illumos gate

Tiny bit more background, I am trying to use rfc2307bis with groups using the member attribute holding a DN of the user. (as per the rfc)

For groups with 1 or more member attribute, the group does not show up in getent group, possibly due to nss not returning properly. Due to the issue found above.

A proposed fix:

diff --git a/usr/src/lib/nsswitch/ldap/common/getgrent.c b/usr/src/lib/nsswitch/ldap/common/getgrent.c
index 184891c9d3..615b67a4e5 100644
--- a/usr/src/lib/nsswitch/ldap/common/getgrent.c
+++ b/usr/src/lib/nsswitch/ldap/common/getgrent.c
@@ -23,6 +23,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2020 Joyent, Inc.
  */

 #include <grp.h>
@@ -239,8 +240,9 @@ getmembers_DN(char **bufpp, int *lenp, ns_ldap_attr_t *members)
        char    *buffer;
        int     buflen;
        int     i, len;
-       int     nss_result = 0;
+       int     nss_result = 0; /* used by TEST_AND_ADJUST macro */
        int     firsttime;
+       ns_ldap_return_code dn2uid_rc;

        buffer = *bufpp;
        buflen = *lenp;
@@ -263,9 +265,9 @@ getmembers_DN(char **bufpp, int *lenp, ns_ldap_attr_t *members)
                if (member_dn[0] == '\0')
                        continue;

-               nss_result = __ns_ldap_dn2uid(member_dn,
+               dn2uid_rc = __ns_ldap_dn2uid(member_dn,
                    &member_uid, NULL, &error);
-               if (nss_result != NS_LDAP_SUCCESS) {
+               if (dn2uid_rc != NS_LDAP_SUCCESS) {
                        (void) __ns_ldap_freeError(&error);
                        error = NULL;
                        continue;

Slightly more compact version:

diff --git a/usr/src/lib/nsswitch/ldap/common/getgrent.c b/usr/src/lib/nsswitch/ldap/common/getgrent.c
index 184891c9d3..765059e86a 100644
--- a/usr/src/lib/nsswitch/ldap/common/getgrent.c
+++ b/usr/src/lib/nsswitch/ldap/common/getgrent.c
@@ -23,6 +23,7 @@
  * Use is subject to license terms.
  *
  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2020 Joyent, Inc.
  */

 #include <grp.h>
@@ -239,7 +240,7 @@ getmembers_DN(char **bufpp, int *lenp, ns_ldap_attr_t *members)
        char    *buffer;
        int     buflen;
        int     i, len;
-       int     nss_result = 0;
+       int     nss_result = 0; /* used by TEST_AND_ADJUST macro */
        int     firsttime;

        buffer = *bufpp;
@@ -263,9 +264,8 @@ getmembers_DN(char **bufpp, int *lenp, ns_ldap_attr_t *members)
                if (member_dn[0] == '\0')
                        continue;

-               nss_result = __ns_ldap_dn2uid(member_dn,
-                   &member_uid, NULL, &error);
-               if (nss_result != NS_LDAP_SUCCESS) {
+               if (__ns_ldap_dn2uid(member_dn,
+                   &member_uid, NULL, &error) != NS_LDAP_SUCCESS) {
                        (void) __ns_ldap_freeError(&error);
                        error = NULL;
                        continue;

I applied patch v2 and build a new PI.

I now see the admins group! (but it is still empty tough), so I asume getmembers_DN still fails... but the failure does not result in a missing group. I'm cursious why it can't fine the DN as it does clearly exist.

[root@freeradius ~]# getent group admins
admins::10002:
[root@freeradius ~]# getent passwd sjorge
sjorge:x:10001:10001:Jorge Schrauwen:/home/sjorge:/opt/local/bin/zsh

# users, groups, acheron.be
dn: cn=users,ou=groups,dc=acheron,dc=be
cn: users
gidNumber: 10001
description: Users
objectClass: posixGroup
objectClass: groupOfMembers

# admins, groups, acheron.be
dn: cn=admins,ou=groups,dc=acheron,dc=be
cn: admins
gidNumber: 10002
description: System Administrators
objectClass: posixGroup
objectClass: groupOfMembers
member: uid=sjorge,ou=accounts,dc=acheron,dc=be

# sjorge, accounts, acheron.be
dn: uid=sjorge,ou=accounts,dc=acheron,dc=be
cn: sjorge
uid: sjorge
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/sjorge
loginShell: /opt/local/bin/zsh
userPassword:: <REMOVED>
gecos: Jorge Schrauwen
sn: Schrauwen
givenName: Jorge
SolarisAttrKeyValue: type=normal;profiles=Primary Administrator
sshPublicKey: <REMOVED>
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: SolarisUserAttr
objectClass: ldapPublicKey

Note that the missing members is addressed by #12240. In addition to the testing Jorge did (the 2nd patch being what was ultimately reviewed), I also setup a small ldap server and loaded it with test data. As part of the test data, 3 groups were added to LDAP, 2 of which had a test user as a secondary member. Without the fix, the groups with the secondary members by DN did not show up. With the fix they appeared. (This was tested in conjunction with the fix for #12240).