From b432b2c4c8039db0130494a83294bee950ebaa6a Mon Sep 17 00:00:00 2001
From: Paweł Poławski <ppolawsk@redhat.com>
Date: Apr 01 2020 09:15:40 +0000
Subject: LDAP: Netgroups refresh in background task


refresh_expired_interval config value spawns be_task
responsible for refreshing expired cache entries
in background.

Netgroup related entries are stored in persistent
cache rather than timestamp cache. After sdap_refresh_step()
has been replaced by generic be_refresh_step()
lookup routine was searching for entries only in
timestamp cache. This result in LDAP netgroup entries
not refreshing in background.

Resolves:
https://pagure.io/SSSD/sssd/issue/4177

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

---

diff --git a/src/providers/be_refresh.c b/src/providers/be_refresh.c
index 5e43571..cd234c5 100644
--- a/src/providers/be_refresh.c
+++ b/src/providers/be_refresh.c
@@ -35,6 +35,7 @@ static errno_t be_refresh_get_values_ex(TALLOC_CTX *mem_ctx,
                                         struct ldb_dn *base_dn,
                                         const char *key_attr,
                                         const char *value_attr,
+                                        int optflags,
                                         char ***_values)
 {
     TALLOC_CTX *tmp_ctx = NULL;
@@ -64,7 +65,7 @@ static errno_t be_refresh_get_values_ex(TALLOC_CTX *mem_ctx,
 
     ret = sysdb_search_with_ts_attr(tmp_ctx, domain, base_dn,
                                     LDB_SCOPE_SUBTREE,
-                                    SYSDB_SEARCH_WITH_TS_ONLY_TS_FILTER,
+                                    optflags,
                                     filter, attrs,
                                     &res);
     if (ret != EOK) {
@@ -102,6 +103,7 @@ static errno_t be_refresh_get_values(TALLOC_CTX *mem_ctx,
     struct ldb_dn *base_dn = NULL;
     errno_t ret;
     const char *key_attr;
+    int optflags = SYSDB_SEARCH_WITH_TS_ONLY_TS_FILTER;
 
     switch (type) {
     case BE_REFRESH_TYPE_INITGROUPS:
@@ -118,6 +120,8 @@ static errno_t be_refresh_get_values(TALLOC_CTX *mem_ctx,
         break;
     case BE_REFRESH_TYPE_NETGROUPS:
         key_attr = SYSDB_CACHE_EXPIRE;
+        // Netgroup will reside in persistent cache rather than timestamp one
+        optflags = SYSDB_SEARCH_WITH_TS_ONLY_SYSDB_FILTER;
         base_dn = sysdb_netgroup_base_dn(mem_ctx, domain);
         break;
     default:
@@ -132,7 +136,7 @@ static errno_t be_refresh_get_values(TALLOC_CTX *mem_ctx,
 
     ret = be_refresh_get_values_ex(mem_ctx, domain, period,
                                    base_dn, key_attr,
-                                   attr_name, _values);
+                                   attr_name, optflags, _values);
 
     talloc_free(base_dn);
     return ret;