[SSSD] [PATCH] Fixed subdomain-related issue in re_expression matching

Jan Zelený jzeleny at redhat.com
Thu Jun 14 10:50:51 UTC 2012


> On 06/13/2012 05:14 PM, Jan Zelený wrote:
> > One part of the matching was to check whether domain part of fully
> > qualified name is a name of a domain or any of its subdomains. The
> > problem is that at the time of first request we don't yet have lists of
> > subdomains.
> 
> Yeah, that's an interesting problem.
> 
> > One solution would be to issue a request to data provider, asking for a
> > list of subdomains but mixing subdomain logic with re_expression
> > matching doesn't seem right. Therefore this patch deletes the check for
> > specific domain name, leaving only check for a specific format.
> 
> Sadly this completely breaks the multiple re_expression concept. The
> only reason we can have multiple re_expression's work and not conflict,
> is because we enforce the following during matching:
> 
>  * The domain's re_expression must match
>  * The domain's re_expression match must produce the domain's name
>    (or one of its subdomains).
> 
> Without the later condition, it's trivial to have re_expressions overlap
> between domains.
> 
> To me it (unfortunately) seems that given both subdomains and multiple
> re_expressions, resolving a qualified name requires looking up those
> subdomains.

Before proposing the patch, I was going through the original review thread 
looking exactly for this kind of information but it wasn't clear to me if the 
domain matching is completely necessary. I think I understand it now, thanks 
for the clarification.

Do you want to implement fix for the issue yourself or should I give it a shot?

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120614/81b99abd/attachment.sig>


More information about the sssd-devel mailing list