[SSSD] Case insensitivity behaviour

Simo Sorce simo at redhat.com
Wed Dec 21 16:05:47 UTC 2011


On Wed, 2011-12-21 at 16:40 +0100, Jan Zelený wrote:
> > Hi,
> > 
> > SSSD 1.7 will bring a new feature - the ability to mark a domain as "case
> > insensitive".
> > 
> > As implemented currently, if a domain is case-insensitive, SSSD would
> > store a lowercased alias in addition to the real name and lowercase all
> > queries for that domain so that they match on the alias. However, SSSD
> > would still return the original case sensitive name from the NSS
> > provider. For example, it is possible to look up a user "Foo" with
> > "getent passwd foo", but getent would still return
> > "Foo:*:uid:gid:Foo:/home/Foo:/bin/bash".
> > 
> > One of our users logged https://fedorahosted.org/sssd/ticket/1123
> > requesting that we also lowercase the *result*. I'm not sure it's the
> > right thing to do, I implemented the case sensitivity feature the way I
> > did on purpose, thinking that we still want to return the *real* user name
> > much like we do for multiple CN attributes.
> > 
> > I would appreciate more opinions on this. One of the reasons for
> > implementing this feature in the first place was Windows SSO[1] - I
> > admit I haven't tested this particular scenario, but I think what we
> > have now would suffice so that name lookups would work regardless of
> > case.
> 
> I couldn't find any functionality-based reason for the requested change. Is 
> there one? So far it seems to me that the reason is mostly cosmetic. But in 
> that case I could oppose that it would lowercase the returned result even if I 
> logged in with capitalized login. That's why I think the current solution is 
> the best you could have done.

The reason is very simple.

Think stuff like pam access or any other software that does a getpwuid()
and then wants to compare the name against a list. You absolutely
positively want the cases to match as a lot of software is still
case-sensitive and will treat foo and Foo as different users.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list