-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/09/2013 06:37 AM, Jakub Hrozek wrote:
On Mon, Jul 08, 2013 at 10:16:05PM +0200, Jakub Hrozek wrote:
> On Mon, Jul 08, 2013 at 04:01:26PM -0400, Stephen Gallagher
> wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
>>> Hi,
>>>
>>> Alexander found a long-standing bug that was revealed by the
>>> recent getsidbynam code. The getsidbynam code in the NSS
>>> responder searches users by name using
>>> sysdb_search_user_by_name() which in turn constructs the user
>>> DN based on username and sysdb domain name. But this is
>>> fragile when it comes to case-insensitive domains as the RDN
>>> contains the original name verbatim (think
>>> Administrator(a)AD.EXAMPLE.COM) but the input can be any
>>> combination of upper and lower case.
>>>
>>> I think it it safest to just do a subtree search instead and
>>> search using both name and the lowercased alias. This would
>>> make the API more robust.
>>>
>>> Also I realized that there is an ugly inconsistency when it
>>> comes to subdomain users which have a FQDN in the name
>>> attribute (and by extension RDN). Some sysdb functions treat
>>> the name paramater in input as "plain name" and append the
>>> domain name in case the domain is a subdomain, some rely on
>>> the caller doing so. I think we should definitely standardize
>>> the API one way or another.
>>>
>>
>> Ack
>>
>> Compiles cleanly and passes all sysdb tests. I'd prefer it if
>> you extended those tests to include alias lookups, but that
>> doesn't have to block this patch.
>
> Yes, I will re-send another version but I wanted to unblock
> Alexander's testing first.
>
> Thank you for the review.
Attached is a version of the patch that also adds a unit test. I
also attached just the unit test so you can quickly verify that the
test failed without the sysdb patch.
Ack to these patches.
I'd still like to see some tests in the sysdb suite for dealing with
aliases in the users and groups, though. I'll file a separate RFE for
that.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlHb/xAACgkQeiVVYja6o6P7vwCffowoHai87hVPsxVJPywIMOdI
5W0An3W5Lw+Mrb7Ljpf87EHDYLK3XwXi
=ZSUj
-----END PGP SIGNATURE-----