URL:
https://github.com/SSSD/sssd/pull/644
Author: joeFischetti
Title: #644: When multiple UIDs exist, use the username provided by the user as the first
lookup
Action: opened
PR body:
"""
The current state of the code has no way of determining the "correct" UID to use
when there are multiple values. If there are multiple values, and the RDN doesn't
match, this update checks the UID's returned against the username that was provided by
the user at the prompt. If that matches, it's used. If that doesn't match, it
falls back to the existing code.
Example:
My ldap record includes multiple uid values, ["genericemployee1",
"itstaff1"]
I need access to machines as "itstaff1". "genericemployee1" is used
as an identifier in other systems/services.
If I log in with "itstaff1" at the prompt, and my ldap lookup with filter
(uid=itstaff1) is successful, the array of UID's are checked against
"itstaff1" and that's what *_primary is set to.
With the current code, if I try to log in with "itstaff1" at the prompt, I'm
actually logged into the system as "genericemployee1". Based on the order that
the values are returned... some other staff are logged into their
"genericemployee" or the "itstaff" accounts.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/644/head:pr644
git checkout pr644