From 92ea1fda746e2ebc26aca4e5ae4be605f17a46c1 Mon Sep 17 00:00:00 2001 From: "Thierry bordaz (tbordaz)" Date: Thu, 26 Jun 2014 11:57:41 +0200 Subject: [PATCH 1/2] Ticket 47829: memberof scope: allow to exclude subtrees Bug Description: Memberof Plugins can be restricted to a given subtree memberofentryscope (https://fedorahosted.org/389/ticket/47526). A limitation is that the scope is singled valued so there is no possibility to configure several containers but not all of them. For example with https://fedorahosted.org/freeipa/ticket/3813, we need memberof to scope all the suffix except one special container: cn=provisioning,SUFFIX Fix Description: A solution to make 'memberofentryscope' multivalued is possible but not really convenient. For example for https://fedorahosted.org/freeipa/ticket/3813, we would need to all the containers (accounts, sudo, hbac, pbac...) except the 'provisioning' container. The implemented solution is to allow to exclude a subtree from the memberof scoping. So the configuration could be: memberofentryscope: SUFFIX memberofentryscopeexcludesubtree: cn=provisioning,SUFFIX https://fedorahosted.org/389/ticket/47829 Reviewed by: ? Platforms tested: F17/F19/F20 Flag Day: no Doc impact: no --- ldap/servers/plugins/memberof/memberof.c | 23 +++++++++---- ldap/servers/plugins/memberof/memberof.h | 3 ++ ldap/servers/plugins/memberof/memberof_config.c | 44 ++++++++++++++++++++++++- 3 files changed, 63 insertions(+), 7 deletions(-) diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c index 11ac965..8257e9d 100644 --- a/ldap/servers/plugins/memberof/memberof.c +++ b/ldap/servers/plugins/memberof/memberof.c @@ -685,6 +685,7 @@ memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, char *cookie = NULL; int all_backends = memberof_config_get_all_backends(); Slapi_DN *entry_scope = memberof_config_get_entry_scope(); + Slapi_DN *entry_scope_exclude_subtree = memberof_config_get_entry_scope_exclude_subtree(); int types_name_len = 0; int num_types = 0; int dn_len = slapi_sdn_get_ndn_len(sdn); @@ -695,6 +696,10 @@ memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, if (entry_scope && !slapi_sdn_issuffix(sdn, entry_scope)) { return (rc); } + + if (entry_scope_exclude_subtree && slapi_sdn_issuffix(sdn, entry_scope_exclude_subtree)) { + return (rc); + } /* Count the number of types. */ for (num_types = 0; types && types[num_types]; num_types++) @@ -814,6 +819,7 @@ int memberof_postop_modrdn(Slapi_PBlock *pb) int ret = SLAPI_PLUGIN_SUCCESS; void *caller_id = NULL; Slapi_DN *entry_scope = NULL; + Slapi_DN *entry_scope_exclude_subtree = memberof_config_get_entry_scope_exclude_subtree(); entry_scope = memberof_config_get_entry_scope(); slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM, @@ -882,7 +888,8 @@ int memberof_postop_modrdn(Slapi_PBlock *pb) * of other group entries. We need to update any member * attributes to refer to the new name. */ if (ret == LDAP_SUCCESS && pre_sdn && post_sdn) { - if (entry_scope && !slapi_sdn_issuffix(post_sdn, entry_scope)) { + if ((entry_scope && !slapi_sdn_issuffix(post_sdn, entry_scope)) || + (entry_scope_exclude_subtree && slapi_sdn_issuffix(post_sdn, entry_scope_exclude_subtree))) { memberof_del_dn_data del_data = {0, configCopy.memberof_attr}; if((ret = memberof_del_dn_from_groups(pb, &configCopy, pre_sdn))){ slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, @@ -2030,6 +2037,7 @@ int memberof_get_groups_callback(Slapi_Entry *e, void *callback_data) Slapi_Value *group_dn_val = 0; Slapi_ValueSet *groupvals = *((memberof_get_groups_data*)callback_data)->groupvals; Slapi_ValueSet *group_norm_vals = *((memberof_get_groups_data*)callback_data)->group_norm_vals; + Slapi_DN *entry_scope_exclude_subtree = memberof_config_get_entry_scope_exclude_subtree(); int rc = 0; if(slapi_is_shutting_down()){ @@ -2083,11 +2091,14 @@ int memberof_get_groups_callback(Slapi_Entry *e, void *callback_data) goto bail; } - /* Push group_dn_val into the valueset. This memory is now owned - * by the valueset. */ - group_dn_val = slapi_value_new_string(group_dn); - slapi_valueset_add_value_ext(groupvals, group_dn_val, SLAPI_VALUE_FLAG_PASSIN); - slapi_valueset_add_value_ext(group_norm_vals, group_ndn_val, SLAPI_VALUE_FLAG_PASSIN); + /* if the group does not belong to an excluded subtree, adds it to the valueset */ + if (!(entry_scope_exclude_subtree && slapi_sdn_issuffix(group_sdn, entry_scope_exclude_subtree))) { + /* Push group_dn_val into the valueset. This memory is now owned + * by the valueset. */ + group_dn_val = slapi_value_new_string(group_dn); + slapi_valueset_add_value_ext(groupvals, group_dn_val, SLAPI_VALUE_FLAG_PASSIN); + slapi_valueset_add_value_ext(group_norm_vals, group_ndn_val, SLAPI_VALUE_FLAG_PASSIN); + } /* now recurse to find parent groups of e */ memberof_get_groups_r(((memberof_get_groups_data*)callback_data)->config, diff --git a/ldap/servers/plugins/memberof/memberof.h b/ldap/servers/plugins/memberof/memberof.h index d0532cf..6d56081 100644 --- a/ldap/servers/plugins/memberof/memberof.h +++ b/ldap/servers/plugins/memberof/memberof.h @@ -68,6 +68,7 @@ #define MEMBEROF_ATTR "memberOfAttr" #define MEMBEROF_BACKEND_ATTR "memberOfAllBackends" #define MEMBEROF_ENTRY_SCOPE_ATTR "memberOfEntryScope" +#define MEMBEROF_ENTRY_SCOPE_EXCLUDE_SUBTREE "memberOfEntryScopeExcludeSubtree" #define DN_SYNTAX_OID "1.3.6.1.4.1.1466.115.121.1.12" #define NAME_OPT_UID_SYNTAX_OID "1.3.6.1.4.1.1466.115.121.1.34" @@ -80,6 +81,7 @@ typedef struct memberofconfig { char *memberof_attr; int allBackends; Slapi_DN *entryScope; + Slapi_DN *entryScopeExcludeSubtree; Slapi_Filter *group_filter; Slapi_Attr **group_slapiattrs; } MemberOfConfig; @@ -99,6 +101,7 @@ void memberof_wlock_config(); void memberof_unlock_config(); int memberof_config_get_all_backends(); Slapi_DN * memberof_config_get_entry_scope(); +Slapi_DN * memberof_config_get_entry_scope_exclude_subtree(); void memberof_set_config_area(Slapi_DN *sdn); Slapi_DN * memberof_get_config_area(); void memberof_set_plugin_area(Slapi_DN *sdn); diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c index 0c10dbe..df8ddcb 100644 --- a/ldap/servers/plugins/memberof/memberof_config.c +++ b/ldap/servers/plugins/memberof/memberof_config.c @@ -77,7 +77,7 @@ static int memberof_search (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_En /* This is the main configuration which is updated from dse.ldif. The * config will be copied when it is used by the plug-in to prevent it * being changed out from under a running memberOf operation. */ -static MemberOfConfig theConfig = {NULL, NULL,0, NULL, NULL, NULL}; +static MemberOfConfig theConfig = {NULL, NULL,0, NULL, NULL, NULL, NULL}; static Slapi_RWLock *memberof_config_lock = 0; static int inited = 0; @@ -336,6 +336,7 @@ memberof_apply_config (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* int groupattr_name_len = 0; char *allBackends = NULL; char *entryScope = NULL; + char *entryScopeExcludeSubtree = NULL; char *sharedcfg = NULL; *returncode = LDAP_SUCCESS; @@ -387,6 +388,7 @@ memberof_apply_config (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* memberof_attr = slapi_entry_attr_get_charptr(e, MEMBEROF_ATTR); allBackends = slapi_entry_attr_get_charptr(e, MEMBEROF_BACKEND_ATTR); entryScope = slapi_entry_attr_get_charptr(e, MEMBEROF_ENTRY_SCOPE_ATTR); + entryScopeExcludeSubtree = slapi_entry_attr_get_charptr(e, MEMBEROF_ENTRY_SCOPE_EXCLUDE_SUBTREE); /* We want to be sure we don't change the config in the middle of * a memberOf operation, so we obtain an exclusive lock here */ @@ -511,6 +513,35 @@ memberof_apply_config (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* } else { theConfig.entryScope = NULL; } + + slapi_sdn_free(&theConfig.entryScopeExcludeSubtree); + if (entryScopeExcludeSubtree) + { + if (theConfig.entryScope == NULL) { + slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "Error: Ignoring ExcludeSubtree (%s) because entryScope is not define\n", + entryScopeExcludeSubtree); + theConfig.entryScopeExcludeSubtree = NULL; + slapi_ch_free_string(&entryScopeExcludeSubtree); + } else if (slapi_dn_syntax_check(NULL, entryScopeExcludeSubtree, 1) == 1) { + slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "Error: Ignoring invalid DN used as plugin entry exclude subtree: [%s]\n", + entryScopeExcludeSubtree); + theConfig.entryScopeExcludeSubtree = NULL; + slapi_ch_free_string(&entryScopeExcludeSubtree); + } else { + theConfig.entryScopeExcludeSubtree = slapi_sdn_new_dn_passin(entryScopeExcludeSubtree); + } + } else { + theConfig.entryScopeExcludeSubtree = NULL; + } + if (theConfig.entryScopeExcludeSubtree && theConfig.entryScope && !slapi_sdn_issuffix(theConfig.entryScopeExcludeSubtree, theConfig.entryScope)) { + slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "Error: Ignoring ExcludeSubtree (%s) that is out of the scope (%s)\n", + slapi_sdn_get_dn(theConfig.entryScopeExcludeSubtree), + slapi_sdn_get_dn(theConfig.entryScope)); + slapi_sdn_free(&theConfig.entryScopeExcludeSubtree); + } /* release the lock */ memberof_unlock_config(); @@ -703,6 +734,17 @@ memberof_config_get_entry_scope() return entry_scope; } +Slapi_DN * +memberof_config_get_entry_scope_exclude_subtree() +{ + Slapi_DN *entry_exclude_subtree; + + slapi_rwlock_rdlock(memberof_config_lock); + entry_exclude_subtree = theConfig.entryScopeExcludeSubtree; + slapi_rwlock_unlock(memberof_config_lock); + + return entry_exclude_subtree; +} /* * Check if we are modifying the config, or changing the shared config entry */ -- 1.7.11.7