URL:
https://github.com/SSSD/sssd/pull/5503
Author: stanislavlevin
Title: #5503: pam_sss: Don't fail on deskprofiles phase for AD users
Action: edited
Changed field: body
Original value:
"""
By default (if session_provider is not none) during session setup pam_sss attempts to
fetch desktop rules and profiles for user from IPA domain. As part of this job, the data
provider looks for the user info(uid and gid) in IPA domain but fails to do that for AD
user from a trusted domain returning PAM_SESSION_ERR.
The requested target domain has been already found in `dp_req_new` and may be referenced
as `params->domain`. This change doesn't introduce the possibility to fetch
deskprofiles for AD users, but at least, to don't break PAM authentication for them.
Fixes:
https://github.com/SSSD/sssd/issues/5499
"""