On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
> On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
>> fixes
https://fedorahosted.org/sssd/ticket/1628
>>
>> When user's alias was the same as pw_name, the sysdb search was failing.
>> This resulted into not contacting the provider again.
>
> Ack
>
> The name is *usually* the same as alias, we just try to canonicalize the
> result of the proxy provider. In 90% of cases, the canonicalization just
> yields the same real name as the name requested (which was passed as an
> alias).
Actually, nack. Sorry, I didn't take a deep enough look the first time
around. The issue really lies in the ghost users as I originally
thought.
This patch only fixes the symptom, not the cause. The bug can
still persist if some other part of the code stores the same string in
name and the alias. That might be weird, but it's two different
attributes, so why not and it actually *might* be happening in a
case_insensitive domain if the original name was already lowercase.
So I think the proper fix would be to change building the filter in
sysdb_add_user() to only include the alias if it differs from the
primary name -OR- only delete the aliases from the ghost attributes,
whichever would be more elegant.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
i modified both the filter creating and aliases removing.
aliases for obvious reason (breaking functionality)
filter - it was working allright, ie:
(|(ghost=johndoe)(ghost=johndoe)) -instead of- (|(ghost=johndoe))
but resulted into doubled search in db
new patch is attached.
Ondra
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1013 Brno 1 office
irc: okos @ #brno