[SSSD] [PATCH] Fixed subdomain-related issue in re_expression matching

Stef Walter stefw at gnome.org
Thu Jun 14 10:26:27 UTC 2012


On 06/13/2012 05:14 PM, Jan Zelený wrote:
> One part of the matching was to check whether domain part of fully
> qualified name is a name of a domain or any of its subdomains. The
> problem is that at the time of first request we don't yet have lists of
> subdomains.

Yeah, that's an interesting problem.

> One solution would be to issue a request to data provider, asking for a
> list of subdomains but mixing subdomain logic with re_expression
> matching doesn't seem right. Therefore this patch deletes the check for
> specific domain name, leaving only check for a specific format.

Sadly this completely breaks the multiple re_expression concept. The
only reason we can have multiple re_expression's work and not conflict,
is because we enforce the following during matching:

 * The domain's re_expression must match
 * The domain's re_expression match must produce the domain's name
   (or one of its subdomains).

Without the later condition, it's trivial to have re_expressions overlap
between domains.

To me it (unfortunately) seems that given both subdomains and multiple
re_expressions, resolving a qualified name requires looking up those
subdomains.

Cheers,

Stef



More information about the sssd-devel mailing list