IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa-kdb: enhance deref searches

Browse Source 
Allow to deref more than one attribute.
The attrs searched are the same for all deref attributes at this time.
This commit is contained in:
Simo Sorce 2011-11-20 20:50:27 -05:00
parent 7d744f82e2
commit 045c7c123e
3 changed files with 39 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
daemons/ipa-kdb/ipa_kdb.h
View File

@ -123,8 +123,11 @@ krb5_error_code ipadb_simple_modify(struct ipadb_context *ipactx,
krb5_error_code ipadb_simple_delete_val(struct ipadb_context *ipactx, krb5_error_code ipadb_simple_delete_val(struct ipadb_context *ipactx,
char *dn, char *attr, char *value); char *dn, char *attr, char *value);
krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx, krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx,
char *entry_dn, char **entry_attrs, char *base_dn, int scope,
char *deref_attr_name, char **deref_attrs, char *filter,
char **entry_attrs,
char **deref_attr_names,
char **deref_attrs,
LDAPMessage **res); LDAPMessage **res);
int ipadb_ldap_attr_to_int(LDAP *lcontext, LDAPMessage *le, int ipadb_ldap_attr_to_int(LDAP *lcontext, LDAPMessage *le,

34
daemons/ipa-kdb/ipa_kdb_common.c
View File

@ -265,24 +265,39 @@ done:
} }
krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx, krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx,
char *entry_dn, char **entry_attrs, char *base_dn, int scope,
char *deref_attr_name, char **deref_attrs, char *filter,
char **entry_attrs,
char **deref_attr_names,
char **deref_attrs,
LDAPMessage **res) LDAPMessage **res)
{ {
struct berval derefval = { 0, NULL }; struct berval derefval = { 0, NULL };
LDAPControl *ctrl[2] = { NULL, NULL }; LDAPControl *ctrl[2] = { NULL, NULL };
LDAPDerefSpec ds[2]; LDAPDerefSpec *ds;
krb5_error_code kerr; krb5_error_code kerr;
int times; int times;
int ret; int ret;
int c;
ds[0].derefAttr = deref_attr_name; for (c = 0; deref_attr_names[c]; c++) {
ds[0].attributes = deref_attrs; /* count */ ;
ds[1].derefAttr = NULL; }
ds = calloc(c, sizeof(LDAPDerefSpec));
if (!ds) {
return ENOMEM;
}
for (c = 0; deref_attr_names[c]; c++) {
ds[c].derefAttr = deref_attr_names[c];
ds[c].attributes = deref_attrs;
}
ret = ldap_create_deref_control_value(ipactx->lcontext, ds, &derefval); ret = ldap_create_deref_control_value(ipactx->lcontext, ds, &derefval);
if (ret != LDAP_SUCCESS) { if (ret != LDAP_SUCCESS) {
return ENOMEM; kerr = ENOMEM;
goto done;
} }
ret = ldap_control_create(LDAP_CONTROL_X_DEREF, ret = ldap_control_create(LDAP_CONTROL_X_DEREF,
@ -297,8 +312,8 @@ krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx,
ret = LDAP_SUCCESS; ret = LDAP_SUCCESS;
while (!ipadb_need_retry(ipactx, ret) && times > 0) { while (!ipadb_need_retry(ipactx, ret) && times > 0) {
times--; times--;
ret = ldap_search_ext_s(ipactx->lcontext, entry_dn, ret = ldap_search_ext_s(ipactx->lcontext, base_dn,
LDAP_SCOPE_BASE, "(objectclass=*)", scope, filter,
entry_attrs, 0, entry_attrs, 0,
ctrl, NULL, ctrl, NULL,
&std_timeout, LDAP_NO_LIMIT, &std_timeout, LDAP_NO_LIMIT,
@ -309,6 +324,7 @@ krb5_error_code ipadb_deref_search(struct ipadb_context *ipactx,
done: done:
ldap_memfree(derefval.bv_val); ldap_memfree(derefval.bv_val);
free(ds);
return kerr; return kerr;
} }

11
daemons/ipa-kdb/ipa_kdb_mspac.c
View File

@ -84,6 +84,11 @@ static char *user_pac_attrs[] = {
NULL NULL
}; };
char *deref_search_attrs[] = {
"memberOf",
NULL
};
static char *memberof_pac_attrs[] = { static char *memberof_pac_attrs[] = {
"gidNumber", "gidNumber",
"ipaNTSecurityIdentifier", "ipaNTSecurityIdentifier",
@ -502,8 +507,10 @@ static krb5_error_code ipadb_get_pac(krb5_context kcontext,
/* == Search PAC info == */ /* == Search PAC info == */
kerr = ipadb_deref_search(ipactx, ied->entry_dn, user_pac_attrs, kerr = ipadb_deref_search(ipactx, ied->entry_dn, LDAP_SCOPE_BASE,
"memberOf", memberof_pac_attrs, &results); "(objectclass=*)", user_pac_attrs,
deref_search_attrs, memberof_pac_attrs,
&results);
if (kerr) { if (kerr) {
goto done; goto done;
} }