Could you file a bug against pam_mkhomedir?
I can definitely do this, though I'm not exactly sure what the bug is
because I don't think I understand the problem fully. "mkhomedir.so doesn't
play nice with aliased usernames"? Can you offer a little more guidance
and/or explanation?
When running id_provider = ad, we default to operating in case-insensitive
mode.
Is there a config option that exposes case sensitivity mode? If not, such a
feature might be useful. Not sure if that is programmatically
feasible/practical, though.
-Chris
On Wed, Oct 9, 2013 at 12:37 PM, Stephen Gallagher <sgallagh(a)redhat.com>wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/09/2013 12:20 PM, Chris Hartman wrote:
> Well, in a related development, it appears there is a hardware
> issue with the testing PC- bad hard disk. Will replace, reinstall
> OS, and re-test.
>
> However, there is definitely a case sensitivity issue happening.
>
> My other hosts only have an issue when logging in with Guest as
> opposed to guest. Guest causes /home/guest to be created despite
> what's in the unixHomeDirectory attribute; then I'm always dropped
> in / because "Could not chdir to home directory /tmp/Guest: No such
> file or directory." I imagine this because sssd is lowercasing
> usernames but PAM isn't? "getent passwd guest" always returns the
> same result:
> guest:*:1596000501:1596000514:Guest:/tmp/Guest:/bin/bash
Hmm, that would be an interesting interaction problem. Yeah, PAM gets
passed *exactly* what you submit to it. Could you file a bug against
pam_mkhomedir? We probably want to have it normalize the lookup by
running getpwnam() itself to deal with aliased usernames (which is
essentially how we deal with case-insensitivity in SSSD; we treat the
name you passed in as an alias for the REAL user, which is the
lowercase version.).
>
> If I login in with guest, everything works as expected (after the
> cache is cleared). It seems strange that I'm even allowed to auth
> with both guest and Guest. Shouldn't one fail? Is this a bug or
> feature?
>
When running id_provider = ad, we default to operating in
case-insensitive mode. That's a feature.
Now, if they're not returning the same information, that would be a bug.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlJVhi0ACgkQeiVVYja6o6PK4QCfer+OI1eaSSeXJt6Az+61O0my
NXIAn3bG12hR9dStnSn4mY+lznj4LbaI
=RxO6
-----END PGP SIGNATURE-----
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users