diff options
| author | Pavel Reichl <preichl@redhat.com> | 2014-08-22 13:56:32 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-09-08 19:03:54 +0200 |
| commit | 191d7f7ce3de10d9e19eaa0a6ab3319bcd4ca95d (patch) | |
| tree | 7fd1507a5fddec8f8867e45705a3c5aba248fc69 | |
| parent | 4da27d52078497c5c095f4a4cd9975fe5c83c330 (diff) | |
| download | sssd-191d7f7ce3de10d9e19eaa0a6ab3319bcd4ca95d.tar.gz sssd-191d7f7ce3de10d9e19eaa0a6ab3319bcd4ca95d.tar.xz sssd-191d7f7ce3de10d9e19eaa0a6ab3319bcd4ca95d.zip | |
AD: process non-posix nested groups using tokenGroups
When initgr is performed for AD supporting tokenGroups, do not skip
non-posix groups.
Resolves:
https://fedorahosted.org/sssd/ticket/2343
Reviewed-by: Michal Židek <mzidek@redhat.com>
(cherry picked from commit 4932db6258ccfb612a3a28eb6a618c2f042b9d58)
| -rw-r--r-- | src/providers/ldap/sdap_async_initgroups_ad.c | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/src/providers/ldap/sdap_async_initgroups_ad.c b/src/providers/ldap/sdap_async_initgroups_ad.c index 9b07507bf..574579d9e 100644 --- a/src/providers/ldap/sdap_async_initgroups_ad.c +++ b/src/providers/ldap/sdap_async_initgroups_ad.c @@ -1152,8 +1152,7 @@ sdap_ad_tokengroups_get_posix_members(TALLOC_CTX *mem_ctx, TALLOC_CTX *tmp_ctx = NULL; struct sss_domain_info *domain = NULL; struct ldb_message *msg = NULL; - const char *attrs[] = {SYSDB_NAME, SYSDB_POSIX, NULL}; - const char *is_posix = NULL; + const char *attrs[] = {SYSDB_NAME, NULL}; const char *name = NULL; char *sid = NULL; char **valid_groups = NULL; @@ -1200,12 +1199,6 @@ sdap_ad_tokengroups_get_posix_members(TALLOC_CTX *mem_ctx, ret = sysdb_search_group_by_sid_str(tmp_ctx, domain->sysdb, domain, sid, attrs, &msg); if (ret == EOK) { - is_posix = ldb_msg_find_attr_as_string(msg, SYSDB_POSIX, NULL); - if (is_posix != NULL && strcmp(is_posix, "FALSE") == 0) { - /* skip non-posix group */ - continue; - } - /* we will update membership of this group */ name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); if (name == NULL) { |