URL:
https://github.com/SSSD/sssd/pull/49
Author: jhrozek
Title: #49: Try to match multiple results from an AD initgroups request against
domain's search bases, too
Action: opened
PR body:
"""
This is a proposed way of solving
https://fedorahosted.org/sssd/ticket/3199. It is not complete, because there is
no integration test, the commit message sucks and in general I'm not sure about
the approach.
But the problem is that if a search for a user returns multiple results (which
is the case with nested child domains and GC in use), then we only try to match
against a candidate base DN derived from the domains's name. This works in case
the domain name is the same as the AD forest name, but not otherwise.
Thefore, the patch tries to also take a look at the domain's search base and
match against that as a fallback.
My questions are:
- is this a good idea at all?
- should we loop across all search bases?
- shouldn't we revert the order and first try to match the search base and only
then the domain name?
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/49/head:pr49
git checkout pr49