3:14 a.m.
On Mon, Dec 01, 2014 at 10:24:23AM +0100, Lukas Slebodnik wrote:
ehlo,
another result of my IPA <-> AD trust issues.
patch is attached.
LS
From 04f07630df690dcbddfa5e4db1cb19935cf6444e Mon Sep 17 00:00:00
2001
From: Lukas Slebodnik <lslebodn(a)redhat.com>
Date: Fri, 28 Nov 2014 14:32:29 +0100
Subject: [PATCH 2/2] IPA: Fix checking of trust in originalDN
In function ipa_subdom_get_forest the comment contains says:
"We are only interested in the member domain objects.
In IPA the forest root object is stored as e.g.
cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the
forest are children of the forest root object e.g.
cn=SUB.AD.DOM,cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com"
The member domain objects contains 6 components in dn, which cuased
error messages for forest root object.
[ipa_subdom_get_forest] (0x4000):
Checking if we need the forest name for
[cn=adtest.dom,cn=ad,cn=trusts,dc=example,dc=test].
[ipa_subdom_get_forest] (0x0400): 4th component is not 'trust', nothing to do.
Hi Lukas,
thank you for catching this. I agree that the log message is irritating
for the forest root, but I think your solution is not the right one.
---
src/providers/ipa/ipa_subdomains.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 6fdb0befa32f96d01c9b3666a3ef9c8331a83242..c1b07c54cafb5fb6256b6bb33322ff3ab4e2aa9b
100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -612,7 +612,7 @@ static errno_t ipa_subdom_get_forest(TALLOC_CTX *mem_ctx,
goto done;
}
- if (ldb_dn_get_comp_num(dn) < 5) {
+ if (ldb_dn_get_comp_num(dn) < 6) {
I think this change will only suppress the log message for the forest
root if the IPA domain has only 2 components. If your IPA domain is e.g.
ipa.test.example.com and hence the base DN
dc=ipa,dc=test,dc=example,dc=com the DN of the forest root will have
more than 6 components. I added this if-block only to check if the DN
has sufficient components for the following checks, not to filter out
the forest root. The comment inside of the if-block might give a wrong
impression here.
/* We are only interested in the member domain objects. In
IPA the
* forest root object is stored as e.g.
* cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the
The main checks are the checks for the 3rd ("ad") and 4th ("trust")
component, if both are successful the current DN is one of a member
domain and we can take the value of the second component as forest name.
To make the log message less irritating for the forest root I see the
following possibilities:
- change the log level and mention in the message that this is most
probably the forest root
- add explicit checks for the forest root (2nd component="ad", 3rd
component="trust) and skip it without a message
- pass the baseDN or some struct holding the baseDN to
ipa_subdom_get_forest() so that all DNs with the wrong number of
components (number of baseDN components + 4) are skipped.
HTH
bye,
Sumit
--
2.1.0
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
3447
days inactive
3448
days old
sssd-devel@lists.fedorahosted.org
1 comments
2 participants
participants (2)
-
Lukas Slebodnik -
Sumit Bose