diff options
| author | Sumit Bose <sbose@redhat.com> | 2015-04-29 16:46:14 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-05-06 10:43:59 +0200 |
| commit | 0f9c28eb52d2b45c8a97f709308dc11377831b8c (patch) | |
| tree | 4fd1d28e4a9fe217fa7e1d3faf43e5c781ec9d50 /src/providers/ipa | |
| parent | 35b178d02dfd293778aefbc0b465a5a3a4b6cd8f (diff) | |
| download | sssd-0f9c28eb52d2b45c8a97f709308dc11377831b8c.tar.gz sssd-0f9c28eb52d2b45c8a97f709308dc11377831b8c.tar.xz sssd-0f9c28eb52d2b45c8a97f709308dc11377831b8c.zip | |
IPA: allow initgroups by UUID for FreeIPA users
If a FreeIPA user is searched with the help of an override name the UUID
from the override anchor is used to search the user. Currently the
initgroups request only allows searches by SID or name. With this patch
a UUID can be used as well.
Related to https://fedorahosted.org/sssd/ticket/2642
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Diffstat (limited to 'src/providers/ipa')
| -rw-r--r-- | src/providers/ipa/ipa_id.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c index 764943479..2bae97cd9 100644 --- a/src/providers/ipa/ipa_id.c +++ b/src/providers/ipa/ipa_id.c @@ -554,6 +554,7 @@ struct ipa_id_get_account_info_state { struct sss_domain_info *domain; struct be_req *be_req; struct be_acct_req *ar; + struct be_acct_req *orig_ar; const char *realm; struct sysdb_attrs *override_attrs; @@ -732,13 +733,25 @@ static void ipa_id_get_account_info_got_override(struct tevent_req *subreq) if (strcmp(state->ar->domain, anchor_domain) == 0) { + state->orig_ar = state->ar; + ret = get_be_acct_req_for_uuid(state, ipa_uuid, state->ar->domain, &state->ar); if (ret != EOK) { - DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_sid failed.\n"); + DEBUG(SSSDBG_OP_FAILURE, "get_be_acct_req_for_uuid failed.\n"); goto fail; } + + if ((state->orig_ar->entry_type & BE_REQ_TYPE_MASK) + == BE_REQ_INITGROUPS) { + DEBUG(SSSDBG_TRACE_ALL, + "Switching back to BE_REQ_INITGROUPS.\n"); + state->ar->entry_type = BE_REQ_INITGROUPS; + state->ar->filter_type = BE_FILTER_UUID; + state->ar->attr_type = BE_ATTR_CORE; + } + } else { DEBUG(SSSDBG_MINOR_FAILURE, "Anchor from a different domain [%s], expected [%s]. " \ |