778c958 ID views: ignore searches for views outside the subtrees of schema-compat sets

Authored and Committed by abbra 9 years ago
    ID views: ignore searches for views outside the subtrees of schema-compat sets
    
    schema-compat plugin may provide multiple disjoint subtrees which
    can be used to request overridden entries by prefixing the subtree
    suffix with a
    
      cn=<name of view>,cn=views,<subtree suffix>
    
    As subtrees may be disjoint, we cannot rely on the common suffix. Thus,
    any attempt to replace target DN and update filter terms must only be
    done once we are sure the search will be done in the subtree.
    
    This optimization prevents mistakenly changing the search filter when
    FreeIPA and SSSD search for the ID overrides themselves, as the same
    structure of the target DN is used for  cn=views,cn=accounts,$SUFFIX
    subtree in FreeIPA. This subtree is never handled by slapi-nis and
    should be ignored.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1157989
    
        
file modified
+9 -2
file modified
+72 -9