From 0535ad2bee920be5c07ee207903c2196eb19c02f Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 24 Jun 2013 12:51:53 +0200 Subject: PAC: do not delete originalDN or cached password if present If the PAC responder recognizes some attribute changes between the cached user entry and the PAC data it quite crudely just removes the cached entry and recreates it. While in most cases all needed data can be recovered from the PAC data there is a case where it is not possible. E.g the IPA HBAC code use the OriginalDN attribute to improve performance when evaluating access rules. This patch makes sure this attribute is not lost when the PAC responder updates the object. --- src/responder/pac/pacsrv_cmd.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/responder/pac/pacsrv_cmd.c b/src/responder/pac/pacsrv_cmd.c index 479a09419..2b11acad4 100644 --- a/src/responder/pac/pacsrv_cmd.c +++ b/src/responder/pac/pacsrv_cmd.c @@ -544,11 +544,12 @@ static errno_t save_pac_user(struct pac_req_ctx *pr_ctx) int ret; const char *attrs[] = {SYSDB_NAME, SYSDB_NAME_ALIAS, SYSDB_UIDNUM, SYSDB_GIDNUM, SYSDB_GECOS, SYSDB_HOMEDIR, - SYSDB_SHELL, NULL}; + SYSDB_SHELL, SYSDB_ORIG_DN, SYSDB_CACHEDPWD, NULL}; struct ldb_message *msg; struct passwd *pwd = NULL; TALLOC_CTX *tmp_ctx = NULL; struct sysdb_attrs *user_attrs = NULL; + const char *tmp_str; sysdb = pr_ctx->dom->sysdb; if (sysdb == NULL) { @@ -581,6 +582,30 @@ static errno_t save_pac_user(struct pac_req_ctx *pr_ctx) DEBUG(SSSDBG_OP_FAILURE, ("sysdb_delete_user failed.\n")); goto done; } + + /* If the entry is delete we might loose the information about the + * original DN of e.g. an IPA user or a chache password. */ + tmp_str = ldb_msg_find_attr_as_string(msg, SYSDB_ORIG_DN, NULL); + if (tmp_str != NULL) { + ret = sysdb_attrs_add_string(user_attrs, SYSDB_ORIG_DN, + tmp_str); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("sysdb_attrs_add_string failed.\n")); + goto done; + } + } + + tmp_str = ldb_msg_find_attr_as_string(msg, SYSDB_CACHEDPWD, NULL); + if (tmp_str != NULL) { + ret = sysdb_attrs_add_string(user_attrs, SYSDB_CACHEDPWD, + tmp_str); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("sysdb_attrs_add_string failed.\n")); + goto done; + } + } } else { goto done; } -- cgit