[SSSD] [PATCH 0/1] RFC: Fix group memberships for subdomain users

Simo Sorce simo at redhat.com
Sun Nov 11 03:05:36 UTC 2012


This patch changes the way subdomain users are stored in the database.

The reason for changing the way we do it is that the sysdb code, before the
subdomain patches were added assumed a single domain per cache file. This
assumption beled in many other interfaces including the way users are read and
returned in the nss responder, as well as potentially how hbac and sudo handle
rules for checking if users are part of a rule.

In order to make sure subdomain users are univocally recognized as such the
safest way is to change how users are saved and always save subdomain users
with sully qualified names.


With this change we solve one of the most eveident issues we currently have
where subdomain users are not listed fully wualified in group membership when
they should.

The side effect of this change is that cache files need to be removed if the
admin decides to change the formatting string for representing fully qualified
users. An action like this has many other important consequences on the system
so I think this limitation is perfectly reasonable.

This patch is in RFC status because I haven't dealt with database migrations
to fix existing subdomain users. Would it be acceptable to simply remove
all subdomain user entries on upgrade ?

Also in order to fix this important issue for 1.9 I have refrained from
significantly changing sysdb interfaces or other code around domain
manipulation. I think such changes are necessary in future. The consequence
of not changing sysdb interfaces is that knowledge of the fact the subdonains
users need to be fully qualified bleeds in various other callers. I hope I
caught all the callers that need to know about this difference but I haven't
yet checked sudo related code for example.

The patch is so far fully tested and allows password based logins with full
HABC checking. getent passwd/group commands also return the extected outputs.

Please review carefully.

Simo Sorce (1):
  Refactor the way subdomain accounts are saved

 src/db/sysdb_search.c            |   17 +++++++++++-
 src/providers/data_provider_be.c |   11 +++++++
 src/providers/ipa/ipa_s2n_exop.c |   54 +++++++++++++++++++++++++++++++++++---
 src/responder/nss/nsssrv_cmd.c   |   36 +++++++++++++++++++++++--
 src/responder/pac/pacsrv_cmd.c   |   15 +++++++++-
 src/responder/pac/pacsrv_utils.c |   52 ++++++++++++++++++++----------------
 src/responder/pam/pamsrv_cmd.c   |   18 ++++++++++++-
 src/util/domain_info_utils.c     |    2 +-
 8 files changed, 170 insertions(+), 35 deletions(-)




More information about the sssd-devel mailing list