_bases; char *set_filter; int i; - relevant_subtrees = set_data->relevant_subtrees; + restrict_subtrees = set_data->restrict_subtrees; ignore_subtrees = set_data->ignore_subtrees; set_bases = set_data->bases; set_filter = set_data->entry_filter; - if (ignore_subtrees != NULL) { - for (i = 0; ignore_subtrees[i] != NULL; i++) { - if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), - ignore_subtrees[i], - LDAP_SCOPE_SUBTREE) != 0) { - return FALSE; - } - } - } - if (relevant_subtrees != NULL) { - for (i = 0; relevant_subtrees[i] != NULL; i++) { - if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), - relevant_subtrees[i], - LDAP_SCOPE_SUBTREE) != 0) { - break; - } - } - if (relevant_subtrees[i] == NULL) { - /* Non-empty list, but no match. */ - return FALSE; - } - } - if (set_bases != NULL) { + /* Check if it's in the map's configured area(s). */ for (i = 0; set_bases[i] != NULL; i++) { if (backend_shr_entry_matches(pb, e, set_bases[i], LDAP_SCOPE_SUBTREE, set_filter)) { - return TRUE; + break; } } + if (set_bases[i] != NULL) { + /* If it is, then check that it's in the subtrees we're + * restricting updates to... */ + if (restrict_subtrees != NULL) { + for (i = 0; restrict_subtrees[i] != NULL; i++) { + if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), + restrict_subtrees[i], + LDAP_SCOPE_SUBTREE) != 0) { + break; + } + } + if (restrict_subtrees[i] == NULL) { + /* Non-empty list, but no match. */ + return FALSE; + } + } + /* ... and not in one that we intend to ignore. */ + if (ignore_subtrees != NULL) { + for (i = 0; ignore_subtrees[i] != NULL; i++) { + if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e), + ignore_subtrees[i], + LDAP_SCOPE_SUBTREE) != 0) { + return FALSE; + } + } + } + return TRUE; + } } return FALSE; @@ -1015,30 +1045,31 @@ backend_shr_update_references_cb(const char *group, const char *set, cbdata = cbdata_ptr; state = set_data->state; - /* Check if this entry is in one of the areas we've been specifically - * told to ignore. */ - if (set_data->ignore_subtrees != NULL) { - for (i = 0; set_data->ignore_subtrees[i] != NULL; i++) { + /* If it is, then check that it's in one of the subtrees we're + * restricting updates to... */ + if (set_data->restrict_subtrees != NULL) { + for (i = 0; set_data->restrict_subtrees[i] != NULL; i++) { if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(cbdata->e), - set_data->ignore_subtrees[i], + set_data->restrict_subtrees[i], LDAP_SCOPE_SUBTREE) != 0) { - /* Yeah, we're done here. */ - return TRUE; + break; } } + if (set_data->restrict_subtrees[i] == NULL) { + /* Non-empty list, but no match. */ + return TRUE; + } } - if (set_data->relevant_subtrees != NULL) { - for (i = 0; set_data->relevant_subtrees[i] != NULL; i++) { + /* ... and not in one that we intend to ignore. */ + if (set_data->ignore_subtrees != NULL) { + for (i = 0; set_data->ignore_subtrees[i] != NULL; i++) { if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(cbdata->e), - set_data->relevant_subtrees[i], + set_data->ignore_subtrees[i], LDAP_SCOPE_SUBTREE) != 0) { - break; + /* Yeah, we're done here. */ + return TRUE; } } - if (set_data->relevant_subtrees[i] == NULL) { - /* Non-empty list, but no match. */ - return TRUE; - } } /* If the entry didn't change any attributes which are at all relevant diff --git a/src/back-shr.h b/src/back-shr.h index 83c049d..44c25fe 100644 --- a/src/back-shr.h +++ b/src/back-shr.h @@ -33,6 +33,7 @@ char **backend_shr_dup_strlist_n(char **strlist, int n); char **backend_shr_dup_strlist(char **strlist); char **backend_shr_dup_strlist_unless_empty(char **strlist); void backend_shr_add_strlist(char ***strlist, const char *item); +void backend_shr_add_sdnlist(const Slapi_DN ***sdnlist, const char *dn); const Slapi_DN **backend_shr_dup_sdnlist(const Slapi_DN **sdnlist); void backend_shr_free_sdnlist(const Slapi_DN **sdnlist); diff --git a/src/backend.h b/src/backend.h index 8c00dd4..7974aae 100644 --- a/src/backend.h +++ b/src/backend.h @@ -46,10 +46,12 @@ struct backend_shr_set_data { /* Configuration flag indicating whether or not we try to skip * recomputing data in this map. */ unsigned int skip_uninteresting_updates:1; - /* Subtrees under which all of the contents that we care about will be - * stored. Other locaoins will be silently ignored. */ - const struct slapi_dn **relevant_subtrees; - /* Subtrees under which we ignore contents. */ + /* Subtrees under which all of the contents that we care about, and + * anything that refers to content that we care about, will be stored. + * Other locations will be silently ignored if this list contains any + * values. */ + const struct slapi_dn **restrict_subtrees; + /* Subtrees under which we ignore contents and updates. */ const struct slapi_dn **ignore_subtrees; struct backend_set_data *self; }; diff --git a/src/format.c b/src/format.c index cfec33e..d5dc7ff 100644 --- a/src/format.c +++ b/src/format.c @@ -60,6 +60,8 @@ static int format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -286,8 +288,8 @@ format_add_sdn_list(struct slapi_dn ***list, struct slapi_dn ***list2, } static int -format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter, - void *identity) +format_check_entry_exists(Slapi_PBlock *pb, const char *dn, char *filter, + void *identity) { Slapi_DN *sdn; Slapi_Entry *entry; @@ -303,12 +305,62 @@ format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter, } } +static int +format_check_sdn_location(const Slapi_DN *sdn, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees) +{ + int i; + + if (restrict_subtrees != NULL) { + for (i = 0; restrict_subtrees[i] != NULL; i++) { + if (slapi_sdn_scope_test(sdn, + restrict_subtrees[i], + LDAP_SCOPE_SUBTREE) != 0) { + break; + } + } + if (restrict_subtrees[i] == NULL) { + /* Non-empty list, but no match. */ + return ENOENT; + } + } + if (ignore_subtrees != NULL) { + for (i = 0; ignore_subtrees[i] != NULL; i++) { + if (slapi_sdn_scope_test(sdn, + ignore_subtrees[i], + LDAP_SCOPE_SUBTREE) != 0) { + return ENOENT; + } + } + } + return 0; +} + +static int +format_check_dn_location(const char *dn, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees) +{ + int ret = ENOENT; + Slapi_DN *sdn; + + sdn = slapi_sdn_new_dn_byref(dn); + if (sdn != NULL) { + ret = format_check_sdn_location(sdn, + restrict_subtrees, + ignore_subtrees); + slapi_sdn_free(&sdn); + } + return ret; +} + static void -format_add_filtered_sdn_list(Slapi_PBlock *pb, - struct slapi_dn ***list, struct slapi_dn ***list2, - const char *dn, char *filter, void *identity) +format_maybe_add_sdn_list(Slapi_PBlock *pb, + struct slapi_dn ***list, struct slapi_dn ***list2, + const char *dn, char *filter, void *identity) { - if (format_check_entry(pb, dn, filter, identity) == 0) { + if (format_check_entry_exists(pb, dn, filter, identity) == 0) { format_add_sdn_list(list, list2, dn); } } @@ -918,6 +970,8 @@ static int format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -951,6 +1005,7 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, ret = -ENOENT; values = format_get_data_set(state, pb, e, group, set, value_format, disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -966,6 +1021,8 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, i = format_expand(state, pb, e, group, set, default_value, NULL, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -1006,6 +1063,8 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *fname, const char *group, const char *set, char *ref_attr, char *target_attr, char *filter, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -1059,6 +1118,16 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, "\"%s\"\n", fname, cref); continue; } + if (format_check_sdn_location(refdn, + restrict_subtrees, + ignore_subtrees) != 0) { + slapi_log_error(SLAPI_LOG_PLUGIN, + state->plugin_desc->spd_id, + "%s: entry \"%s\" is in a location " + "where we don't look\n", fname, cref); + slapi_sdn_free(&refdn); + continue; + } wrap_search_internal_get_entry(pb, refdn, filter, attrs, &ref, state->plugin_identity); if (ref == NULL) { @@ -1115,6 +1184,8 @@ static int format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -1147,6 +1218,7 @@ format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, target_attr = argv[1]; ret = format_deref_x(state, pb, e, "deref", group, set, ref_attr, target_attr, NULL, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list); @@ -1158,6 +1230,8 @@ static int format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -1191,6 +1265,7 @@ format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, target_attr = argv[2]; ret = format_deref_x(state, pb, e, "deref_f", group, set, ref_attr, target_attr, filter, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list); @@ -1207,6 +1282,8 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *fname, const char *group, const char *set, const char **attributes, const char **filters, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -1272,6 +1349,18 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, format_add_sdn_list(&list->links[i].base_sdn_list, &list->links[i].base_sdn_list2, slapi_sdn_get_ndn(parent)); + /* Check if the referred-to entry is in a location that + * we care about. */ + if (format_check_sdn_location(these[j], + restrict_subtrees, + ignore_subtrees) != 0) { + slapi_log_error(SLAPI_LOG_PLUGIN, + state->plugin_desc->spd_id, + "%s: entry \"%s\" is in a location " + "where we don't look\n", fname, + slapi_sdn_get_ndn(these[j])); + continue; + } /* Pull up the named entry. */ wrap_search_internal_get_entry(pb, these[j], NULL, @@ -1315,18 +1404,25 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, if (cvalue == NULL) { continue; } + /* If it's in an area that we're + * ignoring, then ignore it already. */ + if (format_check_dn_location(cvalue, + restrict_subtrees, + ignore_subtrees) != 0) { + continue; + } /* Let's visit the named entry this * time, in case we're nesting. */ - format_add_filtered_sdn_list(pb, &these, &these2, - cvalue, - list->links[i + 1].filter_str, - state->plugin_identity); + format_maybe_add_sdn_list(pb, &these, &these2, + cvalue, + list->links[i + 1].filter_str, + state->plugin_identity); /* We need to visit the named entry * next time. */ - format_add_filtered_sdn_list(pb, &next, &next2, - cvalue, - list->links[i + 1].filter_str, - state->plugin_identity); + format_maybe_add_sdn_list(pb, &next, &next2, + cvalue, + list->links[i + 1].filter_str, + state->plugin_identity); } else { /* Get the value. */ bval = slapi_value_get_berval(value); @@ -1373,6 +1469,8 @@ static int format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -1405,6 +1503,7 @@ format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, group, set, (const char **) argv, NULL, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -1417,6 +1516,8 @@ static int format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -1475,6 +1576,7 @@ format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, group, set, (const char **) attrs, (const char **) filters, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -1543,6 +1645,8 @@ static int format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -1748,6 +1852,8 @@ static int format_referred_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -1989,6 +2095,8 @@ static int format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2021,6 +2129,7 @@ format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, "merge: expanding ->%s<-\n", argv[i]); values = format_get_data_set(state, pb, e, group, set, argv[i], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -2074,6 +2183,8 @@ format_match_generic(struct plugin_state *state, const char *group, const char *set, const char *args, int min_args, int default_arg, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -2109,6 +2220,7 @@ format_match_generic(struct plugin_state *state, lengths = NULL; values = format_get_data_set(state, pb, e, group, set, argv[0], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -2164,6 +2276,8 @@ format_match_generic(struct plugin_state *state, group, set, argv[default_arg], disallowed, + restrict_subtrees, + ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, @@ -2273,6 +2387,8 @@ format_match(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2282,6 +2398,7 @@ format_match(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, 2, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2292,6 +2409,8 @@ format_mmatch(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2301,6 +2420,7 @@ format_mmatch(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, -1, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2333,6 +2453,8 @@ format_regmatch(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2342,6 +2464,7 @@ format_regmatch(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, 2, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2352,6 +2475,8 @@ format_mregmatch(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2361,6 +2486,7 @@ format_mregmatch(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, -1, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2376,6 +2502,8 @@ format_regmatchi(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2385,6 +2513,7 @@ format_regmatchi(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, 2, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2395,6 +2524,8 @@ format_mregmatchi(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2404,6 +2535,7 @@ format_mregmatchi(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 2, -1, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2529,6 +2661,8 @@ format_regsub(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2538,6 +2672,7 @@ format_regsub(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 3, 3, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2548,6 +2683,8 @@ format_mregsub(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2557,6 +2694,7 @@ format_mregsub(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 3, -1, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2572,6 +2710,8 @@ format_regsubi(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2581,6 +2721,7 @@ format_regsubi(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 3, 3, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2591,6 +2732,8 @@ format_mregsubi(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2600,6 +2743,7 @@ format_mregsubi(struct plugin_state *state, { return format_match_generic(state, pb, e, group, set, args, 3, -1, disallowed, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -2615,6 +2759,8 @@ static int format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2657,6 +2803,7 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, /* Evaluate the value expression to get a list of candidate values. */ values = format_get_data_set(state, pb, e, group, set, argv[1], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -2695,6 +2842,8 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, * return its values. */ ret = format_expand(state, pb, e, group, set, argv[matched ? 2 : 3], disallowed, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -2709,6 +2858,8 @@ static int format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2737,6 +2888,8 @@ format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, for (i = 0; i < argc; i++) { ret = format_expand(state, pb, e, group, set, argv[i], disallowed, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -2779,6 +2932,8 @@ static int format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2821,6 +2976,7 @@ format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, choices = NULL; values = format_get_data_set(state, pb, e, group, set, argv[0], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -2884,6 +3040,8 @@ static int format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -2922,6 +3080,7 @@ format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, /* Evaluate this argument. */ values = format_get_data_set(state, pb, e, group, set, argv[i], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -2985,6 +3144,8 @@ static int format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -3046,6 +3207,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, j = (i / 3) * 2; values[j] = format_get_data_set(state, pb, e, group, set, argv[i], disallowed, + restrict_subtrees, + ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, @@ -3059,6 +3222,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, "link: evaluating \"%s\"\n", argv[i + 1]); values[j] = format_get_data_set(state, pb, e, group, set, argv[i + 1], disallowed, + restrict_subtrees, + ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, @@ -3219,6 +3384,8 @@ static int format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -3261,6 +3428,7 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, ret = -ENOENT; values = format_get_data_set(state, pb, e, group, set, value_format, disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -3276,6 +3444,8 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, i = format_expand(state, pb, e, group, set, default_value, NULL, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, @@ -3333,6 +3503,8 @@ format_internal_sequence_number(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -3378,6 +3550,8 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -3429,6 +3603,7 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb, "dribble_merge: expanding ->%s<-\n", argv[i]); values = format_get_data_set(state, pb, e, group, set, argv[i], disallowed, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &lengths); @@ -3538,6 +3713,8 @@ format_lookup_fn(const char *fnname) Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -3883,6 +4060,8 @@ format_expand_simple(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -3993,6 +4172,8 @@ format_expand_simple(struct plugin_state *state, i = format_expand(state, pb, e, group, set, default_value, NULL, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, @@ -4012,6 +4193,8 @@ format_expand_simple(struct plugin_state *state, i = format_expand(state, pb, e, group, set, alternate_value, NULL, + restrict_subtrees, + ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, @@ -4041,6 +4224,7 @@ format_expand_simple(struct plugin_state *state, /* Supply the alternate value. */ i = format_expand(state, pb, e, group, set, alternate_value, NULL, + restrict_subtrees, ignore_subtrees, outbuf, outbuf_len, outbuf_choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list); @@ -4079,6 +4263,8 @@ static int format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, char ***ref_attrs, @@ -4094,6 +4280,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *args, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char *outbuf, int outbuf_len, struct format_choice **outbuf_choices, char ***rel_attrs, @@ -4154,6 +4342,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, set, subexp, disallowed, + restrict_subtrees, + ignore_subtrees, outbuf + j, outbuf_len - j, outbuf_choices, @@ -4260,6 +4450,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, used = (*formatfn)(state, pb, e, group, set, params, disallowed, + restrict_subtrees, + ignore_subtrees, outbuf + j, outbuf_len - j, outbuf_choices, rel_attrs, @@ -4321,6 +4513,8 @@ format_format(struct plugin_state *state, const char *group, const char *set, const char *fmt, const char *disallowed, struct format_choice **choices, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, struct format_ref_attr_list ***ref_attr_list, @@ -4348,6 +4542,8 @@ format_format(struct plugin_state *state, pb = wrap_pblock_new(parent_pb); i = format_expand(state, pb, e, group, set, fmt, disallowed, + restrict_subtrees, + ignore_subtrees, buf, buflen, choices, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list); @@ -4410,6 +4606,8 @@ format_get_data(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, @@ -4420,6 +4618,7 @@ format_get_data(struct plugin_state *state, unsigned int ignored; return format_format(state, pb, e, group, set, fmt, disallowed, NULL, + restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, @@ -4443,6 +4642,8 @@ format_get_data_set(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e, const char *group, const char *set, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, @@ -4457,7 +4658,7 @@ format_get_data_set(struct plugin_state *state, unsigned int template_len; choices = NULL; template = format_format(state, pb, e, group, set, fmt, disallowed, - &choices, + &choices, restrict_subtrees, ignore_subtrees, rel_attrs, ref_attrs, inref_attrs, ref_attr_list, inref_attr_list, &template_len); diff --git a/src/format.h b/src/format.h index 0aa7d20..4cde2dc 100644 --- a/src/format.h +++ b/src/format.h @@ -59,6 +59,8 @@ char *format_get_data(struct plugin_state *state, const char *domain, const char *map, const char *fmt, const char *disallowed_chars, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, @@ -71,6 +73,8 @@ char **format_get_data_set(struct plugin_state *state, const char *domain, const char *map, const char *fmt, const char *disallowed, + const struct slapi_dn **restrict_subtrees, + const struct slapi_dn **ignore_subtrees, char ***rel_attrs, char ***ref_attrs, struct format_inref_attr ***inref_attrs, diff --git a/tests/test37-schema-ignore/after.sh b/tests/test37-schema-ignore/after.sh new file mode 100755 index 0000000..0579ab2 --- /dev/null +++ b/tests/test37-schema-ignore/after.sh @@ -0,0 +1,5 @@ +#!/bin/sh +echo '[updated]' +search -b "cn=NIS Server,cn=plugins,cn=config" dn nis-domain nis-map | $LDIFSORT +echo '[result]' +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test37-schema-ignore/after.txt b/tests/test37-schema-ignore/after.txt new file mode 100644 index 0000000..cbbef96 --- /dev/null +++ b/tests/test37-schema-ignore/after.txt @@ -0,0 +1,20 @@ +[updated] +dn: cn=NIS Server,cn=plugins,cn=config + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: mac2name + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: name2mac +nis-map: name2mac2 + +[result] +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test37-schema-ignore/before.sh b/tests/test37-schema-ignore/before.sh new file mode 100755 index 0000000..b85c1ab --- /dev/null +++ b/tests/test37-schema-ignore/before.sh @@ -0,0 +1,2 @@ +#!/bin/sh +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test37-schema-ignore/before.txt b/tests/test37-schema-ignore/before.txt new file mode 100644 index 0000000..9c92512 --- /dev/null +++ b/tests/test37-schema-ignore/before.txt @@ -0,0 +1,7 @@ +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test37-schema-ignore/change.sh b/tests/test37-schema-ignore/change.sh new file mode 100755 index 0000000..0db2c95 --- /dev/null +++ b/tests/test37-schema-ignore/change.sh @@ -0,0 +1,15 @@ +#!/bin/sh +modify << EOF +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +changetype: modify +add: nis-map +nis-map: name2mac2 +- + +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +changetype: modify +add: member +member: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +- + +EOF diff --git a/tests/test37-schema-ignore/change.txt b/tests/test37-schema-ignore/change.txt new file mode 100644 index 0000000..50b0ac7 --- /dev/null +++ b/tests/test37-schema-ignore/change.txt @@ -0,0 +1,4 @@ +modifying entry "nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config" + +modifying entry "cn=g2,cn=groups,cn=accounts,dc=example,dc=com" + diff --git a/tests/test37-schema-ignore/description.txt b/tests/test37-schema-ignore/description.txt new file mode 100644 index 0000000..9248be6 --- /dev/null +++ b/tests/test37-schema-ignore/description.txt @@ -0,0 +1 @@ +ignore selected subtrees diff --git a/tests/test37-schema-ignore/dse.ldif b/tests/test37-schema-ignore/dse.ldif new file mode 100644 index 0000000..79e5e3a --- /dev/null +++ b/tests/test37-schema-ignore/dse.ldif @@ -0,0 +1,37 @@ +dn: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +cn: compat-group +schema-compat-container-group: cn=compat,cn=accounts,dc=example,dc=com +schema-compat-container-rdn: ou=group +schema-compat-check-access: yes +schema-compat-search-base: cn=groups,cn=Accounts,dc=example,dc=com +schema-compat-search-base: cn=managed-groups,cn=Accounts,dc=example,dc=com +schema-compat-search-filter: (&(objectClass=posixGroup)(gidNumber>=1500)) +schema-compat-entry-rdn: cn=%{cn} +schema-compat-entry-attribute: objectclass=extensibleObject +schema-compat-entry-attribute: memberUid=%deref_r("member","uid") +schema-compat-entry-attribute: memberCN=%deref_r("member","nis-map") +schema-compat-entry-attribute: gidNumber=%{gidNumber} +schema-compat-ignore-subtree: cn=NIS Server,cn=plugins,cn=config + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: name2mac +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%2") +nis-values-format: %{macaddress} %{cn} + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: mac2name +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%1") +nis-values-format: %{macaddress} %{cn} + diff --git a/tests/test37-schema-ignore/plugin-process-all.txt b/tests/test37-schema-ignore/plugin-process-all.txt new file mode 100644 index 0000000..fc7b80d --- /dev/null +++ b/tests/test37-schema-ignore/plugin-process-all.txt @@ -0,0 +1 @@ +verifying that we get called diff --git a/tests/test37-schema-ignore/userRoot.ldif b/tests/test37-schema-ignore/userRoot.ldif new file mode 100644 index 0000000..f450895 --- /dev/null +++ b/tests/test37-schema-ignore/userRoot.ldif @@ -0,0 +1,87 @@ +# users, accounts, example.com +dn: cn=users,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: users + +# groups, accounts, example.com +dn: cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# managed-groups, accounts, example.com +dn: cn=managed-groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# tuser1, users, accounts, example.com +dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +uid: tuser1 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1003 +gecos: tuser1 +sn: User +homeDirectory: /home/tuser1 +cn: Tim User +uidNumber: 1101 + +# tuser2, users, accounts, example.com +dn: uid=tuser2,cn=users,cn=accounts,dc=example,dc=com +uid: tuser2 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser2 +sn: User +homeDirectory: /home/tuser2 +cn: Timmy User +uidNumber: 1102 + +# tuser3, users, accounts, example.com +dn: uid=tuser3,cn=users,cn=accounts,dc=example,dc=com +uid: tuser3 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser3 +sn: User +homeDirectory: /home/tuser3 +cn: Timothy User +uidNumber: 1103 + +# g1, groups, accounts, example.com +dn: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 1001 +cn: g1 +description: g1 +member: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +member: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config + +# g2, groups, accounts, example.com +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 2002 +cn: g2 +description: g2 +member: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +member: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config + diff --git a/tests/test38-schema-restrict/after.sh b/tests/test38-schema-restrict/after.sh new file mode 100755 index 0000000..0579ab2 --- /dev/null +++ b/tests/test38-schema-restrict/after.sh @@ -0,0 +1,5 @@ +#!/bin/sh +echo '[updated]' +search -b "cn=NIS Server,cn=plugins,cn=config" dn nis-domain nis-map | $LDIFSORT +echo '[result]' +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test38-schema-restrict/after.txt b/tests/test38-schema-restrict/after.txt new file mode 100644 index 0000000..cbbef96 --- /dev/null +++ b/tests/test38-schema-restrict/after.txt @@ -0,0 +1,20 @@ +[updated] +dn: cn=NIS Server,cn=plugins,cn=config + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: mac2name + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: name2mac +nis-map: name2mac2 + +[result] +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test38-schema-restrict/before.sh b/tests/test38-schema-restrict/before.sh new file mode 100755 index 0000000..b85c1ab --- /dev/null +++ b/tests/test38-schema-restrict/before.sh @@ -0,0 +1,2 @@ +#!/bin/sh +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test38-schema-restrict/before.txt b/tests/test38-schema-restrict/before.txt new file mode 100644 index 0000000..9c92512 --- /dev/null +++ b/tests/test38-schema-restrict/before.txt @@ -0,0 +1,7 @@ +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test38-schema-restrict/change.sh b/tests/test38-schema-restrict/change.sh new file mode 100755 index 0000000..0db2c95 --- /dev/null +++ b/tests/test38-schema-restrict/change.sh @@ -0,0 +1,15 @@ +#!/bin/sh +modify << EOF +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +changetype: modify +add: nis-map +nis-map: name2mac2 +- + +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +changetype: modify +add: member +member: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +- + +EOF diff --git a/tests/test38-schema-restrict/change.txt b/tests/test38-schema-restrict/change.txt new file mode 100644 index 0000000..50b0ac7 --- /dev/null +++ b/tests/test38-schema-restrict/change.txt @@ -0,0 +1,4 @@ +modifying entry "nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config" + +modifying entry "cn=g2,cn=groups,cn=accounts,dc=example,dc=com" + diff --git a/tests/test38-schema-restrict/description.txt b/tests/test38-schema-restrict/description.txt new file mode 100644 index 0000000..78e51e5 --- /dev/null +++ b/tests/test38-schema-restrict/description.txt @@ -0,0 +1 @@ +restrict updates to selected subtrees diff --git a/tests/test38-schema-restrict/dse.ldif b/tests/test38-schema-restrict/dse.ldif new file mode 100644 index 0000000..402bbf2 --- /dev/null +++ b/tests/test38-schema-restrict/dse.ldif @@ -0,0 +1,37 @@ +dn: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +cn: compat-group +schema-compat-container-group: cn=compat,cn=accounts,dc=example,dc=com +schema-compat-container-rdn: ou=group +schema-compat-check-access: yes +schema-compat-search-base: cn=groups,cn=Accounts,dc=example,dc=com +schema-compat-search-base: cn=managed-groups,cn=Accounts,dc=example,dc=com +schema-compat-search-filter: (&(objectClass=posixGroup)(gidNumber>=1500)) +schema-compat-entry-rdn: cn=%{cn} +schema-compat-entry-attribute: objectclass=extensibleObject +schema-compat-entry-attribute: memberUid=%deref_r("member","uid") +schema-compat-entry-attribute: memberCN=%deref_r("member","nis-map") +schema-compat-entry-attribute: gidNumber=%{gidNumber} +schema-compat-restrict-subtree: cn=accounts,dc=example,dc=com + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: name2mac +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%2") +nis-values-format: %{macaddress} %{cn} + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: mac2name +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%1") +nis-values-format: %{macaddress} %{cn} + diff --git a/tests/test38-schema-restrict/plugin-process-all.txt b/tests/test38-schema-restrict/plugin-process-all.txt new file mode 100644 index 0000000..fc7b80d --- /dev/null +++ b/tests/test38-schema-restrict/plugin-process-all.txt @@ -0,0 +1 @@ +verifying that we get called diff --git a/tests/test38-schema-restrict/userRoot.ldif b/tests/test38-schema-restrict/userRoot.ldif new file mode 100644 index 0000000..f450895 --- /dev/null +++ b/tests/test38-schema-restrict/userRoot.ldif @@ -0,0 +1,87 @@ +# users, accounts, example.com +dn: cn=users,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: users + +# groups, accounts, example.com +dn: cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# managed-groups, accounts, example.com +dn: cn=managed-groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# tuser1, users, accounts, example.com +dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +uid: tuser1 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1003 +gecos: tuser1 +sn: User +homeDirectory: /home/tuser1 +cn: Tim User +uidNumber: 1101 + +# tuser2, users, accounts, example.com +dn: uid=tuser2,cn=users,cn=accounts,dc=example,dc=com +uid: tuser2 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser2 +sn: User +homeDirectory: /home/tuser2 +cn: Timmy User +uidNumber: 1102 + +# tuser3, users, accounts, example.com +dn: uid=tuser3,cn=users,cn=accounts,dc=example,dc=com +uid: tuser3 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser3 +sn: User +homeDirectory: /home/tuser3 +cn: Timothy User +uidNumber: 1103 + +# g1, groups, accounts, example.com +dn: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 1001 +cn: g1 +description: g1 +member: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +member: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config + +# g2, groups, accounts, example.com +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 2002 +cn: g2 +description: g2 +member: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +member: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config + diff --git a/tests/test39-schema-restrictignore/after.sh b/tests/test39-schema-restrictignore/after.sh new file mode 100755 index 0000000..0579ab2 --- /dev/null +++ b/tests/test39-schema-restrictignore/after.sh @@ -0,0 +1,5 @@ +#!/bin/sh +echo '[updated]' +search -b "cn=NIS Server,cn=plugins,cn=config" dn nis-domain nis-map | $LDIFSORT +echo '[result]' +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test39-schema-restrictignore/after.txt b/tests/test39-schema-restrictignore/after.txt new file mode 100644 index 0000000..cbbef96 --- /dev/null +++ b/tests/test39-schema-restrictignore/after.txt @@ -0,0 +1,20 @@ +[updated] +dn: cn=NIS Server,cn=plugins,cn=config + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: mac2name + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +nis-domain: example.com +nis-map: name2mac +nis-map: name2mac2 + +[result] +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test39-schema-restrictignore/before.sh b/tests/test39-schema-restrictignore/before.sh new file mode 100755 index 0000000..b85c1ab --- /dev/null +++ b/tests/test39-schema-restrictignore/before.sh @@ -0,0 +1,2 @@ +#!/bin/sh +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test39-schema-restrictignore/before.txt b/tests/test39-schema-restrictignore/before.txt new file mode 100644 index 0000000..9c92512 --- /dev/null +++ b/tests/test39-schema-restrictignore/before.txt @@ -0,0 +1,7 @@ +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test39-schema-restrictignore/change.sh b/tests/test39-schema-restrictignore/change.sh new file mode 100755 index 0000000..0db2c95 --- /dev/null +++ b/tests/test39-schema-restrictignore/change.sh @@ -0,0 +1,15 @@ +#!/bin/sh +modify << EOF +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +changetype: modify +add: nis-map +nis-map: name2mac2 +- + +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +changetype: modify +add: member +member: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +- + +EOF diff --git a/tests/test39-schema-restrictignore/change.txt b/tests/test39-schema-restrictignore/change.txt new file mode 100644 index 0000000..50b0ac7 --- /dev/null +++ b/tests/test39-schema-restrictignore/change.txt @@ -0,0 +1,4 @@ +modifying entry "nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config" + +modifying entry "cn=g2,cn=groups,cn=accounts,dc=example,dc=com" + diff --git a/tests/test39-schema-restrictignore/description.txt b/tests/test39-schema-restrictignore/description.txt new file mode 100644 index 0000000..2699c9a --- /dev/null +++ b/tests/test39-schema-restrictignore/description.txt @@ -0,0 +1 @@ +restrict and ignore, working together diff --git a/tests/test39-schema-restrictignore/dse.ldif b/tests/test39-schema-restrictignore/dse.ldif new file mode 100644 index 0000000..1fbf5f9 --- /dev/null +++ b/tests/test39-schema-restrictignore/dse.ldif @@ -0,0 +1,38 @@ +dn: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +cn: compat-group +schema-compat-container-group: cn=compat,cn=accounts,dc=example,dc=com +schema-compat-container-rdn: ou=group +schema-compat-check-access: yes +schema-compat-search-base: cn=groups,cn=Accounts,dc=example,dc=com +schema-compat-search-base: cn=managed-groups,cn=Accounts,dc=example,dc=com +schema-compat-search-filter: (&(objectClass=posixGroup)(gidNumber>=1500)) +schema-compat-entry-rdn: cn=%{cn} +schema-compat-entry-attribute: objectclass=extensibleObject +schema-compat-entry-attribute: memberUid=%deref_r("member","uid") +schema-compat-entry-attribute: memberCN=%deref_r("member","nis-map") +schema-compat-entry-attribute: gidNumber=%{gidNumber} +schema-compat-ignore-subtree: cn=NIS Server,cn=plugins,cn=config +schema-compat-restrict-subtree: cn=accounts,dc=example,dc=com + +dn: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: name2mac +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%2") +nis-values-format: %{macaddress} %{cn} + +dn: nis-domain=example.com+nis-map=mac2name,cn=NIS Server,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +nis-domain: example.com +nis-map: mac2name +nis-base: cn=computers, cn=Accounts, dc=example, dc=com +nis-filter: objectclass=ieee802device +nis-keys-format: %mregsub("%{macaddress} %{cn}","(..:..:..:..:..:..) (.*)","%1") +nis-values-format: %{macaddress} %{cn} + diff --git a/tests/test39-schema-restrictignore/plugin-process-all.txt b/tests/test39-schema-restrictignore/plugin-process-all.txt new file mode 100644 index 0000000..fc7b80d --- /dev/null +++ b/tests/test39-schema-restrictignore/plugin-process-all.txt @@ -0,0 +1 @@ +verifying that we get called diff --git a/tests/test39-schema-restrictignore/userRoot.ldif b/tests/test39-schema-restrictignore/userRoot.ldif new file mode 100644 index 0000000..f450895 --- /dev/null +++ b/tests/test39-schema-restrictignore/userRoot.ldif @@ -0,0 +1,87 @@ +# users, accounts, example.com +dn: cn=users,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: users + +# groups, accounts, example.com +dn: cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# managed-groups, accounts, example.com +dn: cn=managed-groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# tuser1, users, accounts, example.com +dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +uid: tuser1 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1003 +gecos: tuser1 +sn: User +homeDirectory: /home/tuser1 +cn: Tim User +uidNumber: 1101 + +# tuser2, users, accounts, example.com +dn: uid=tuser2,cn=users,cn=accounts,dc=example,dc=com +uid: tuser2 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser2 +sn: User +homeDirectory: /home/tuser2 +cn: Timmy User +uidNumber: 1102 + +# tuser3, users, accounts, example.com +dn: uid=tuser3,cn=users,cn=accounts,dc=example,dc=com +uid: tuser3 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser3 +sn: User +homeDirectory: /home/tuser3 +cn: Timothy User +uidNumber: 1103 + +# g1, groups, accounts, example.com +dn: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 1001 +cn: g1 +description: g1 +member: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +member: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config + +# g2, groups, accounts, example.com +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 2002 +cn: g2 +description: g2 +member: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +member: nis-domain=example.com+nis-map=name2mac,cn=NIS Server,cn=plugins,cn=config + diff --git a/tests/test40-schema-ignoredefault/after.sh b/tests/test40-schema-ignoredefault/after.sh new file mode 100755 index 0000000..278fcae --- /dev/null +++ b/tests/test40-schema-ignoredefault/after.sh @@ -0,0 +1,3 @@ +#!/bin/sh +echo '[result]' +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test40-schema-ignoredefault/after.txt b/tests/test40-schema-ignoredefault/after.txt new file mode 100644 index 0000000..db120fb --- /dev/null +++ b/tests/test40-schema-ignoredefault/after.txt @@ -0,0 +1,8 @@ +[result] +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test40-schema-ignoredefault/before.sh b/tests/test40-schema-ignoredefault/before.sh new file mode 100755 index 0000000..b85c1ab --- /dev/null +++ b/tests/test40-schema-ignoredefault/before.sh @@ -0,0 +1,2 @@ +#!/bin/sh +search -b cn=compat,cn=accounts,dc=example,dc=com dn gidNumber memberCN | $LDIFSORT diff --git a/tests/test40-schema-ignoredefault/before.txt b/tests/test40-schema-ignoredefault/before.txt new file mode 100644 index 0000000..9c92512 --- /dev/null +++ b/tests/test40-schema-ignoredefault/before.txt @@ -0,0 +1,7 @@ +dn: cn=compat,cn=accounts,dc=example,dc=com + +dn: cn=g2,ou=group,cn=compat,cn=accounts,dc=example,dc=com +gidNumber: 2002 + +dn: ou=group,cn=compat,cn=accounts,dc=example,dc=com + diff --git a/tests/test40-schema-ignoredefault/change.sh b/tests/test40-schema-ignoredefault/change.sh new file mode 100755 index 0000000..d1510b9 --- /dev/null +++ b/tests/test40-schema-ignoredefault/change.sh @@ -0,0 +1,18 @@ +#!/bin/sh +add << EOF +dn: cn=reindex now,cn=index,cn=tasks,cn=config +changetype: add +objectclass: top +objectclass: extensibleObject +cn: reindex now +nsInstance: userRoot +nsIndexAttribute: objectclass +nsIndexAttribute: aci +nsIndexAttribute: cn +nsIndexAttribute: mail +nsIndexAttribute: member +nsIndexAttribute: memberOf +nsIndexAttribute: uid +nis-map: bogus + +EOF diff --git a/tests/test40-schema-ignoredefault/change.txt b/tests/test40-schema-ignoredefault/change.txt new file mode 100644 index 0000000..7cfd0b0 --- /dev/null +++ b/tests/test40-schema-ignoredefault/change.txt @@ -0,0 +1,2 @@ +adding new entry "cn=reindex now,cn=index,cn=tasks,cn=config" + diff --git a/tests/test40-schema-ignoredefault/description.txt b/tests/test40-schema-ignoredefault/description.txt new file mode 100644 index 0000000..d883f1f --- /dev/null +++ b/tests/test40-schema-ignoredefault/description.txt @@ -0,0 +1 @@ +ignore default subtrees diff --git a/tests/test40-schema-ignoredefault/dse.ldif b/tests/test40-schema-ignoredefault/dse.ldif new file mode 100644 index 0000000..b134a65 --- /dev/null +++ b/tests/test40-schema-ignoredefault/dse.ldif @@ -0,0 +1,16 @@ +dn: cn=compat-group,cn=Schema Compatibility,cn=plugins,cn=config +objectClass: top +objectClass: extensibleObject +cn: compat-group +schema-compat-container-group: cn=compat,cn=accounts,dc=example,dc=com +schema-compat-container-rdn: ou=group +schema-compat-check-access: yes +schema-compat-search-base: cn=groups,cn=Accounts,dc=example,dc=com +schema-compat-search-base: cn=managed-groups,cn=Accounts,dc=example,dc=com +schema-compat-search-filter: (&(objectClass=posixGroup)(gidNumber>=1500)) +schema-compat-entry-rdn: cn=%{cn} +schema-compat-entry-attribute: objectclass=extensibleObject +schema-compat-entry-attribute: memberUid=%deref_r("member","uid") +schema-compat-entry-attribute: memberCN=%deref_r("member","nis-map") +schema-compat-entry-attribute: gidNumber=%{gidNumber} + diff --git a/tests/test40-schema-ignoredefault/plugin-process-all.txt b/tests/test40-schema-ignoredefault/plugin-process-all.txt new file mode 100644 index 0000000..fc7b80d --- /dev/null +++ b/tests/test40-schema-ignoredefault/plugin-process-all.txt @@ -0,0 +1 @@ +verifying that we get called diff --git a/tests/test40-schema-ignoredefault/userRoot.ldif b/tests/test40-schema-ignoredefault/userRoot.ldif new file mode 100644 index 0000000..cc579f8 --- /dev/null +++ b/tests/test40-schema-ignoredefault/userRoot.ldif @@ -0,0 +1,86 @@ +# users, accounts, example.com +dn: cn=users,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: users + +# groups, accounts, example.com +dn: cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# managed-groups, accounts, example.com +dn: cn=managed-groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: nsContainer +cn: groups + +# tuser1, users, accounts, example.com +dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +uid: tuser1 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1003 +gecos: tuser1 +sn: User +homeDirectory: /home/tuser1 +cn: Tim User +uidNumber: 1101 + +# tuser2, users, accounts, example.com +dn: uid=tuser2,cn=users,cn=accounts,dc=example,dc=com +uid: tuser2 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser2 +sn: User +homeDirectory: /home/tuser2 +cn: Timmy User +uidNumber: 1102 + +# tuser3, users, accounts, example.com +dn: uid=tuser3,cn=users,cn=accounts,dc=example,dc=com +uid: tuser3 +objectClass: top +objectClass: person +objectClass: posixAccount +objectClass: inetUser +loginShell: /bin/sh +gidNumber: 1004 +gecos: tuser3 +sn: User +homeDirectory: /home/tuser3 +cn: Timothy User +uidNumber: 1103 + +# g1, groups, accounts, example.com +dn: cn=g1,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 1001 +cn: g1 +description: g1 +member: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com +member: cn=reindex now,cn=index,cn=tasks,cn=config + +# g2, groups, accounts, example.com +dn: cn=g2,cn=groups,cn=accounts,dc=example,dc=com +objectClass: top +objectClass: groupofnames +objectClass: posixGroup +objectClass: inetUser +gidNumber: 2002 +cn: g2 +description: g2 +member: cn=g1,cn=groups,cn=accounts,dc=example,dc=com + -- cgit