Title: #209: IPA: lookup AD users by certificates on IPA clients
Get a list of users mapped to a certificate back from the IPA server, look
them up and store them together with the certificate used for the search as
mapped attribute to the cache.
Related to https://pagure.io/SSSD/sssd/issue/3050
This is another puzzle piece of looking up users by certificate, this time for
AD users on IPA clients. If you think it should not run under #3050 anymore
please let me know, then I'll open a new ticket.
It turned out that although most of the code was already there to lookup AD
users with the whole certificate it so far never worked, see 3rd patch. Even if
this is fixed the fixed from a0b1bfa76073d3ce3208e67e6d72bb92088edac5 is needed
on the IPA server side as well to allow the processing on reasonable sized
Since it never worked it took the opportunity to replace the single user lookup
with a lookup which returns a list of user to support mapping a certificate to
multiple users. To test this the IPA server side must use the patch from
to get the user list reply.
To test it the InfoPipe or python listbycert request can be used.
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/209/head:pr209
git checkout pr209