From 69994add9cd4e57d40b3b7a0b1783ef2d0aa974c Mon Sep 17 00:00:00 2001
From: Pavel Reichl <preichl@redhat.com>
Date: Wed, 21 May 2014 09:30:13 +0100
Subject: [PATCH] SDAP: Add option to disable use of Token-Groups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Disabling use of Token-Groups is mandatory if expansion of nested groups is not
desired (ldap_group_nesting_level = 0) for AD provider.

Resolves:
https://fedorahosted.org/sssd/ticket/2294

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
---
 src/config/SSSDConfig/__init__.py.in       |  1 +
 src/config/etc/sssd.api.d/sssd-ad.conf     |  1 +
 src/config/etc/sssd.api.d/sssd-ipa.conf    |  1 +
 src/config/etc/sssd.api.d/sssd-ldap.conf   |  1 +
 src/man/sssd-ldap.5.xml                    | 14 ++++++++++++++
 src/providers/ad/ad_opts.h                 |  1 +
 src/providers/ipa/ipa_opts.h               |  1 +
 src/providers/ldap/ldap_opts.h             |  1 +
 src/providers/ldap/sdap.h                  |  1 +
 src/providers/ldap/sdap_async_initgroups.c |  7 +++++--
 10 files changed, 27 insertions(+), 2 deletions(-)

Index: sssd-1.9.4/src/config/SSSDConfig/__init__.py.in
===================================================================
--- sssd-1.9.4.orig/src/config/SSSDConfig/__init__.py.in
+++ sssd-1.9.4/src/config/SSSDConfig/__init__.py.in
@@ -293,6 +293,7 @@ option_strings = {
 
     'ldap_groups_use_matching_rule_in_chain' : _('Use LDAP_MATCHING_RULE_IN_CHAIN for group lookups'),
     'ldap_initgroups_use_matching_rule_in_chain' : _('Use LDAP_MATCHING_RULE_IN_CHAIN for initgroup lookups'),
+    'ldap_use_tokengroups' : _('Whether to use Token-Groups'),
 
     # [provider/ldap/auth]
     'ldap_pwd_policy' : _('Policy to evaluate the password expiration'),
Index: sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ad.conf
===================================================================
--- sssd-1.9.4.orig/src/config/etc/sssd.api.d/sssd-ad.conf
+++ sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -104,6 +104,7 @@ ldap_idmap_default_domain = str, None, f
 ldap_idmap_default_domain_sid = str, None, false
 ldap_groups_use_matching_rule_in_chain = bool, None, false
 ldap_initgroups_use_matching_rule_in_chain = bool, None, false
+ldap_use_tokengroups = bool, None, false
 
 [provider/ad/auth]
 krb5_ccachedir = str, None, false
Index: sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ipa.conf
===================================================================
--- sssd-1.9.4.orig/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -124,6 +124,7 @@ ldap_idmap_default_domain = str, None, f
 ldap_idmap_default_domain_sid = str, None, false
 ldap_groups_use_matching_rule_in_chain = bool, None, false
 ldap_initgroups_use_matching_rule_in_chain = bool, None, false
+ldap_use_tokengroups = bool, None, false
 
 [provider/ipa/auth]
 krb5_ccachedir = str, None, false
Index: sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ldap.conf
===================================================================
--- sssd-1.9.4.orig/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ sssd-1.9.4/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -114,6 +114,7 @@ ldap_idmap_default_domain = str, None, f
 ldap_idmap_default_domain_sid = str, None, false
 ldap_groups_use_matching_rule_in_chain = bool, None, false
 ldap_initgroups_use_matching_rule_in_chain = bool, None, false
+ldap_use_tokengroups = bool, None, false
 
 [provider/ldap/auth]
 ldap_pwd_policy = str, None, false
Index: sssd-1.9.4/src/man/sssd-ldap.5.xml
===================================================================
--- sssd-1.9.4.orig/src/man/sssd-ldap.5.xml
+++ sssd-1.9.4/src/man/sssd-ldap.5.xml
@@ -926,6 +926,20 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>ldap_use_tokengroups</term>
+                    <listitem>
+                        <para>
+                          This options enables or disables use of Token-Groups
+                          attribute when performing initgroup for users from
+                          Active Directory Server 2008 and later.
+                        </para>
+                        <para>
+                            Default: True
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_netgroup_object_class (string)</term>
                     <listitem>
                         <para>
Index: sssd-1.9.4/src/providers/ad/ad_opts.h
===================================================================
--- sssd-1.9.4.orig/src/providers/ad/ad_opts.h
+++ sssd-1.9.4/src/providers/ad/ad_opts.h
@@ -120,6 +120,7 @@ struct dp_option ad_def_ldap_opts[] = {
     { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE},
     DP_OPTION_TERMINATOR
 };
 
Index: sssd-1.9.4/src/providers/ipa/ipa_opts.h
===================================================================
--- sssd-1.9.4.orig/src/providers/ipa/ipa_opts.h
+++ sssd-1.9.4/src/providers/ipa/ipa_opts.h
@@ -134,6 +134,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE},
     DP_OPTION_TERMINATOR
 };
 
Index: sssd-1.9.4/src/providers/ldap/ldap_opts.h
===================================================================
--- sssd-1.9.4.orig/src/providers/ldap/ldap_opts.h
+++ sssd-1.9.4/src/providers/ldap/ldap_opts.h
@@ -112,6 +112,7 @@ struct dp_option default_basic_opts[] =
     { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE},
     DP_OPTION_TERMINATOR
 };
 
Index: sssd-1.9.4/src/providers/ldap/sdap.h
===================================================================
--- sssd-1.9.4.orig/src/providers/ldap/sdap.h
+++ sssd-1.9.4/src/providers/ldap/sdap.h
@@ -228,6 +228,7 @@ enum sdap_basic_opt {
     SDAP_IDMAP_DEFAULT_DOMAIN_SID,
     SDAP_AD_MATCHING_RULE_GROUPS,
     SDAP_AD_MATCHING_RULE_INITGROUPS,
+    SDAP_AD_USE_TOKENGROUPS,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
Index: sssd-1.9.4/src/providers/ldap/sdap_async_initgroups.c
===================================================================
--- sssd-1.9.4.orig/src/providers/ldap/sdap_async_initgroups.c
+++ sssd-1.9.4/src/providers/ldap/sdap_async_initgroups.c
@@ -2723,8 +2723,8 @@ static void sdap_get_initgr_user(struct
             return;
         }
 
-        if (use_id_mapping
-                && state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008) {
+        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008
+            && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
             /* Take advantage of AD's tokenGroups mechanism to look up all
              * parent groups in a single request.
              */
@@ -2815,8 +2815,9 @@ static void sdap_get_initgr_done(struct
 
     case SDAP_SCHEMA_RFC2307BIS:
     case SDAP_SCHEMA_AD:
-        if (use_id_mapping
-                && state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008) {
+        if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008
+            && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) {
+ 
             ret = sdap_get_ad_tokengroups_initgroups_recv(subreq);
         }
         else if (state->opts->support_matching_rule
