>From ffeaf255263671f8cc43bab3aec7b1304e076705 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 8 Oct 2013 19:10:41 +0200 Subject: [PATCH 2/6] LDAP: Parse FQDN into name/domain for subdomain users Related: https://fedorahosted.org/sssd/ticket/2082 When a subdomain user logs in, the username the account request receives is a FQDN. This hackish patch parses the FQDN and only uses the name to search the LDAP. --- src/providers/ldap/sdap_access.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c index 267a2b863cc1e944998ee53ca985d17d2cef715d..6b387271a229668ddfa5d67143a585e667a16ddd 100644 --- a/src/providers/ldap/sdap_access.c +++ b/src/providers/ldap/sdap_access.c @@ -644,6 +644,8 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx, const char *basedn; char *clean_username; errno_t ret = ERR_INTERNAL; + char *name; + char *domname; req = tevent_req_create(mem_ctx, &state, struct sdap_access_filter_req_ctx); if (req == NULL) { @@ -694,8 +696,16 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx, } /* Construct the filter */ + /* Subdomain users are identified by FQDN. We need to use just the username */ + ret = sss_parse_name(state, domain->names, username, &domname, &name); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("Could not parse [%s] into name and " + "domain components, access might fail\n", username)); + name = discard_const(username); + } - ret = sss_filter_sanitize(state, state->username, &clean_username); + ret = sss_filter_sanitize(state, name, &clean_username); if (ret != EOK) { goto done; } -- 1.8.3.1