On Tue, Jul 09, 2013 at 08:16:16AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/09/2013 06:37 AM, Jakub Hrozek wrote:
> On Mon, Jul 08, 2013 at 10:16:05PM +0200, Jakub Hrozek wrote:
>> On Mon, Jul 08, 2013 at 04:01:26PM -0400, Stephen Gallagher
>> wrote:
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>>
>>> On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
>>>> Hi,
>>>>
>>>> Alexander found a long-standing bug that was revealed by the
>>>> recent getsidbynam code. The getsidbynam code in the NSS
>>>> responder searches users by name using
>>>> sysdb_search_user_by_name() which in turn constructs the user
>>>> DN based on username and sysdb domain name. But this is
>>>> fragile when it comes to case-insensitive domains as the RDN
>>>> contains the original name verbatim (think
>>>> Administrator(a)AD.EXAMPLE.COM) but the input can be any
>>>> combination of upper and lower case.
>>>>
>>>> I think it it safest to just do a subtree search instead and
>>>> search using both name and the lowercased alias. This would
>>>> make the API more robust.
>>>>
>>>> Also I realized that there is an ugly inconsistency when it
>>>> comes to subdomain users which have a FQDN in the name
>>>> attribute (and by extension RDN). Some sysdb functions treat
>>>> the name paramater in input as "plain name" and append the
>>>> domain name in case the domain is a subdomain, some rely on
>>>> the caller doing so. I think we should definitely standardize
>>>> the API one way or another.
>>>>
>>>
>>> Ack
>>>
>>> Compiles cleanly and passes all sysdb tests. I'd prefer it if
>>> you extended those tests to include alias lookups, but that
>>> doesn't have to block this patch.
>>
>> Yes, I will re-send another version but I wanted to unblock
>> Alexander's testing first.
>>
>> Thank you for the review.
>
> Attached is a version of the patch that also adds a unit test. I
> also attached just the unit test so you can quickly verify that the
> test failed without the sysdb patch.
>
Ack to these patches.
Pushed to master and sssd-1-10
I'd still like to see some tests in the sysdb suite for dealing
with
aliases in the users and groups, though. I'll file a separate RFE for
that.
Thank you. It would be nice to extend the coverage along with
making the API consistent wrt accepting FQDN or just name when storing a
subdomain user (which is one of the main alias use cases along with the
AD provider).
The ticket to make the API consistent is:
https://fedorahosted.org/sssd/ticket/2011