Use the alternative objectclass in group maps.

Use the alternative group objectclass in queries.

Fixes:
https://fedorahosted.org/sssd/ticket/2436

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

1 files changed, 9 insertions, 2 deletions

diff --git a/src/providers/ldap/sdap_async_nested_groups.c b/src/providers/ldap/sdap_async_nested_groups.c
index b07616a93..ad5667e59 100644
--- a/src/providers/ldap/sdap_async_nested_groups.c
+++ b/src/providers/ldap/sdap_async_nested_groups.c
@@ -1712,6 +1712,7 @@ sdap_nested_group_lookup_group_send(TALLOC_CTX *mem_ctx,
      const char **attrs = NULL;
      const char *base_filter = NULL;
      const char *filter = NULL;
+     char *oc_list;
      errno_t ret;
 
      req = tevent_req_create(mem_ctx, &state,
@@ -1728,8 +1729,14 @@ sdap_nested_group_lookup_group_send(TALLOC_CTX *mem_ctx,
      }
 
      /* create filter */
-     base_filter = talloc_asprintf(attrs, "(&(objectclass=%s)(%s=*))",
-                                   map[SDAP_OC_GROUP].name,
+     oc_list = sdap_make_oc_list(state, map);
+     if (oc_list == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to create objectClass list.\n");
+        ret = ENOMEM;
+        goto immediately;
+     }
+
+     base_filter = talloc_asprintf(attrs, "(&(%s)(%s=*))", oc_list,
                                    map[SDAP_AT_GROUP_NAME].name);
      if (base_filter == NULL) {
          ret = ENOMEM;