From 37193dc35297bf9d552c67be2c5f2d80bc9c9e5a Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Fri, 12 Dec 2014 13:07:55 -0500 Subject: [PATCH 2/2] IPA: properly handle groups from different domains When groups are resolved on IPA clients as part of a user lookup not all groups have to be from the same domain as the used. This has to be checked to store the group object properly in the cache. Related to https://fedorahosted.org/sssd/ticket/2529 --- src/providers/ipa/ipa_s2n_exop.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c index 292056af11ec23f52402859221964d35b9bbd4ad..581cbe0a027e6a1e8c39b2639497cc6584eb9f5b 100644 --- a/src/providers/ipa/ipa_s2n_exop.c +++ b/src/providers/ipa/ipa_s2n_exop.c @@ -2024,10 +2024,24 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom, case RESP_GROUP_MEMBERS: type = SYSDB_MEMBER_GROUP; + if (0 != strcmp(dom->name, attrs->domain_name)) { + dom = find_domain_by_name(get_domains_head(dom), + attrs->domain_name, true); + if (dom == NULL) { + DEBUG(SSSDBG_OP_FAILURE, + "Cannot find domain: [%s]\n", attrs->domain_name); + ret = EINVAL; + goto done; + } + } + if (name == NULL) { + name = attrs->a.group.gr_name; + } + + if (IS_SUBDOMAIN(dom)) { /* we always use the fully qualified name for subdomain users */ - name = sss_tc_fqname(tmp_ctx, dom->names, dom, - attrs->a.group.gr_name); + name = sss_tc_fqname(tmp_ctx, dom->names, dom, name); if (!name) { DEBUG(SSSDBG_OP_FAILURE, "failed to format user name,\n"); ret = ENOMEM; -- 2.1.0