On Fri, May 06, 2016 at 03:04:42PM +0200, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
From 18cbf559addfeb77ad83b81e23431295a3e5c6ae Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Fri, 6 May 2016 15:02:19 +0200 Subject: [PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
In ipa_account_info_handler we first check if the request is for a user from a trusted domain and go that way for all request types. In contrast, in the ipa_account_info_done we first check if the requested object is a netgroup. If both are true, we first start a subdomain lookup send but then call netgroup lookup recv, which results in talloc type mismatch and crashes sssd_be.
FWIW, the reporter also confirmed this patch works for them.