diff options
| author | Sumit Bose <sbose@redhat.com> | 2015-01-22 21:20:25 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-01-26 23:41:13 +0100 |
| commit | 63748c69a2c6785d949c82f94749704e0408e5a7 (patch) | |
| tree | 68b843753dba9485c9edf0a613d6f3555e71806c /src/providers/ipa/ipa_subdomains_ext_groups.c | |
| parent | e438fbf102c3d787902504bdae177e84230cbbc9 (diff) | |
| download | sssd-63748c69a2c6785d949c82f94749704e0408e5a7.tar.gz sssd-63748c69a2c6785d949c82f94749704e0408e5a7.tar.xz sssd-63748c69a2c6785d949c82f94749704e0408e5a7.zip | |
IPA: resolve IPA group-memberships for AD users
So far only for initgroups requests the IPA group memberships where
resolved for AD users and due to
6fac5e5f0c54a0f92872ce1450606cfcb577a920 those memberships are not
overridden by other request. But it turned out that the originalMemberOf
attributes related to the IPA group memberships can be overridden by
user lookups. Since the originalMemberOf attribute is important in the
HBAC evaluation this patch makes sure that the originalMemberOf
attribute is not removed but updated during user lookups.
Related to https://fedorahosted.org/sssd/ticket/2560
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Diffstat (limited to 'src/providers/ipa/ipa_subdomains_ext_groups.c')
| -rw-r--r-- | src/providers/ipa/ipa_subdomains_ext_groups.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/providers/ipa/ipa_subdomains_ext_groups.c b/src/providers/ipa/ipa_subdomains_ext_groups.c index 6feca44de..b9690bdb6 100644 --- a/src/providers/ipa/ipa_subdomains_ext_groups.c +++ b/src/providers/ipa/ipa_subdomains_ext_groups.c @@ -452,7 +452,8 @@ struct tevent_req *ipa_get_ad_memberships_send(TALLOC_CTX *mem_ctx, state->domain = domain; state->dp_error = -1; - if ((ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_INITGROUPS + if (((ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_INITGROUPS + && (ar->entry_type & BE_REQ_TYPE_MASK) != BE_REQ_USER) || ar->filter_type != BE_FILTER_NAME) { DEBUG(SSSDBG_OP_FAILURE, "Unsupported request type.\n"); ret = EINVAL; |