Hi,
the attached patch fixes regression tracked by
https://fedorahosted.org/sssd/ticket/2723
Please see the commit message for more details.
From 2f4e2e6d5e8f29f5b2cdd9f0b825edc172da57ea Mon Sep 17 00:00:00
2001
From: Jakub Hrozek <jhrozek(a)redhat.com>
Date: Tue, 21 Jul 2015 21:00:27 +0200
Subject: [PATCH] LDAP: imposing sizelimit=1 for single-entry searches breaks
overlapping domains
https://fedorahosted.org/sssd/ticket/2723
In case there are overlapping sdap domains, a search for a single user
might match and return multiple entries. For instance, with AD domains
represented by search bases:
DC=win,DC=trust,DC=test
DC=child,DC=win,DC=trust,DC=test
A search for user from win.trust.test would be based at:
DC=win,DC=trust,DC=test
but would match both search bases and return both users.
Instead of performing complex filtering, just save both users. The
responder would select the entry that matches the user's search.
Patch works
but do we need to store all users?
IIRC we have a code where we choose user based on the best match of
domain dn and used dn.
LS