Merging upstream version 2.9.5.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

7 files changed, 36 insertions, 27 deletions

diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
index 7159d63..2c984ef 100644
--- a/src/providers/ldap/ldap_common.h
+++ b/src/providers/ldap/ldap_common.h
@@ -304,6 +304,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        struct sdap_id_ctx *ctx,
                                        struct sdap_domain *sdom,
                                        struct sdap_id_conn_ctx *conn,
+                                       struct sdap_search_base **search_bases,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index da54816..b3ea233 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -1139,6 +1139,7 @@ struct groups_by_user_state {
     struct sdap_id_op *op;
     struct sysdb_ctx *sysdb;
     struct sss_domain_info *domain;
+    struct sdap_search_base **search_bases;
 
     const char *filter_value;
     int filter_type;
@@ -1160,6 +1161,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        struct sdap_id_ctx *ctx,
                                        struct sdap_domain *sdom,
                                        struct sdap_id_conn_ctx *conn,
+                                       struct sdap_search_base **search_bases,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
@@ -1192,6 +1194,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
     state->extra_value = extra_value;
     state->domain = sdom->dom;
     state->sysdb = sdom->dom->sysdb;
+    state->search_bases = search_bases;
 
     if (state->domain->type == DOM_TYPE_APPLICATION || set_non_posix) {
         state->non_posix = true;
@@ -1254,6 +1257,7 @@ static void groups_by_user_connect_done(struct tevent_req *subreq)
                                   sdap_id_op_handle(state->op),
                                   state->ctx,
                                   state->conn,
+                                  state->search_bases,
                                   state->filter_value,
                                   state->filter_type,
                                   state->extra_value,
@@ -1449,7 +1453,7 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
         }
 
         subreq = groups_by_user_send(state, be_ctx->ev, id_ctx,
-                                     sdom, conn,
+                                     sdom, conn, NULL,
                                      ar->filter_value,
                                      ar->filter_type,
                                      ar->extra_value,
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index f5637c5..956eba9 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -1252,19 +1252,10 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
                                              struct sdap_domain *sdom)
 {
     int ret;
-    char *naming_context = NULL;
 
-    if (!sdom->search_bases
-            || !sdom->user_search_bases
-            || !sdom->group_search_bases
-            || !sdom->netgroup_search_bases
-            || !sdom->host_search_bases
-            || !sdom->sudo_search_bases
-            || !sdom->iphost_search_bases
-            || !sdom->ipnetwork_search_bases
-            || !sdom->autofs_search_bases) {
-        naming_context = get_naming_context(opts->basic, rootdse);
-        if (naming_context == NULL) {
+    if (!sdom->naming_context) {
+        sdom->naming_context = get_naming_context(sdom, rootdse);
+        if (sdom->naming_context == NULL) {
             DEBUG(SSSDBG_CRIT_FAILURE, "get_naming_context failed.\n");
 
             /* This has to be non-fatal, since some servers offer
@@ -1280,7 +1271,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1288,7 +1279,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->user_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_USER_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1296,7 +1287,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->group_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_GROUP_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1304,7 +1295,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->netgroup_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_NETGROUP_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1312,7 +1303,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->host_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_HOST_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1320,7 +1311,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->sudo_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                    SDAP_SUDO_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1328,7 +1319,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->service_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                   SDAP_SERVICE_SEARCH_BASE,
-                                  naming_context);
+                                  sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1336,7 +1327,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->autofs_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                   SDAP_AUTOFS_SEARCH_BASE,
-                                  naming_context);
+                                  sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1344,7 +1335,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->iphost_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_IPHOST_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
@@ -1352,14 +1343,13 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->ipnetwork_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_IPNETWORK_SEARCH_BASE,
-                                   naming_context);
+                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
 
     ret = EOK;
 
 done:
-    talloc_free(naming_context);
     return ret;
 }
 
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 161bc5c..103d50e 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -454,6 +454,17 @@ struct sdap_domain {
 
     char *basedn;
 
+    /* The naming_context could be a more reliable source than basedn for the
+     * actual base DN because basedn is set very early from the domain name
+     * given in sssd.conf. Although it is recommended to use the fully
+     * qualified DNS domain name here it is not required. As a result basedn
+     * might not reflect the actual based DN of the LDAP server. Also pure
+     * LDAP server (i.e. not AD or FreeIPA) might use different schemes to set
+     * the base DN which will not be based on the DNS domain of the LDAP
+     * server. naming_context might be NULL even after connection to an LDAP
+     * server. */
+    char *naming_context;
+
     struct sdap_search_base **search_bases;
     struct sdap_search_base **user_search_bases;
     struct sdap_search_base **group_search_bases;
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index 5458d21..89245f4 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -158,6 +158,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
+                                        struct sdap_search_base **search_bases,
                                         const char *name,
                                         int filter_type,
                                         const char *extra_value,
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 97be594..fb3d8fe 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -2732,6 +2732,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
+                                        struct sdap_search_base **search_bases,
                                         const char *filter_value,
                                         int filter_type,
                                         const char *extra_value,
@@ -2764,7 +2765,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
     state->orig_user = NULL;
     state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
     state->user_base_iter = 0;
-    state->user_search_bases = sdom->user_search_bases;
+    state->user_search_bases = (search_bases == NULL) ? sdom->user_search_bases
+                                                      : search_bases;
     if (!state->user_search_bases) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Initgroups lookup request without a user search base\n");
diff --git a/src/providers/ldap/sdap_idmap.c b/src/providers/ldap/sdap_idmap.c
index 3795ed6..e982308 100644
--- a/src/providers/ldap/sdap_idmap.c
+++ b/src/providers/ldap/sdap_idmap.c
@@ -506,8 +506,8 @@ sdap_idmap_sid_to_unix(struct sdap_idmap_ctx *idmap_ctx,
                                     (uint32_t *)id);
         if (err != IDMAP_SUCCESS) {
             DEBUG(SSSDBG_MINOR_FAILURE,
-                  "Could not convert objectSID [%s] to a UNIX ID\n",
-                   sid_str);
+                  "Could not convert objectSID [%s] to a UNIX ID [%d] [%s]\n",
+                   sid_str, err, idmap_error_string(err));
             ret = EIO;
             goto done;
         }