summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLukas Slebodnik <lslebodn@redhat.com>2015-04-13 09:50:29 +0200
committerJakub Hrozek <jhrozek@redhat.com>2015-04-14 13:13:30 +0200
commitb9fbeb75e7a4f50f98d979a70a710f9221892483 (patch)
treed544ec4e13ea288b0a2ca6328c61a4b19082021f
parentbad2fc8133d941e5a6c8d8016c9689e039265c61 (diff)
downloadsssd-b9fbeb75e7a4f50f98d979a70a710f9221892483.tar.gz
sssd-b9fbeb75e7a4f50f98d979a70a710f9221892483.tar.xz
sssd-b9fbeb75e7a4f50f98d979a70a710f9221892483.zip
SDAP: Filter ad groups in initgroups
Function sdap_add_incomplete_groups stored domain local groups from subdomain as POSIX group, which should not be done. Resolves: https://fedorahosted.org/sssd/ticket/2614 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
-rw-r--r--src/providers/ldap/sdap_async_initgroups.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 96617aecc..ae617b9c4 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -51,6 +51,7 @@ errno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
time_t now;
char *sid_str = NULL;
bool use_id_mapping;
+ bool need_filter;
char *tmp_name;
/* There are no groups in LDAP but we should add user to groups ?? */
@@ -210,6 +211,17 @@ errno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
uuid = NULL;
}
+ ret = sdap_check_ad_group_type(domain, opts, ldap_groups[ai],
+ groupname, &need_filter);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ if (need_filter) {
+ posix = false;
+ gid = 0;
+ }
+
DEBUG(SSSDBG_TRACE_INTERNAL,
"Adding fake group %s to sysdb\n", groupname);
ret = sysdb_add_incomplete_group(domain, groupname, gid,