On Fri, Jan 24, 2014 at 12:00:13PM +0100, Sumit Bose wrote: > ACK. > > I wonder if you want to fix a copy-and-paste error in the following > comment before push the patch? > > > @@ -497,7 +513,19 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx, > > /* Convert the UID to its objectSID */ > ^ > > err = sss_idmap_unix_to_sid(ctx->opts->idmap_ctx->map, > > gid, &sid); >
Sure, attached is a patch I'd like to push.
>From 6095e82a99cc1c1fcac5e00f0a770302cc46eb2b Mon Sep 17 00:00:00 2001 From: Jakub Hrozek <jhro...@redhat.com> Date: Fri, 24 Jan 2014 10:02:23 +0100 Subject: [PATCH] LDAP: Don't abort request if no id mapping domain matches If an ID was requested from the back end, but no ID mapping domain matched, the request ended with a scary error message. It's better to treat the request as if no such ID was found in the domain Related: https://fedorahosted.org/sssd/ticket/2200 --- src/providers/ad/ad_id.c | 2 +- src/providers/ldap/ldap_id.c | 42 +++++++++++++++++++++++++++++++++++++----- 2 files changed, 38 insertions(+), 6 deletions(-) diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c index 3d26957b13cd39cf6e07cec5c7656910a15b9f46..85edcf6d604f705f5645f77689c2b4c7471b5edd 100644 --- a/src/providers/ad/ad_id.c +++ b/src/providers/ad/ad_id.c @@ -386,7 +386,7 @@ ad_account_info_complete(struct tevent_req *req) error_text = NULL; } else { DEBUG(SSSDBG_FATAL_FAILURE, - ("Bug: dp_error is OK on failed request")); + ("Bug: dp_error is OK on failed request\n")); dp_error = DP_ERR_FATAL; error_text = req_error_text; } diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c index 6fb67516153629309638c3400afa03be6dbaad2f..422a3b92c281e75eb6c652da756d1271f27dffdf 100644 --- a/src/providers/ldap/ldap_id.c +++ b/src/providers/ldap/ldap_id.c @@ -129,7 +129,19 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx, /* Convert the UID to its objectSID */ err = sss_idmap_unix_to_sid(ctx->opts->idmap_ctx->map, uid, &sid); - if (err != IDMAP_SUCCESS) { + if (err == IDMAP_NO_DOMAIN) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("[%s] did not match any configured ID mapping domain\n", + name)); + + ret = sysdb_delete_user(state->domain, NULL, uid); + if (ret == ENOENT) { + /* Ignore errors to remove users that were not cached previously */ + ret = EOK; + } + + goto fail; + } else if (err != IDMAP_SUCCESS) { DEBUG(SSSDBG_MINOR_FAILURE, ("Mapping ID [%s] to SID failed: [%s]\n", name, idmap_error_string(err))); @@ -213,7 +225,11 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx, return req; fail: - tevent_req_error(req, ret); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, ev); return req; } @@ -494,10 +510,22 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx, goto fail; } - /* Convert the UID to its objectSID */ + /* Convert the GID to its objectSID */ err = sss_idmap_unix_to_sid(ctx->opts->idmap_ctx->map, gid, &sid); - if (err != IDMAP_SUCCESS) { + if (err == IDMAP_NO_DOMAIN) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("[%s] did not match any configured ID mapping domain\n", + name)); + + ret = sysdb_delete_group(state->domain, NULL, gid); + if (ret == ENOENT) { + /* Ignore errors to remove users that were not cached previously */ + ret = EOK; + } + + goto fail; + } else if (err != IDMAP_SUCCESS) { DEBUG(SSSDBG_MINOR_FAILURE, ("Mapping ID [%s] to SID failed: [%s]\n", name, idmap_error_string(err))); @@ -585,7 +613,11 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx, return req; fail: - tevent_req_error(req, ret); + if (ret != EOK) { + tevent_req_error(req, ret); + } else { + tevent_req_done(req); + } tevent_req_post(req, ev); return req; } -- 1.8.4.2
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel