>From e0fba806bc2e8fd916029894cf0d8ea2e735865d Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 29 May 2013 16:01:23 +0200 Subject: [PATCH 11/15] LDAP: Do not store separate GID for subdomain users As the subdomains are MPG domains, we don't want to store a separate GID for the subdomain users, but rather just create a UPG. --- src/providers/ldap/sdap_async_users.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c index e4d224cc8b3db9a58f07a24ea53ae5e457fbac89..a368965f68d89508c0faee9ba699c86f5792db02 100644 --- a/src/providers/ldap/sdap_async_users.c +++ b/src/providers/ldap/sdap_async_users.c @@ -267,13 +267,20 @@ int sdap_save_user(TALLOC_CTX *memctx, } if (use_id_mapping) { - ret = sdap_get_idmap_primary_gid(opts, attrs, sid_str, dom_sid_str, - &gid); - if (ret) { - DEBUG(SSSDBG_CRIT_FAILURE, - ("Cannot get the GID for [%s] in domain [%s].\n", - name, dom->name)); - goto done; + if (IS_SUBDOMAIN(dom) == false) { + ret = sdap_get_idmap_primary_gid(opts, attrs, sid_str, dom_sid_str, + &gid); + if (ret) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("Cannot get the GID for [%s] in domain [%s].\n", + name, dom->name)); + goto done; + } + } else { + /* For subdomain users, only create the private group as + * the subdomain is an MPG domain + */ + gid = 0; } /* Store the GID in the ldap_attrs so it doesn't get @@ -294,9 +301,10 @@ int sdap_save_user(TALLOC_CTX *memctx, } /* check that the gid is valid for this domain */ - if (OUT_OF_ID_RANGE(gid, dom->id_min, dom->id_max)) { - DEBUG(2, ("User [%s] filtered out! (primary gid out of range)\n", - name)); + if (IS_SUBDOMAIN(dom) == false && + OUT_OF_ID_RANGE(gid, dom->id_min, dom->id_max)) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("User [%s] filtered out! (primary gid out of range)\n", name)); ret = EINVAL; goto done; } -- 1.8.2.1