On Tue, Aug 12, 2014 at 02:27:59PM +0200, Pavel Březina wrote:
On 08/10/2014 06:42 PM, Jakub Hrozek wrote:
>Hi,
>
>I think we shouldn't honor the default_domain_suffix for netgroup lookups
>at all. The main use case for the option is to avoid entering the domain
>for users from AD trusts, where you don't have netgroups on the AD
>side. Moreover, netgroups don't play well eith fully qualified lookups
>either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).
>
>Using default_domain_suffix for netgroups is actually harmful, because
>hostgroups defined on an IPA server are translated into netgroups, so
>honoring the suffix breaks sudo rules in the trust case.
>
>As a side-effect, this patch should fix
>https://fedorahosted.org/sssd/ticket/2400
This sounds reasonable. Ack.
Sorry, I forgot to send pushmail:
* master: e6d441518531e7931e29dd8c65a3448a213e3865
* sssd-1-11: 484a9f2fc6952199096ea5afb486b3eddb545c20