Hi,
Alexander found a long-standing bug that was revealed by the recent
getsidbynam code. The getsidbynam code in the NSS responder searches
users by name using sysdb_search_user_by_name() which in turn constructs
the user DN based on username and sysdb domain name. But this is fragile
when it comes to case-insensitive domains as the RDN contains the
original name verbatim (think Administrator(a)AD.EXAMPLE.COM) but the
input can be any combination of upper and lower case.
I think it it safest to just do a subtree search instead and search using
both name and the lowercased alias. This would make the API more robust.
Also I realized that there is an ugly inconsistency when it comes to
subdomain users which have a FQDN in the name attribute (and by
extension RDN). Some sysdb functions treat the name paramater in input
as "plain name" and append the domain name in case the domain is a
subdomain, some rely on the caller doing so. I think we should
definitely standardize the API one way or another.