diff options
| author | Pavel Reichl <preichl@redhat.com> | 2014-05-21 09:30:13 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-06-02 15:24:53 +0200 |
| commit | 69994add9cd4e57d40b3b7a0b1783ef2d0aa974c (patch) | |
| tree | e45d0d5055bfcb47cbff9a3717bcb803c613380a /src/providers/ldap/sdap_async_initgroups.c | |
| parent | c30f1d05d6c75080fbe8ea9868f291e7a331ad44 (diff) | |
| download | sssd-69994add9cd4e57d40b3b7a0b1783ef2d0aa974c.tar.gz sssd-69994add9cd4e57d40b3b7a0b1783ef2d0aa974c.tar.xz sssd-69994add9cd4e57d40b3b7a0b1783ef2d0aa974c.zip | |
SDAP: Add option to disable use of Token-Groups
Disabling use of Token-Groups is mandatory if expansion of nested groups is not
desired (ldap_group_nesting_level = 0) for AD provider.
Resolves:
https://fedorahosted.org/sssd/ticket/2294
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Diffstat (limited to 'src/providers/ldap/sdap_async_initgroups.c')
| -rw-r--r-- | src/providers/ldap/sdap_async_initgroups.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c index de4e0fbd1..c7169dda7 100644 --- a/src/providers/ldap/sdap_async_initgroups.c +++ b/src/providers/ldap/sdap_async_initgroups.c @@ -2920,7 +2920,8 @@ static void sdap_get_initgr_user(struct tevent_req *subreq) return; } - if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008) { + if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008 + && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) { /* Take advantage of AD's tokenGroups mechanism to look up all * parent groups in a single request. */ @@ -3020,7 +3021,9 @@ static void sdap_get_initgr_done(struct tevent_req *subreq) case SDAP_SCHEMA_RFC2307BIS: case SDAP_SCHEMA_AD: - if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008) { + if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008 + && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) { + ret = sdap_ad_tokengroups_initgroups_recv(subreq); } else if (state->opts->support_matching_rule |