Attached patches should fix https://fedorahosted.org/sssd/ticket/1980
The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more
result than 1, sssd will return error. sysdb_getpwnam has already had
The second patch removes function call sss_cmd_done inside of check_cache,
because function is sss_cmd_done is called in parent functions.
This was a reason of sssd crash.
How to reproduce this crash.
1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb
This netgroup should have the same attribute (name or nameAlias or memberOf)
as another netgroup.
2. call sudo with user, which is member of ^^^ netgroup.
Those patches fix only sssd crash, but we should find out:
Why were those netgroups stored in sysdb.
attached are three man page patches.
[PATCH 1/3] MAN: clarify the default access provider for AD
After we added a section that clarified what access_provider=ad did,
some users were confused and thought that "ad" was also the default
access provider if "id_provider=ad" was specified.
[PATCH 2/3] MAN: IP addresss does not work when used for ad_server
Currently using IP address as value of ad_server is not supported, so
the man pages should not mention that as an option.
[PATCH 3/3] MAN: Clarify the min_id/max_id limits further
Some users were confused by our description of min_id/max_id and thought
the limits only applied to returning entries from the NSS responder.
However, the limits are actually enforced on the back end side, so the
entries are not even saved to cache.
I created a separate ticket to support subdomain users and groups in
There is a bug in PAC responder at the moment which makes simple access
provider to always deny access to subdomain users. PAC responder
currently fails to resolve group membership, thus we get error in access
provider when looking up groups and access is denied. Jakub will look
Ensure that cmd_ctx->name will not be NULL.
If cmd_ctx->name was not initialized by sss_parse_name
then copy of name will be used.
Coverity ID: 11647
Patch is attached.
-----BEGIN PGP SIGNED MESSAGE-----
Netgroups often have memberNisNetgroup entries included in them
that will never process correctly if we require fully-qualified
names on the nested lookup. This patch alters the behavior of
netgroup lookups to check *all* domains for an unqualified
netgroup name, instead of only the ones not requiring fully-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----