URL:
https://github.com/SSSD/sssd/pull/209
Title: #209: IPA: lookup AD users by certificates on IPA clients
jhrozek commented:
"""
Hmm, looking at the debug output, it might be the cache_req's code fault:
```
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_set_domain] (0x0400): CR #6: Using
domain [win.trust.test]
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_search_send] (0x0400): CR #6: Looking up
CERT:nxgxW/ww==@win.trust.test
...
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_create_and_add_result] (0x0400): CR #6:
Found 1 entries in domain win.trust.test
```
That's fine, but:
```
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_set_domain] (0x0400): CR #8: Using
domain [child.win.trust.test]
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_search_send] (0x0400): CR #8: Looking up
CERT:nxgxW/ww==@child.win.trust.test
...
(Wed Mar 29 11:30:04 2017) [sssd[ifp]] [cache_req_create_and_add_result] (0x0400): CR #8:
Found 1 entries in domain child.win.trust.test
```
So it looks like cache_req is looking in all domains and returning the entries from all
domains..
Please let me know if you prefer to file a separate ticket or fix the problem here.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/209#issuecomment-290062549