LDAP: Add autorid compatibility mode

7 files changed, 20 insertions, 8 deletions

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index a48602b28..bdbb90214 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -264,6 +264,7 @@ option_strings = {
     'ldap_idmap_range_min' : _('Lower bound for ID-mapping'),
     'ldap_idmap_range_max' : _('Upper bound for ID-mapping'),
     'ldap_idmap_range_size' : _('Number of IDs for each slice when ID-mapping'),
+    'ldap_idmap_autorid_compat' : _('Use autorid-compatible algorithm for ID-mapping'),
 
     # [provider/ldap/auth]
     'ldap_pwd_policy' : _('Policy to evaluate the password expiration'),
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 1cad031fc..0447d0c45 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -113,6 +113,7 @@ ipa_host_ssh_public_key = str, None, false
 ldap_idmap_range_min = int, None, false
 ldap_idmap_range_max = int, None, false
 ldap_idmap_range_size = int, None, false
+ldap_idmap_autorid_compat = bool, None, false
 
 [provider/ipa/auth]
 krb5_ccachedir = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 795181554..1ea1c948b 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -107,6 +107,7 @@ ldap_service_entry_usn = str, None, false
 ldap_idmap_range_min = int, None, false
 ldap_idmap_range_max = int, None, false
 ldap_idmap_range_size = int, None, false
+ldap_idmap_autorid_compat = bool, None, false
 
 [provider/ldap/auth]
 ldap_pwd_policy = str, None, false
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 866bd3ce0..ee9ff15f3 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -117,6 +117,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_idmap_range_min", DP_OPT_NUMBER, { .number = 100001 }, NULL_NUMBER },
     { "ldap_idmap_range_max", DP_OPT_NUMBER, { .number = 2000100000LL }, NULL_NUMBER },
     { "ldap_idmap_range_size", DP_OPT_NUMBER, { .number = 200000 }, NULL_NUMBER },
+    { "ldap_idmap_autorid_compat", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index a4c780691..8b8ea25c6 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -99,6 +99,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_idmap_range_min", DP_OPT_NUMBER, { .number = 100001 }, NULL_NUMBER },
     { "ldap_idmap_range_max", DP_OPT_NUMBER, { .number = 2000100000LL }, NULL_NUMBER },
     { "ldap_idmap_range_size", DP_OPT_NUMBER, { .number = 200000 }, NULL_NUMBER },
+    { "ldap_idmap_autorid_compat", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index d72a0edd9..7c55ad5a0 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -214,6 +214,7 @@ enum sdap_basic_opt {
     SDAP_IDMAP_LOWER,
     SDAP_IDMAP_UPPER,
     SDAP_IDMAP_RANGESIZE,
+    SDAP_IDMAP_AUTORID_COMPAT,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
diff --git a/src/providers/ldap/sdap_idmap.c b/src/providers/ldap/sdap_idmap.c
index ea65195ac..24e7ef371 100644
--- a/src/providers/ldap/sdap_idmap.c
+++ b/src/providers/ldap/sdap_idmap.c
@@ -196,15 +196,21 @@ sdap_idmap_add_domain(struct sdap_idmap_ctx *idmap_ctx,
     } else {
         /* If slice is -1, we're being asked to pick a new slice */
 
-        /* Hash the domain sid string */
-        hash_val = murmurhash3(dom_sid, strlen(dom_sid), 0xdeadbeef);
-
-        /* Now get take the modulus of the hash val and the max_slices
-         * to determine its optimal position in the range.
-         */
-        new_slice->slice_num = hash_val % max_slices;
-        orig_slice = new_slice->slice_num;
+        if (dp_opt_get_bool(idmap_ctx->id_ctx->opts->basic, SDAP_IDMAP_AUTORID_COMPAT)) {
+            /* In autorid compatibility mode, always start at 0 and find the first
+             * free value.
+             */
+            orig_slice = 0;
+        } else {
+            /* Hash the domain sid string */
+            hash_val = murmurhash3(dom_sid, strlen(dom_sid), 0xdeadbeef);
 
+            /* Now get take the modulus of the hash val and the max_slices
+             * to determine its optimal position in the range.
+             */
+            new_slice->slice_num = hash_val % max_slices;
+            orig_slice = new_slice->slice_num;
+        }
         /* Verify that this slice is not already in use */
         do {
             DLIST_FOR_EACH(s, idmap_ctx->slices) {