On Tue, Oct 29, 2013 at 03:26:43PM +0100, Pavel Březina wrote:
These two patches fix the problem for me. I will just do one small
change in DEBUG message:
+ /* Always store SID string if available */
+ ret = sdap_attrs_get_sid_str(tmpctx, opts->idmap_ctx, attrs,
+ opts->user_map[SDAP_AT_USER_OBJECTSID].sys_name,
+ &sid_str);
+ if (ret == EOK) {
+ ret = sysdb_attrs_add_string(user_attrs, SYSDB_SID_STR, sid_str);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("Could not add SID string: [%s]\n",
+ strerror(ret)));
+ goto done;
+ }
+ } else if (ret == ENOENT) {
+ DEBUG(SSSDBG_TRACE_ALL, ("objectSID: not available for group [%s].\n",
This one will say "user", not "group".
+ user_name));
+ sid_str = NULL;
+ } else {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("Could not identify objectSID: [%s]\n",
+ strerror(ret)));
+ sid_str = NULL;
+ }
+
+ /* If this object has a SID available, we will determine the correct
+ * domain by its SID. */
+ if (sid_str != NULL) {
+ dom = find_subdomain_by_sid(get_domains_head(dom), sid_str);
+ if (dom == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("SID %s does not belong to any known "
+ "domain\n", sid_str));
+ return ERR_DOMAIN_NOT_FOUND;
+ }
+ }
+
From 5817d4a0f971a8d5740bbb32fce1b26d7578d4b2 Mon Sep 17 00:00:00
2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina(a)redhat.com>
Date: Tue, 29 Oct 2013 15:20:10 +0100
Subject: [PATCH 2/2] sdap_save_group: try to determine domain by SID
ACK