[SSSD] [PATCH] SYSDB: Don't operate with aliases same as name

Ondrej Kos okos at redhat.com
Mon Nov 19 12:36:53 UTC 2012


On 11/16/2012 05:02 PM, Jakub Hrozek wrote:
> On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
>> On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
>>> fixes https://fedorahosted.org/sssd/ticket/1628
>>>
>>> When user's alias was the same as pw_name, the sysdb search was failing.
>>> This resulted into not contacting the provider again.
>>
>> Ack
>>
>> The name is *usually* the same as alias, we just try to canonicalize the
>> result of the proxy provider. In 90% of cases, the canonicalization just
>> yields the same real name as the name requested (which was passed as an
>> alias).
>
> Actually, nack. Sorry, I didn't take a deep enough look the first time
> around. The issue really lies in the ghost users as I originally
> thought.
>
> This patch only fixes the symptom, not the cause. The bug can
> still persist if some other part of the code stores the same string in
> name and the alias. That might be weird, but it's two different
> attributes, so why not and it actually *might* be happening in a
> case_insensitive domain if the original name was already lowercase.
>
> So I think the proper fix would be to change building the filter in
> sysdb_add_user() to only include the alias if it differs from the
> primary name -OR- only delete the aliases from the ghost attributes,
> whichever would be more elegant.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
i modified both the filter creating and aliases removing.
aliases for obvious reason (breaking functionality)
filter - it was working allright, ie:
(|(ghost=johndoe)(ghost=johndoe))   -instead of- (|(ghost=johndoe))
but resulted into doubled search in db

new patch is attached.

Ondra

-- 
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech

phone: +420-532-294-558
cell:  +420-736-417-909
ext:   82-62558
loc:   1013 Brno 1 office
irc:   okos @ #brno
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SYSDB-Don-t-operate-with-aliases-same-as-name.patch
Type: text/x-patch
Size: 1438 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121119/ef9f1117/attachment.bin>


More information about the sssd-devel mailing list