URL:
https://github.com/SSSD/sssd/pull/39
Title: #39: RESPONDER: Enable sudoRule in case insen. domains (1.13)
jhrozek commented:
"""
On Tue, Nov 08, 2016 at 05:06:41AM -0800, celestian wrote:
Yes, the second patch explicitly qualifies the names. I don't
know if there is possibility to add wrong domain to the given user name this way.
That's the question.
The reason for doing this is that function ```sudosrv_get_user()``` ask for that type of
name. How you can see:
```
# grep 'administrator' *.log
# sssd_scorpion.domain.log:
[be_get_account_info] (0x0200): Got request for
[0x3][BE_REQ_INITGROUPS][1][name=administrator]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=administrator)(objectclass=user)(objectSID=*))][DC=scorpion,DC=domain].
[pam_print_data] (0x0100): ruser: administrator(a)scorpion.domain
[sssd[be[scorpion.domain]]] [pam_print_data] (0x0100): ruser:
administrator(a)scorpion.domain
# sssd_sudo.log:
[sss_parse_name_for_domains] (0x0200): name 'administrator(a)scorpion.domain'
matched expression for domain 'scorpion.domain', user is administrator
[sss_parse_name_for_domains] (0x0200): name 'administrator(a)scorpion.domain'
matched expression for domain 'scorpion.domain', user is administrator
[sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [administrator]
from [scorpion.domain]
[sss_ncache_check_str] (0x2000): Checking negative cache for
[NCE/USER/scorpion.domain/administrator]
[sudosrv_get_user] (0x0200): Requesting info about [administrator(a)scorpion.domain]
[sudosrv_get_user] (0x0400): Returning info for user [administrator(a)scorpion.domain]
This is only how the DEBUG messages are formatted:
122 DEBUG(SSSDBG_FUNC_DATA, "Requesting info about [%s@%s]\n",
123 name, dom->name);
and:
243 DEBUG(SSSDBG_TRACE_FUNC, "Returning info for user [%s@%s]\n",
244 cmd_ctx->username, dctx->domain->name);
In the cache I can see both administrator(a)win.trust.test and
administrator. But do we need the qualified name? Why?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/39#issuecomment-259134748