On 3/20/2023 9:13 AM, Alexey Tikhonov wrote:
But probably SSSD should refuse to handle this kind of names
immediately, instead of cutting unallowed chars off and handling what
remains?
Yes please, as the current implementation
Otherwise it leads to a kind of security issue, as shown in the
original email...
effectively aliases the set of '@+<username>' to '<username>'
which I
can't imagine is desirable or intended behavior.
Thanks…