Hi,
after further testing we realized there are some more bugs in the PAM
responder related to restricting users.
[PATCH 1/4] PAM: Domain names are case-insensitive
This bug was mostly hitting subdomain users in my tests.
[PATCH 2/4] PAM: Missing argument to domains= should fail auth
Prevents admin from misconfiguring his PAM stack in an insecure way.
[PATCH 3/4] MAN: Misspelled username in pam_trusted_users is not fatal
The man page described behaviour that wasn't implemented (and shouldn't
be)
[PATCH 4/4] RESPONDER: Log failures to resolve user names in csv_string_to_uid_array
Makes it easier to discover misspelled user names in the user lists.
I'm sorry there are no unit test (yet), I'm working on implementing
them:
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=pam
But the progress is slow and we need to apply the patches to downstream.