>From 04f07630df690dcbddfa5e4db1cb19935cf6444e Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Fri, 28 Nov 2014 14:32:29 +0100 Subject: [PATCH 2/2] IPA: Fix checking of trust in originalDN In function ipa_subdom_get_forest the comment contains says: "We are only interested in the member domain objects. In IPA the forest root object is stored as e.g. cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the forest are children of the forest root object e.g. cn=SUB.AD.DOM,cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com" The member domain objects contains 6 components in dn, which cuased error messages for forest root object. [ipa_subdom_get_forest] (0x4000): Checking if we need the forest name for [cn=adtest.dom,cn=ad,cn=trusts,dc=example,dc=test]. [ipa_subdom_get_forest] (0x0400): 4th component is not 'trust', nothing to do. --- src/providers/ipa/ipa_subdomains.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c index 6fdb0befa32f96d01c9b3666a3ef9c8331a83242..c1b07c54cafb5fb6256b6bb33322ff3ab4e2aa9b 100644 --- a/src/providers/ipa/ipa_subdomains.c +++ b/src/providers/ipa/ipa_subdomains.c @@ -612,7 +612,7 @@ static errno_t ipa_subdom_get_forest(TALLOC_CTX *mem_ctx, goto done; } - if (ldb_dn_get_comp_num(dn) < 5) { + if (ldb_dn_get_comp_num(dn) < 6) { /* We are only interested in the member domain objects. In IPA the * forest root object is stored as e.g. * cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the -- 2.1.0