>From ea124bb09064355cd49733ce9ba82cea2e37d39d Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 12 Jul 2013 15:19:02 +0200 Subject: [PATCH] IPA: warn if full_name_format is customized in server mode https://fedorahosted.org/sssd/ticket/2009 If the IPA server mode is on and the SSSD is running on the IPA server, then the server's extdom plugin calls getpwnam_r to read info about trusted users from the AD server and return them to the clients that called the extended operation. The SSSD returns the subdomain users fully-qualified, ie "user@domain" by default. The format of the fully qualified name is configurable. However, the extdom plugin returns the user name without the domain component. With this patch, when ipa_server_mode is on, warn if the full_name_format is set to a non-default value. That would prompt the admin to change the format if he changed it to something exotic. --- src/confdb/confdb.h | 2 ++ src/providers/ipa/ipa_subdomains.c | 17 +++++++++++++++++ src/util/usertools.c | 2 +- 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h index 01eade2b5a6628416964d16f65e37698f4a9db65..3e88b78f3ef4f8e98ac6a1a0e7552f6a232bbbc4 100644 --- a/src/confdb/confdb.h +++ b/src/confdb/confdb.h @@ -71,6 +71,8 @@ /* Both monitor and domains */ #define CONFDB_NAME_REGEX "re_expression" #define CONFDB_FULL_NAME_FORMAT "full_name_format" +#define CONFDB_DEFAULT_FULL_NAME_FORMAT "%1$s@%2$s%3$s" +#define CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD "%1$s@%2$s" /* Responders */ #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout" diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c index 7910e246699e265d1ddd54c66eca6e7c434df204..a09f07ac9473b105d01273980c5c294d838b26a2 100644 --- a/src/providers/ipa/ipa_subdomains.c +++ b/src/providers/ipa/ipa_subdomains.c @@ -1118,6 +1118,23 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx, return EOK; } + /* The IPA code relies on the default FQDN format to unparse user + * names. Warn loudly if the full_name_format was customized on the + * IPA server + */ + if ((strcmp(be_ctx->domain->names->fq_fmt, + CONFDB_DEFAULT_FULL_NAME_FORMAT) != 0) + && (strcmp(be_ctx->domain->names->fq_fmt, + CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD) != 0)) { + DEBUG(SSSDBG_FATAL_FAILURE, ("%s is set to a non-default value [%s] " \ + "lookups of subdomain users will likely fail!\n", + CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt)); + sss_log(SSS_LOG_ERR, "%s is set to a non-default value [%s] " \ + "lookups of subdomain users will likely fail!\n", + CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt); + /* Attempt to continue */ + } + realm = dp_opt_get_string(id_ctx->ipa_options->basic, IPA_KRB5_REALM); if (realm == NULL) { DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm for IPA?\n")); diff --git a/src/util/usertools.c b/src/util/usertools.c index dc863ce82d21a857cc6a28bb963e0e729c38b583..7ec14b35118b8edb930314050339719539f0f7ff 100644 --- a/src/util/usertools.c +++ b/src/util/usertools.c @@ -306,7 +306,7 @@ int sss_names_init(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb, } if (!fq_fmt) { - fq_fmt = talloc_strdup(tmpctx, "%1$s@%2$s"); + fq_fmt = talloc_strdup(tmpctx, CONFDB_DEFAULT_FULL_NAME_FORMAT); if (!fq_fmt) { ret = ENOMEM; goto done; -- 1.8.3.1