URL:
https://github.com/SSSD/sssd/pull/239
Author: jhrozek
Title: #239: HBAC: Use memberof ASQ search instead of originalMemberOf
Action: opened
PR body:
"""
This PR should fix the bug we were seeing in the HBAC evaluation of users
from a trusted AD domain where the originalMemberOf didn't match the
memberOf attributes.
Because maintaining the originalMemberOf attributes is fragile, let's
instead dereference the memberOf attribute and look at the names of the groups
this way.
To make sure we only consider IPA groups and not groups from trusted
domains, we construct a base DN of the IPA domain sysdb group container
and pop the RDN from the DN of the object examined and compare the two.
If other developers think it's too much of a hack, we can just search the
IPA domain with a BASE search and the group DN. A BASE search is just a
direct lookup on the LDB level, so it wouldn't be too slow either.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/239/head:pr239
git checkout pr239