On Fri, Apr 26, 2013 at 10:28:53AM +0200, Jakub Hrozek wrote:
> On Thu, Apr 25, 2013 at 01:58:37PM +0200, Sumit Bose wrote:
> > Hi,
> >
> > the IPA SELinux provider cannot look up subdomain user. This patch
> > should fix it and ticket
https://fedorahosted.org/sssd/ticket/1892.
> >
> > bye,
> > Sumit
>
> [snip]
>
> > - op_ctx = ipa_selinux_create_op_ctx(be_req, be_ctx->domain->sysdb,
> > - be_ctx->domain,
> > + if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
> > + subdom_be_ctx = ipa_get_subdomains_be_ctx(be_ctx);
> > + if (subdom_be_ctx == NULL) {
> > + DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured,
" \
> > + "trying configured
domain.\n"));
> > + user_domain = be_ctx->domain;
>
> I wonder if this try of a configured domain would ever succeed?
> Shouldn't we just fail in case an unknown domain is requested and
> subdomains are off?
My intention was to preserve the original behaviour as much as possible.
But you are right, currently only the configured domain can be resolved
in this case.
I will modify the patch accordingly.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel