Attachment 65946 Details for Bug 53889 – Add support for specifying a computer OU LDAP DN when joining

[patch] Add support for specifying a computer OU LDAP DN when joining

0002-Add-support-for-specifying-a-computer-OU-LDAP-DN-whe.patch (text/plain), 25.93 KB, created by Stef Walter on 2012-08-22 12:06:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stef Walter

Created: 2012-08-22 12:06:04 UTC

Size: 25.93 KB

patch

obsolete

>From 5aff2a7df7ba9032fdf007a46ed78147a41d1640 Mon Sep 17 00:00:00 2001
>From: Stef Walter <stefw@gnome.org>
>Date: Wed, 22 Aug 2012 13:48:09 +0200
>Subject: [PATCH 2/2] Add support for specifying a computer OU LDAP DN when
> joining
>
> * Now requires the openldap client libraries
> * Add new --computer-ou argument to 'realm join'
> * Support 'computer-ou' option passed to o.f.r.KerberosMembership.Join()
> * Format is in full LDAP DN format.
> * An administrator can include a section like this to specify
>   a default computer-ou to join to:
>
>   [the.example.com]
>   join-computer-ou = OU=Workstations
>
>https://bugs.freedesktop.org/show_bug.cgi?id=53889
>---
> .gitignore                   |   1 +
> configure.ac                 |  16 +++++
> service/Makefile.am          |   3 +
> service/realm-kerberos.c     |  20 ++++++
> service/realm-kerberos.h     |   3 +
> service/realm-samba-enroll.c |  29 +++++++-
> service/realm-samba-enroll.h |   1 +
> service/realm-samba-util.c   | 166 +++++++++++++++++++++++++++++++++++++++++++
> service/realm-samba-util.h   |  29 ++++++++
> service/realm-samba.c        |  23 ++++--
> service/realm-sssd-ad.c      |  23 ++++--
> tests/Makefile.am            |   6 ++
> tests/test-samba-ou-format.c |  80 +++++++++++++++++++++
> tools/realm-enroll.c         |  18 +++--
> 14 files changed, 396 insertions(+), 22 deletions(-)
> create mode 100644 service/realm-samba-util.c
> create mode 100644 service/realm-samba-util.h
> create mode 100644 tests/test-samba-ou-format.c
>
>diff --git a/.gitignore b/.gitignore
>index 64173a0..9655d8f 100644
>--- a/.gitignore
>+++ b/.gitignore
>@@ -69,6 +69,7 @@ temp.txt
> /tests/test-samba-config
> /tests/test-login-name
> /tests/test-sssd-config
>+/tests/test-samba-ou-format
> 
> /tools/realm
> /tools/realm-enroll
>diff --git a/configure.ac b/configure.ac
>index 5c5a19c..66ca833 100644
>--- a/configure.ac
>+++ b/configure.ac
>@@ -122,6 +122,22 @@ AC_SUBST(KRB5_CFLAGS)
> AC_SUBST(KRB5_LIBS)
> 
> # -------------------------------------------------------------------
>+# LDAP
>+
>+LDAP_LIBS=""
>+
>+AC_CHECK_LIB(ldap, ldap_search)
>+AC_CHECK_LIB(lber, ber_pvt_opt_on)
>+AC_CHECK_HEADERS(ldap.h)
>+AC_CHECK_LIB(resolv, res_query, LDAP_LIBS="-lresolv")
>+
>+LDAP_LIBS="$LDAP_LIBS -lldap -llber"
>+LDAP_CFLAGS=""
>+
>+AC_SUBST(LDAP_LIBS)
>+AC_SUBST(LDAP_CFLAGS)
>+
>+# -------------------------------------------------------------------
> # Directories
> 
> DBUS_SERVICES_DIR="${datadir}/dbus-1/system-services"
>diff --git a/service/Makefile.am b/service/Makefile.am
>index f869041..22a8a10 100644
>--- a/service/Makefile.am
>+++ b/service/Makefile.am
>@@ -36,6 +36,7 @@ realmd_SOURCES = \
> 	realm-samba-config.c realm-samba-config.h \
> 	realm-samba-enroll.c realm-samba-enroll.h \
> 	realm-samba-provider.c realm-samba-provider.h \
>+	realm-samba-util.c realm-samba-util.h \
> 	realm-samba-winbind.c realm-samba-winbind.h \
> 	realm-service.c realm-service.h \
> 	realm-service-systemd.c realm-service-systemd.h \
>@@ -60,6 +61,7 @@ realmd_CFLAGS = \
> 	$(POLKIT_CFLAGS) \
> 	$(GLIB_CFLAGS) \
> 	$(KRB5_CFLAGS) \
>+	$(LDAP_CFLAGS) \
> 	$(NULL)
> 
> realmd_LDADD = \
>@@ -68,6 +70,7 @@ realmd_LDADD = \
> 	$(POLKIT_LIBS) \
> 	$(GLIB_LIBS) \
> 	$(KRB5_LIBS) \
>+	$(LDAP_LIBS) \
> 	$(NULL)
> 
> # Install and uninstall the config for this distro
>diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
>index 0a8b22a..cdae6ab 100644
>--- a/service/realm-kerberos.c
>+++ b/service/realm-kerberos.c
>@@ -23,6 +23,7 @@
> #include "realm-errors.h"
> #include "realm-kerberos.h"
> #include "realm-login-name.h"
>+#include "realm-settings.h"
> 
> #include <krb5/krb5.h>
> 
>@@ -1188,3 +1189,22 @@ realm_kerberos_set_configured (RealmKerberos *self,
> 	realm_dbus_realm_set_configured (self->pv->realm_iface,
> 	                                 configured ? REALM_DBUS_KERBEROS_MEMBERSHIP_INTERFACE : "");
> }
>+
>+gchar *
>+realm_kerberos_calculate_join_computer_ou (RealmKerberos *self,
>+                                           GVariant *options)
>+{
>+	const gchar *computer_ou = NULL;
>+
>+	g_return_val_if_fail (REALM_IS_KERBEROS (self), NULL);
>+
>+	if (options) {
>+		if (!g_variant_lookup (options, "computer-ou", "&s", &computer_ou))
>+			computer_ou = NULL;
>+	}
>+
>+	if (!computer_ou)
>+		computer_ou = realm_settings_value (realm_kerberos_get_name (self), "join-computer-ou");
>+
>+	return g_strdup (computer_ou);
>+}
>diff --git a/service/realm-kerberos.h b/service/realm-kerberos.h
>index bb85ace..50b6eaa 100644
>--- a/service/realm-kerberos.h
>+++ b/service/realm-kerberos.h
>@@ -199,6 +199,9 @@ void                realm_kerberos_set_details                 (RealmKerberos *s
> void                realm_kerberos_set_configured              (RealmKerberos *self,
>                                                                 gboolean configured);
> 
>+gchar *             realm_kerberos_calculate_join_computer_ou  (RealmKerberos *self,
>+                                                                GVariant *options);
>+
> G_END_DECLS
> 
> #endif /* __REALM_KERBEROS_H__ */
>diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
>index 4fb916d..11913b7 100644
>--- a/service/realm-samba-enroll.c
>+++ b/service/realm-samba-enroll.c
>@@ -22,10 +22,13 @@
> #include "realm-samba-config.h"
> #include "realm-samba-enroll.h"
> #include "realm-samba-provider.h"
>+#include "realm-samba-util.h"
> #include "realm-settings.h"
> 
> #include <glib/gstdio.h>
> 
>+#include <ldap.h>
>+
> #include <errno.h>
> #include <fcntl.h>
> #include <string.h>
>@@ -34,6 +37,7 @@ typedef struct {
> 	GCancellable *cancellable;
> 	GDBusMethodInvocation *invocation;
> 	gchar *kerberos_cache_filename;
>+	gchar *create_computer_arg;
> 	GHashTable *settings;
> 	gchar **environ;
> 	gchar *realm;
>@@ -55,6 +59,7 @@ join_closure_free (gpointer data)
> 		g_free (join->kerberos_cache_filename);
> 	}
> 
>+	g_free (join->create_computer_arg);
> 	g_free (join->realm);
> 	g_strfreev (join->environ);
> 	if (join->settings)
>@@ -325,7 +330,8 @@ on_conf_do_join (GObject *source,
> 
> 	if (error == NULL) {
> 		begin_net_process (join,  on_join_do_keytab, g_object_ref (res),
>-		                   "-k", "ads", "join", join->realm, NULL);
>+		                   "-k", "ads", "join", join->realm,
>+		                   join->create_computer_arg, NULL);
> 
> 	} else {
> 		g_simple_async_result_take_error (res, error);
>@@ -338,6 +344,7 @@ on_conf_do_join (GObject *source,
> void
> realm_samba_enroll_join_async (const gchar *realm,
>                                GBytes *admin_kerberos_cache,
>+                               const gchar *computer_ou,
>                                GDBusMethodInvocation *invocation,
>                                GAsyncReadyCallback callback,
>                                gpointer user_data)
>@@ -345,6 +352,7 @@ realm_samba_enroll_join_async (const gchar *realm,
> 	GSimpleAsyncResult *res;
> 	JoinClosure *join;
> 	GError *error = NULL;
>+	gchar *strange_ou;
> 
> 	g_return_if_fail (realm != NULL);
> 	g_return_if_fail (admin_kerberos_cache != NULL);
>@@ -353,11 +361,26 @@ realm_samba_enroll_join_async (const gchar *realm,
> 	                                 realm_samba_enroll_join_async);
> 
> 	join = join_closure_init (realm, admin_kerberos_cache, invocation, &error);
>-	if (join == NULL) {
>+
>+	if (error == NULL) {
>+		g_simple_async_result_set_op_res_gpointer (res, join, join_closure_free);
>+
>+		if (computer_ou != NULL) {
>+			strange_ou = realm_samba_util_build_strange_ou (computer_ou, realm);
>+			if (strange_ou) {
>+				join->create_computer_arg = g_strdup_printf ("createcomputer=%s", strange_ou);
>+				g_free (strange_ou);
>+			} else {
>+				g_set_error (&error, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+				             "The computer-ou argument must be a valid LDAP DN and contain only OU=xxx RDN values.");
>+			}
>+		}
>+	}
>+
>+	if (error != NULL) {
> 		g_simple_async_result_take_error (res, error);
> 		g_simple_async_result_complete_in_idle (res);
> 	} else {
>-		g_simple_async_result_set_op_res_gpointer (res, join, join_closure_free);
> 		begin_net_process (join, on_conf_do_join, g_object_ref (res),
> 		                   "conf", "setparm", REALM_SAMBA_CONFIG_GLOBAL,
> 		                   "realm", join->realm, NULL);
>diff --git a/service/realm-samba-enroll.h b/service/realm-samba-enroll.h
>index 8f6244b..afb4c7e 100644
>--- a/service/realm-samba-enroll.h
>+++ b/service/realm-samba-enroll.h
>@@ -32,6 +32,7 @@ const static krb5_enctype REALM_SAMBA_ENROLL_ENC_TYPES[] = {
> 
> void               realm_samba_enroll_join_async     (const gchar *realm,
>                                                       GBytes *admin_kerberos_cache,
>+                                                      const gchar *computer_ou,
>                                                       GDBusMethodInvocation *invocation,
>                                                       GAsyncReadyCallback callback,
>                                                       gpointer user_data);
>diff --git a/service/realm-samba-util.c b/service/realm-samba-util.c
>new file mode 100644
>index 0000000..3565ca0
>--- /dev/null
>+++ b/service/realm-samba-util.c
>@@ -0,0 +1,166 @@
>+/* realmd -- Realm configuration service
>+ *
>+ * Copyright 2012 Red Hat Inc
>+ *
>+ * This program is free software: you can redistribute it and/or modify
>+ * it under the terms of the GNU Lesser General Public License as published
>+ * by the Free Software Foundation; either version 2 of the licence or (at
>+ * your option) any later version.
>+ *
>+ * See the included COPYING file for more information.
>+ *
>+ * Author: Stef Walter <stefw@gnome.org>
>+ */
>+
>+#include "config.h"
>+
>+#include "realm-samba-util.h"
>+
>+#include <glib.h>
>+
>+#include <ldap.h>
>+
>+static gboolean
>+berval_is_string (const struct berval *bv,
>+                  const gchar *string,
>+                  gsize length)
>+{
>+	return (bv->bv_len == length &&
>+	        g_ascii_strncasecmp (bv->bv_val, string, length) == 0);
>+
>+}
>+
>+static gboolean
>+berval_case_equals (const struct berval *v1,
>+                    const struct berval *v2)
>+{
>+	return (v1->bv_len == v2->bv_len &&
>+	        g_ascii_strncasecmp (v1->bv_val, v2->bv_val, v1->bv_len) == 0);
>+}
>+
>+static gboolean
>+dn_equals_domain (LDAPDN dn,
>+                  const gchar *domain)
>+{
>+	LDAPDN domain_dn;
>+	gchar *domain_dn_str;
>+	gboolean ret;
>+	int rc;
>+	gint i, j;
>+
>+	rc = ldap_domain2dn (domain, &domain_dn_str);
>+	g_return_val_if_fail (rc == LDAP_SUCCESS, FALSE);
>+
>+	rc = ldap_str2dn (domain_dn_str, &domain_dn, LDAP_DN_FORMAT_LDAPV3);
>+	g_return_val_if_fail (rc == LDAP_SUCCESS, FALSE);
>+
>+	g_free (domain_dn_str);
>+
>+	for (i = 0; dn[i] != NULL && domain_dn[i] != NULL; i++) {
>+		for (j = 0; dn[i][j] != NULL && domain_dn[i][j] != NULL; j++) {
>+			if (!berval_case_equals (&(dn[i][j]->la_attr), &(domain_dn[i][j]->la_attr)) &&
>+			    !berval_case_equals (&(dn[i][j]->la_value), &(domain_dn[i][j]->la_value)))
>+				break;
>+		}
>+
>+		if (dn[i][j] != NULL && domain_dn[i][j] != NULL)
>+			break;
>+	}
>+
>+	/* Did we reach end of both DNs? */
>+	ret = (dn[i] == NULL && domain_dn[i] == NULL);
>+
>+	ldap_dnfree (domain_dn);
>+
>+	return ret;
>+}
>+
>+gchar *
>+realm_samba_util_build_strange_ou (const gchar *ldap_dn,
>+                                   const gchar *domain)
>+{
>+	GArray *parts;
>+	GString *part;
>+	gchar **strv;
>+	gchar *str;
>+	LDAPAVA* ava;
>+	gboolean ret;
>+	LDAPDN dn;
>+	int rc;
>+	gint i, j;
>+
>+	/*
>+	 * Here we convert a standard LDAP DN to the strange samba net format,
>+	 * as "documented" here:
>+	 *
>+	 * createcomputer=OU  Precreate the computer account in a specific OU.
>+	 *                    The OU string read from top to bottom without RDNs and delimited by a '/'.
>+	 *                    E.g. "createcomputer=Computers/Servers/Unix"
>+	 *                    NB: A backslash '\' is used as escape at multiple levels and may
>+	 *                        need to be doubled or even quadrupled.  It is not used as a separator.
>+	 */
>+
>+	rc = ldap_str2dn (ldap_dn, &dn, LDAP_DN_FORMAT_LDAPV3);
>+	if (rc != LDAP_SUCCESS)
>+		return NULL;
>+
>+	ret = TRUE;
>+	parts = g_array_new (TRUE, TRUE, sizeof (gchar *));
>+
>+	for (i = 0; dn[i] != NULL; i++) {
>+		ava = dn[i][0];
>+
>+		/*
>+		 * Make sure this is a valid DN, we only support one value per
>+		 * RDN, string values, and must be an OU. DC values are allowed
>+		 * but only at the end of the DN.
>+		 */
>+
>+		if (ava == NULL || dn[i][1] != NULL || !(ava->la_flags & LDAP_AVA_STRING)) {
>+			ret = FALSE;
>+			break;
>+
>+		/* A DC, remainder must match the domain */
>+		} else if (berval_is_string (&ava->la_attr, "DC", 2)) {
>+			ret = dn_equals_domain (dn + i, domain);
>+			break;
>+
>+		/* An OU, include */
>+		} else if (berval_is_string (&ava->la_attr, "OU", 2)) {
>+			part = g_string_sized_new (ava->la_value.bv_len);
>+			for (j = 0; j < ava->la_value.bv_len; j++) {
>+				switch (ava->la_value.bv_val[j]) {
>+				case '\\':
>+					g_string_append (part, "\\\\");
>+					break;
>+				case '/':
>+					g_string_append (part, "\\/");
>+					break;
>+				default:
>+					g_string_append_c (part, ava->la_value.bv_val[j]);
>+					break;
>+				}
>+			}
>+			str = g_string_free (part, FALSE);
>+			g_array_insert_val (parts, 0, str);
>+
>+		/* Invalid, stop */
>+		} else {
>+			ret = FALSE;
>+			break;
>+		}
>+	}
>+
>+	ldap_dnfree (dn);
>+
>+	strv = (gchar **)g_array_free (parts, FALSE);
>+	str = NULL;
>+
>+	/* Loop completed successfully */
>+	if (ret)
>+		str = g_strjoinv ("/", strv);
>+
>+	g_strfreev (strv);
>+
>+	return str;
>+}
>diff --git a/service/realm-samba-util.h b/service/realm-samba-util.h
>new file mode 100644
>index 0000000..2a680e7
>--- /dev/null
>+++ b/service/realm-samba-util.h
>@@ -0,0 +1,29 @@
>+/* realmd -- Realm configuration service
>+ *
>+ * Copyright 2012 Red Hat Inc
>+ *
>+ * This program is free software: you can redistribute it and/or modify
>+ * it under the terms of the GNU Lesser General Public License as published
>+ * by the Free Software Foundation; either version 2 of the licence or (at
>+ * your option) any later version.
>+ *
>+ * See the included COPYING file for more information.
>+ *
>+ * Author: Stef Walter <stefw@gnome.org>
>+ */
>+
>+#include "config.h"
>+
>+#ifndef __REALM_SAMBA_UTIL_H__
>+#define __REALM_SAMBA_UTIL_H__
>+
>+#include <gio/gio.h>
>+
>+G_BEGIN_DECLS
>+
>+gchar *           realm_samba_util_build_strange_ou   (const gchar *ldap_dn,
>+                                                       const gchar *suffix_dn);
>+
>+G_END_DECLS
>+
>+#endif /* __REALM_SAMBA_UTIL_H__ */
>diff --git a/service/realm-samba.c b/service/realm-samba.c
>index fd72874..78c2706 100644
>--- a/service/realm-samba.c
>+++ b/service/realm-samba.c
>@@ -138,6 +138,7 @@ lookup_login_prefix (RealmSamba *self)
> typedef struct {
> 	GDBusMethodInvocation *invocation;
> 	GBytes *ccache;
>+	gchar *computer_ou;
> 	gchar *realm_name;
> } EnrollClosure;
> 
>@@ -146,6 +147,7 @@ enroll_closure_free (gpointer data)
> {
> 	EnrollClosure *enroll = data;
> 	g_free (enroll->realm_name);
>+	g_free (enroll->computer_ou);
> 	g_object_unref (enroll->invocation);
> 	g_bytes_unref (enroll->ccache);
> 	g_slice_free (EnrollClosure, enroll);
>@@ -222,8 +224,8 @@ on_install_do_join (GObject *source,
> 	realm_packages_install_finish (result, &error);
> 	if (error == NULL) {
> 		realm_samba_enroll_join_async (enroll->realm_name, enroll->ccache,
>-		                               enroll->invocation, on_join_do_winbind,
>-		                               g_object_ref (res));
>+		                               enroll->computer_ou, enroll->invocation,
>+		                               on_join_do_winbind, g_object_ref (res));
> 
> 	} else {
> 		g_simple_async_result_take_error (res, error);
>@@ -275,6 +277,7 @@ realm_samba_enroll_async (RealmKerberos *realm,
> 	enroll = g_slice_new0 (EnrollClosure);
> 	enroll->realm_name = g_strdup (realm_kerberos_get_realm_name (realm));
> 	enroll->invocation = g_object_ref (invocation);
>+	enroll->computer_ou = realm_kerberos_calculate_join_computer_ou (realm, options);
> 	g_simple_async_result_set_op_res_gpointer (res, enroll, enroll_closure_free);
> 
> 	/* Make sure not already enrolled in a realm */
>@@ -395,6 +398,7 @@ realm_samba_unenroll_async (RealmKerberos *realm,
> 	GSimpleAsyncResult *res;
> 	UnenrollClosure *unenroll;
> 	const gchar *realm_name;
>+	const gchar *computer_ou;
> 	gchar *enrolled;
> 
> 	realm_name = realm_kerberos_get_realm_name (REALM_KERBEROS (self));
>@@ -408,14 +412,19 @@ realm_samba_unenroll_async (RealmKerberos *realm,
> 
> 	/* Check that enrolled in this realm */
> 	enrolled = lookup_enrolled_realm (self);
>-	if (g_strcmp0 (enrolled, realm_name) == 0) {
>-		realm_kerberos_kinit_ccache_async (realm, name, password, REALM_SAMBA_ENROLL_ENC_TYPES,
>-		                                   invocation, on_kinit_do_leave, g_object_ref (res));
>-
>-	} else {
>+	if (g_strcmp0 (enrolled, realm_name) != 0) {
> 		g_simple_async_result_set_error (res, REALM_ERROR, REALM_ERROR_NOT_CONFIGURED,
> 		                                 _("Not currently joined to a domain"));
> 		g_simple_async_result_complete_in_idle (res);
>+
>+	} else if (g_variant_lookup (options, "computer-ou", "&s", &computer_ou)) {
>+		g_simple_async_result_set_error (res, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+		                                 "The computer-ou argument is not supported when leaving a domain (using samba).");
>+		g_simple_async_result_complete_in_idle (res);
>+
>+	} else {
>+		realm_kerberos_kinit_ccache_async (realm, name, password, REALM_SAMBA_ENROLL_ENC_TYPES,
>+		                                   invocation, on_kinit_do_leave, g_object_ref (res));
> 	}
> 
> 	g_object_unref (res);
>diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
>index b2cfc63..7d239f1 100644
>--- a/service/realm-sssd-ad.c
>+++ b/service/realm-sssd-ad.c
>@@ -81,6 +81,7 @@ realm_sssd_ad_constructed (GObject *obj)
> typedef struct {
> 	GDBusMethodInvocation *invocation;
> 	GBytes *ccache;
>+	gchar *computer_ou;
> 	gchar *realm_name;
> } EnrollClosure;
> 
>@@ -91,6 +92,7 @@ enroll_closure_free (gpointer data)
> 	g_free (enroll->realm_name);
> 	g_object_unref (enroll->invocation);
> 	g_bytes_unref (enroll->ccache);
>+	g_free (enroll->computer_ou);
> 	g_slice_free (EnrollClosure, enroll);
> }
> 
>@@ -240,8 +242,8 @@ on_install_do_join (GObject *source,
> 	realm_packages_install_finish (result, &error);
> 	if (error == NULL) {
> 		realm_samba_enroll_join_async (enroll->realm_name, enroll->ccache,
>-		                               enroll->invocation, on_join_do_sssd,
>-		                               g_object_ref (res));
>+		                               enroll->computer_ou, enroll->invocation,
>+		                               on_join_do_sssd, g_object_ref (res));
> 
> 	} else {
> 		g_simple_async_result_take_error (res, error);
>@@ -292,6 +294,7 @@ realm_sssd_ad_enroll_async (RealmKerberos *realm,
> 	enroll = g_slice_new0 (EnrollClosure);
> 	enroll->realm_name = g_strdup (realm_kerberos_get_realm_name (realm));
> 	enroll->invocation = g_object_ref (invocation);
>+	enroll->computer_ou = realm_kerberos_calculate_join_computer_ou (realm, options);
> 	g_simple_async_result_set_op_res_gpointer (res, enroll, enroll_closure_free);
> 
> 	/* Make sure not already enrolled in a realm */
>@@ -440,6 +443,7 @@ realm_sssd_ad_unenroll_async (RealmKerberos *realm,
> 	RealmSssd *sssd = REALM_SSSD (realm);
> 	GSimpleAsyncResult *res;
> 	UnenrollClosure *unenroll;
>+	const gchar *computer_ou;
> 
> 	res = g_simple_async_result_new (G_OBJECT (realm), callback, user_data,
> 	                                 realm_sssd_ad_unenroll_async);
>@@ -449,14 +453,19 @@ realm_sssd_ad_unenroll_async (RealmKerberos *realm,
> 	g_simple_async_result_set_op_res_gpointer (res, unenroll, unenroll_closure_free);
> 
> 	/* Check that enrolled in this realm */
>-	if (realm_sssd_get_config_section (sssd)) {
>-		realm_kerberos_kinit_ccache_async (realm, name, password, REALM_SAMBA_ENROLL_ENC_TYPES,
>-		                                   invocation, on_kinit_do_leave, g_object_ref (res));
>-
>-	} else {
>+	if (!realm_sssd_get_config_section (sssd)) {
> 		g_simple_async_result_set_error (res, REALM_ERROR, REALM_ERROR_NOT_CONFIGURED,
> 		                                 _("Not currently joined to this domain"));
> 		g_simple_async_result_complete_in_idle (res);
>+
>+	} else if (g_variant_lookup (options, "computer-ou", "&s", &computer_ou)) {
>+		g_simple_async_result_set_error (res, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+		                                 "The computer-ou argument is not supported when leaving a domain (using samba).");
>+		g_simple_async_result_complete_in_idle (res);
>+
>+	} else {
>+		realm_kerberos_kinit_ccache_async (realm, name, password, REALM_SAMBA_ENROLL_ENC_TYPES,
>+		                                   invocation, on_kinit_do_leave, g_object_ref (res));
> 	}
> 
> 	g_object_unref (res);
>diff --git a/tests/Makefile.am b/tests/Makefile.am
>index 08a2bec..231d28e 100644
>--- a/tests/Makefile.am
>+++ b/tests/Makefile.am
>@@ -17,6 +17,7 @@ TEST_PROGS = \
> 	test-ini-config \
> 	test-sssd-config \
> 	test-login-name \
>+	test-samba-ou-format \
> 	$(NULL)
> 
> check_PROGRAMS = \
>@@ -45,6 +46,11 @@ test_login_name_SOURCES = \
> 	$(top_srcdir)/service/realm-login-name.c \
> 	$(NULL)
> 
>+test_samba_ou_format_SOURCES = \
>+	test-samba-ou-format.c \
>+	$(top_srcdir)/service/realm-samba-util.c \
>+	$(NULL)
>+
> frob_install_packages_CFLAGS = \
> 	-DI_KNOW_THE_PACKAGEKIT_GLIB2_API_IS_SUBJECT_TO_CHANGE \
> 	$(PACKAGEKIT_CFLAGS) \
>diff --git a/tests/test-samba-ou-format.c b/tests/test-samba-ou-format.c
>new file mode 100644
>index 0000000..3f03c7f
>--- /dev/null
>+++ b/tests/test-samba-ou-format.c
>@@ -0,0 +1,80 @@
>+/* realmd -- Realm configuration service
>+ *
>+ * Copyright 2012 Red Hat Inc
>+ *
>+ * This program is free software: you can redistribute it and/or modify
>+ * it under the terms of the GNU Lesser General Public License as published
>+ * by the Free Software Foundation; either version 2 of the licence or (at
>+ * your option) any later version.
>+ *
>+ * See the included COPYING file for more information.
>+ *
>+ * Author: Stef Walter <stefw@gnome.org>
>+ */
>+
>+#include "config.h"
>+
>+#include "service/realm-samba-util.h"
>+
>+#include <glib/gstdio.h>
>+
>+#include <string.h>
>+
>+typedef struct {
>+	const gchar *ldap_dn;
>+	const gchar *domain;
>+	const gchar *ou_format;
>+} Fixture;
>+
>+static void
>+test_samba_ou_format (gconstpointer user_data)
>+{
>+	const Fixture *fixture = user_data;
>+	gchar *result;
>+
>+	result = realm_samba_util_build_strange_ou (fixture->ldap_dn, fixture->domain);
>+	g_assert_cmpstr (result, ==, fixture->ou_format);
>+	g_free (result);
>+}
>+
>+static const Fixture samba_ou_fixtures[] = {
>+	{ "OU=One", "domain.example.com", "One" },
>+	{ "OU=One,ou=two", "domain.example.com", "two/One" },
>+	{ "Ou=One Long,OU=two", "domain.example.com", "two/One Long" },
>+	{ "Ou=One,OU=two, ou=Three", "domain.example.com", "Three/two/One" },
>+	{ "Ou=Test/Escape,Ou=Two", "domain.example.com", "Two/Test\\/Escape" },
>+	{ "Ou=Test\\\\Escape,Ou=Two", "domain.example.com", "Two/Test\\\\Escape" },
>+	{ "OU=One,DC=domain,dc=example,Dc=COM", "domain.example.com", "One" },
>+	{ "OU=One,OU=Two Here,DC=domain,dc=example,Dc=COM", "domain.example.com", "Two Here/One" },
>+	{ "OU=One,OU=Two Here,DC=invalid,Dc=COM", "domain.example.com", NULL },
>+	{ " ", "domain.example.com", NULL },
>+	{ "OU", "domain.example.com", NULL },
>+	{ "OU=One,", "domain.example.com", NULL },
>+	{ "CN=Unsupported", "domain.example.com", NULL },
>+	{ "OU=One+CN=Unsupported", "domain.example.com", NULL },
>+};
>+
>+int
>+main (int argc,
>+      char **argv)
>+{
>+	gchar *escaped;
>+	gchar *name;
>+	gint i;
>+
>+	g_type_init ();
>+	g_test_init (&argc, &argv, NULL);
>+	g_set_prgname ("test-samba-ou-format");
>+
>+	for (i = 0; i < G_N_ELEMENTS (samba_ou_fixtures); i++) {
>+		escaped = g_strdup (samba_ou_fixtures[i].ldap_dn);
>+		g_strdelimit (escaped, ", =\\/", '_');
>+		name = g_strdup_printf ("/realmd/samba-ou-format/%s", escaped);
>+		g_free (escaped);
>+
>+		g_test_add_data_func (name, samba_ou_fixtures + i, test_samba_ou_format);
>+		g_free (name);
>+	}
>+
>+	return g_test_run ();
>+}
>diff --git a/tools/realm-enroll.c b/tools/realm-enroll.c
>index 43f879f..8a335d8 100644
>--- a/tools/realm-enroll.c
>+++ b/tools/realm-enroll.c
>@@ -376,19 +376,23 @@ build_ccache_or_password_creds (RealmDbusKerberosMembership *membership,
> static int
> realm_join_or_leave (RealmDbusKerberosMembership *membership,
>                      const gchar *user_name,
>+                     const gchar *computer_ou,
>                      gboolean join)
> {
> 	GError *error = NULL;
> 	GVariant *options;
> 	GVariant *creds;
> 	SyncClosure sync;
>+	GVariant *option = NULL;
> 
> 	creds = build_ccache_or_password_creds (membership, user_name, join);
> 
> 	sync.result = NULL;
> 	sync.loop = g_main_loop_new (NULL, FALSE);
> 
>-	options = g_variant_new_array (G_VARIANT_TYPE ("{sv}"), NULL, 0);
>+	if (computer_ou)
>+		option = g_variant_new ("{sv}", "computer-ou", g_variant_new_string (computer_ou));
>+	options = g_variant_new_array (G_VARIANT_TYPE ("{sv}"), &option, option ? 1 : 0);
> 	g_variant_ref_sink (options);
> 
> 	/* Start actual operation */
>@@ -425,7 +429,8 @@ realm_join_or_leave (RealmDbusKerberosMembership *membership,
> static int
> perform_join (GDBusConnection *connection,
>               const gchar *string,
>-              const gchar *user_name)
>+              const gchar *user_name,
>+              const gchar *computer_ou)
> {
> 	RealmDbusKerberosMembership *membership;
> 	RealmDbusProvider *provider;
>@@ -467,7 +472,7 @@ perform_join (GDBusConnection *connection,
> 		return 1;
> 	}
> 
>-	ret = realm_join_or_leave (membership, user_name, TRUE);
>+	ret = realm_join_or_leave (membership, user_name, computer_ou, TRUE);
> 
> 	g_object_unref (membership);
> 
>@@ -498,7 +503,7 @@ perform_leave (GDBusConnection *connection,
> 		return 1;
> 	}
> 
>-	ret = realm_join_or_leave (membership, user_name, FALSE);
>+	ret = realm_join_or_leave (membership, user_name, NULL, FALSE);
> 	g_object_unref (membership);
> 
> 	return ret;
>@@ -514,11 +519,13 @@ realm_join (int argc,
> 	gboolean arg_verbose = FALSE;
> 	GError *error = NULL;
> 	const gchar *realm_name;
>+	gchar *arg_computer_ou = NULL;
> 	gint ret = 0;
> 
> 	GOptionEntry option_entries[] = {
> 		{ "user", 'U', 0, G_OPTION_ARG_STRING, &arg_user, N_("User name to use for enrollment"), NULL },
> 		{ "verbose", 'v', 0, G_OPTION_ARG_NONE, &arg_verbose, N_("Verbose output"), NULL },
>+		{ "computer-ou", 0, 0, G_OPTION_ARG_STRING, &arg_computer_ou, N_("Computer OU DN to join"), NULL },
> 		{ NULL, }
> 	};
> 
>@@ -539,7 +546,8 @@ realm_join (int argc,
> 		connection = realm_get_connection (arg_verbose);
> 		if (connection) {
> 			realm_name = argc < 2 ? "" : argv[1];
>-			ret = perform_join (connection, realm_name, arg_user);
>+			ret = perform_join (connection, realm_name, arg_user,
>+			                    arg_computer_ou);
> 			g_object_unref (connection);
> 		} else {
> 			ret = 1;
>-- 
>1.7.11.5
>

Actions: View | Splinter Review

Attachments on bug 53889: 65945 | 65946 | 65948

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.