gpo: use correct base dn

[sssd-bot]

Cloned from Pagure issue: https://pagure.io/SSSD/sssd/issue/3847

• Created at 2018-10-08 13:32:10 by pbrezina
• Assigned to avisiedo

---

GPO code in ad_gpo_connect_done converts domain name to base dn which may not be correct. For example if the domain name in sssd.conf is AD, computed base is then dc=AD, but the correct base dn is dc=ad,dc=vm. This makes gpo code to fail.

    /* Convert the domain name into domain DN */
    ret = domain_to_basedn(state, state->host_domain->name, &domain_dn);
    if (ret != EOK) {
        DEBUG(SSSDBG_OP_FAILURE,
              "Cannot convert domain name [%s] to base DN [%d]: %s\n",
               state->host_domain->name, ret, sss_strerror(ret));
        goto done;
    }

    /* SDAP_OC_USER objectclass covers both users and computers */
    filter = talloc_asprintf(state,
                             "(&(objectclass=%s)(%s=%s))",
                             state->opts->user_map[SDAP_OC_USER].name,
                             state->opts->user_map[SDAP_AT_USER_NAME].name,
                             sam_account_name);
    if (filter == NULL) {
        ret = ENOMEM;
        goto done;
    }

    subreq = sdap_get_generic_send(state, state->ev, state->opts,
                                   sdap_id_op_handle(state->sdap_op),
                                   domain_dn, LDAP_SCOPE_SUBTREE,
^^^ correct base dn should be used
                                   filter, attrs, NULL, 0,
                                   state->timeout,
                                   false);

    if (subreq == NULL) {
        DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n");
        ret = EIO;
        goto done;
    }

    tevent_req_set_callback(subreq, ad_gpo_target_dn_retrieval_done, req);

Comments

---

Comment from jhrozek at 2018-10-11 15:34:11

Metadata Update from @jhrozek:

• Issue assigned to mzidek

---

Comment from pbrezina at 2020-03-13 15:00:51

Metadata Update from @pbrezina:

• Issue tagged with: Future milestone, New hire task

---

Comment from pbrezina at 2020-04-14 13:40:21

Metadata Update from @pbrezina:

• Issue assigned to avisiedo (was: mzidek)

[pbrezina]

Pushed PR: #5239

• master
  • a0792b3 - gpo: use correct base dn
  • d79f593 - gpo: remove unused variable domain_dn