URL:
https://github.com/SSSD/sssd/pull/234
Title: #234: HBAC: Use memberof ASQ search instead of originalMemberOf
jhrozek commented:
"""
On Fri, May 12, 2017 at 04:46:42AM -0700, sumit-bose wrote:
sumit-bose commented on this pull request.
>
- ret = get_ipa_groupname(users->groups, domain->sysdb, member_dn,
- &users->groups[num_groups]);
- if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
+ /* Only groups from the IPA domain can be referenced from HBAC rules. To
+ * avoid evaluating groups which might even have the same name, but come
+ * from a trusted domain, we first copy the DN to a temporary one..
+ */
+ member_group_container = ldb_dn_copy(tmp_ctx, members[i]->dn);
Maybe the check can be simplified by calling something like
if (ldb_dn_get_comp_num(members[i]->dn) != exp_comp ||
ldb_dn_compare(ipa_groups_basedn, members[i]->dn) != 0) {
continue;
}
where
exp_comp = db_dn_get_comp_num(ipa_groups_basedn) + 1;
I agree on the first part, but the second is not clear, sorry. The
ipa_groups_basedn is the group container, but the members[i]->dn
variable is the full group DN, so they will never match..right?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/234#issuecomment-301746001