summaryrefslogtreecommitdiff
path: root/src/db
diff options
context:
space:
mode:
authorPavel Březina <pbrezina@redhat.com>2013-09-06 13:44:46 +0200
committerJakub Hrozek <jhrozek@redhat.com>2013-09-26 21:11:52 +0200
commit6ff294ac06863ea76463c3fa3549cc46a60b75ad (patch)
treeaaa3e1524f53226b1fa70dd28147c68a2fa4caec /src/db
parent9cc66028cb6e497588a088ff2953e2ca7ed6ca6d (diff)
downloadsssd-6ff294ac06863ea76463c3fa3549cc46a60b75ad.tar.gz
sssd-6ff294ac06863ea76463c3fa3549cc46a60b75ad.tar.bz2
sssd-6ff294ac06863ea76463c3fa3549cc46a60b75ad.zip
sysdb: sysdb_update_members can take either name or dn
We need to work with distinguish names when processing cross-domain membership, because groups and users may be stored in different sysdb tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
Diffstat (limited to 'src/db')
-rw-r--r--src/db/sysdb.h13
-rw-r--r--src/db/sysdb_ops.c67
2 files changed, 60 insertions, 20 deletions
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index f9232176..c2a42d5c 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -690,13 +690,15 @@ int sysdb_add_group_member(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
const char *group,
const char *member,
- enum sysdb_member_type type);
+ enum sysdb_member_type type,
+ bool is_dn);
int sysdb_remove_group_member(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
const char *group,
const char *member,
- enum sysdb_member_type type);
+ enum sysdb_member_type type,
+ bool is_dn);
errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
@@ -705,6 +707,13 @@ errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
const char *const *add_groups,
const char *const *del_groups);
+errno_t sysdb_update_members_dn(struct sysdb_ctx *sysdb,
+ struct sss_domain_info *member_domain,
+ const char *member,
+ enum sysdb_member_type type,
+ const char *const *add_groups,
+ const char *const *del_groups);
+
/* Password caching function.
* If you are in a transaction ignore sysdb and pass in the handle.
* If you are not in a transaction pass NULL in handle and provide sysdb,
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index 0197d8e0..ca23fadb 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -1997,7 +1997,8 @@ sysdb_group_membership_mod(struct sysdb_ctx *sysdb,
const char *group,
const char *member,
enum sysdb_member_type type,
- int modify_op)
+ int modify_op,
+ bool is_dn)
{
struct ldb_dn *group_dn;
struct ldb_dn *member_dn;
@@ -2021,7 +2022,12 @@ sysdb_group_membership_mod(struct sysdb_ctx *sysdb,
goto done;
}
- group_dn = sysdb_group_dn(sysdb, tmp_ctx, domain, group);
+ if (!is_dn) {
+ group_dn = sysdb_group_dn(sysdb, tmp_ctx, domain, group);
+ } else {
+ group_dn = ldb_dn_new(tmp_ctx, sysdb->ldb, group);
+ }
+
if (!group_dn) {
ret = ENOMEM;
goto done;
@@ -2038,10 +2044,11 @@ int sysdb_add_group_member(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
const char *group,
const char *member,
- enum sysdb_member_type type)
+ enum sysdb_member_type type,
+ bool is_dn)
{
- return sysdb_group_membership_mod(sysdb, domain, group,
- member, type, SYSDB_MOD_ADD);
+ return sysdb_group_membership_mod(sysdb, domain, group, member,
+ type, SYSDB_MOD_ADD, is_dn);
}
/* =Remove-member-from-Group(Native/Legacy)=============================== */
@@ -2051,10 +2058,11 @@ int sysdb_remove_group_member(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
const char *group,
const char *member,
- enum sysdb_member_type type)
+ enum sysdb_member_type type,
+ bool is_dn)
{
- return sysdb_group_membership_mod(sysdb, domain, group,
- member, type, SYSDB_MOD_DEL);
+ return sysdb_group_membership_mod(sysdb, domain, group, member,
+ type, SYSDB_MOD_DEL, is_dn);
}
@@ -3116,12 +3124,13 @@ done:
return ret;
}
-errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
- struct sss_domain_info *domain,
- const char *member,
- enum sysdb_member_type type,
- const char *const *add_groups,
- const char *const *del_groups)
+static errno_t sysdb_update_members_ex(struct sysdb_ctx *sysdb,
+ struct sss_domain_info *domain,
+ const char *member,
+ enum sysdb_member_type type,
+ const char *const *add_groups,
+ const char *const *del_groups,
+ bool is_dn)
{
errno_t ret;
errno_t sret;
@@ -3144,8 +3153,8 @@ errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
if (add_groups) {
/* Add the user to all add_groups */
for (i = 0; add_groups[i]; i++) {
- ret = sysdb_add_group_member(sysdb, domain,
- add_groups[i], member, type);
+ ret = sysdb_add_group_member(sysdb, domain, add_groups[i],
+ member, type, is_dn);
if (ret != EOK) {
DEBUG(1, ("Could not add member [%s] to group [%s]. "
"Skipping.\n", member, add_groups[i]));
@@ -3157,8 +3166,8 @@ errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
if (del_groups) {
/* Remove the user from all del_groups */
for (i = 0; del_groups[i]; i++) {
- ret = sysdb_remove_group_member(sysdb, domain,
- del_groups[i], member, type);
+ ret = sysdb_remove_group_member(sysdb, domain, del_groups[i],
+ member, type, is_dn);
if (ret != EOK) {
DEBUG(1, ("Could not remove member [%s] from group [%s]. "
"Skipping\n", member, del_groups[i]));
@@ -3186,6 +3195,28 @@ done:
return ret;
}
+errno_t sysdb_update_members(struct sysdb_ctx *sysdb,
+ struct sss_domain_info *domain,
+ const char *member,
+ enum sysdb_member_type type,
+ const char *const *add_groups,
+ const char *const *del_groups)
+{
+ return sysdb_update_members_ex(sysdb, domain, member, type,
+ add_groups, del_groups, false);
+}
+
+errno_t sysdb_update_members_dn(struct sysdb_ctx *sysdb,
+ struct sss_domain_info *member_domain,
+ const char *member,
+ enum sysdb_member_type type,
+ const char *const *add_groups,
+ const char *const *del_groups)
+{
+ return sysdb_update_members_ex(sysdb, member_domain, member, type,
+ add_groups, del_groups, true);
+}
+
errno_t sysdb_remove_attrs(struct sysdb_ctx *sysdb,
struct sss_domain_info *domain,
const char *name,