diff options
| author | Sumit Bose <sbose@redhat.com> | 2012-10-18 18:04:06 +0200 |
|---|---|---|
| committer | Sumit Bose <sbose@redhat.com> | 2012-10-26 10:32:05 +0200 |
| commit | 28269b2c1fa38e4579853b7afbe30381a8ab8912 (patch) | |
| tree | d75cb99e695834b512525681333fb3c4e37e9f4f /src/providers/krb5/krb5_renew_tgt.c | |
| parent | 73550e4cc5abf4c639a65c7c65d68d9dd2ed64f7 (diff) | |
| download | sssd-28269b2c1fa38e4579853b7afbe30381a8ab8912.tar.gz sssd-28269b2c1fa38e4579853b7afbe30381a8ab8912.tar.bz2 sssd-28269b2c1fa38e4579853b7afbe30381a8ab8912.zip | |
check_ccache_files: search sub-domains as well
If sssd is configured to renew Kerberos tickets automatically ticket of
sub-domain uses should be renewed as well.
Diffstat (limited to 'src/providers/krb5/krb5_renew_tgt.c')
| -rw-r--r-- | src/providers/krb5/krb5_renew_tgt.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/src/providers/krb5/krb5_renew_tgt.c b/src/providers/krb5/krb5_renew_tgt.c index 2ad5592e..217e03d3 100644 --- a/src/providers/krb5/krb5_renew_tgt.c +++ b/src/providers/krb5/krb5_renew_tgt.c @@ -373,7 +373,8 @@ static errno_t check_ccache_files(struct renew_tgt_ctx *renew_tgt_ctx) { TALLOC_CTX *tmp_ctx; int ret; - const char *ccache_filter = "("SYSDB_CCACHE_FILE"=*)"; + const char *ccache_filter = "(&("SYSDB_CCACHE_FILE"=*)" \ + "("SYSDB_OBJECTCLASS"="SYSDB_USER_CLASS"))"; const char *ccache_attrs[] = { SYSDB_CCACHE_FILE, SYSDB_UPN, SYSDB_NAME, NULL }; size_t msgs_count = 0; @@ -382,6 +383,7 @@ static errno_t check_ccache_files(struct renew_tgt_ctx *renew_tgt_ctx) const char *ccache_file; const char *upn; const char *user_name; + struct ldb_dn *base_dn; tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) { @@ -389,10 +391,18 @@ static errno_t check_ccache_files(struct renew_tgt_ctx *renew_tgt_ctx) return ENOMEM; } - ret = sysdb_search_users(tmp_ctx, renew_tgt_ctx->be_ctx->sysdb, - ccache_filter, ccache_attrs, &msgs_count, &msgs); + base_dn = sysdb_base_dn(renew_tgt_ctx->be_ctx->sysdb, tmp_ctx); + if (base_dn == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_base_dn failed.\n")); + ret = ENOMEM; + goto done; + } + + ret = sysdb_search_entry(tmp_ctx, renew_tgt_ctx->be_ctx->sysdb, base_dn, + LDB_SCOPE_SUBTREE, ccache_filter, ccache_attrs, + &msgs_count, &msgs); if (ret != EOK) { - DEBUG(1, ("sysdb_search_users failed.\n")); + DEBUG(1, ("sysdb_search_entry failed.\n")); goto done; } |