oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Fix HDB two-phase commit for LDAP backend

Browse Source 
We can't replay log entries when recovering if the backend is shared by
writers with separate logs (or no logs at all), i.e., on other hosts.
This commit is contained in:
Nicolas Williams
2016-02-28 17:51:15 -06:00
parent d5bc673e31
commit a114690bde
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/hdb/hdb-ldap.c
View File

@@ -2002,7 +2002,7 @@ hdb_ldap_common(krb5_context context,
(*db)->hdb_master_key_set = 0;
(*db)->hdb_openp = 0;
(*db)->hdb_capability_flags = 0;
(*db)->hdb_capability_flags = HDB_CAP_F_SHARED_DIRECTORY;
(*db)->hdb_open = LDAP_open;
(*db)->hdb_close = LDAP_close;
(*db)->hdb_fetch_kvno = LDAP_fetch_kvno;

1
lib/hdb/hdb.h
View File

@@ -71,6 +71,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
#define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
#define HDB_CAP_F_HANDLE_PASSWORDS 2
#define HDB_CAP_F_PASSWORD_UPDATE_KEYS 4
#define HDB_CAP_F_SHARED_DIRECTORY 8
/* auth status values */
#define HDB_AUTH_SUCCESS 0

7
lib/kadm5/log.c
View File

@@ -1719,7 +1719,12 @@ recover_replay(kadm5_server_context *context,
/* We're at the start of the payload; compute end of entry offset */
off = krb5_storage_seek(sp, 0, SEEK_CUR) + len + LOG_TRAILER_SZ;
ret = kadm5_log_replay(context, op, ver, len, sp);
/* We cannot perform log recovery on LDAP and such backends */
if (data->mode == kadm_recover_replay &&
(context->db->hdb_capability_flags & HDB_CAP_F_SHARED_DIRECTORY))
ret = 0;
else
ret = kadm5_log_replay(context, op, ver, len, sp);
switch (ret) {
case HDB_ERR_NOENTRY:
case HDB_ERR_EXISTS: