[SSSD] [PATCH] SYSDB: Don't operate with aliases same as name
Ondrej Kos
okos at redhat.com
Mon Nov 19 12:36:53 UTC 2012
On 11/16/2012 05:02 PM, Jakub Hrozek wrote:
> On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
>> On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
>>> fixes https://fedorahosted.org/sssd/ticket/1628
>>>
>>> When user's alias was the same as pw_name, the sysdb search was failing.
>>> This resulted into not contacting the provider again.
>>
>> Ack
>>
>> The name is *usually* the same as alias, we just try to canonicalize the
>> result of the proxy provider. In 90% of cases, the canonicalization just
>> yields the same real name as the name requested (which was passed as an
>> alias).
>
> Actually, nack. Sorry, I didn't take a deep enough look the first time
> around. The issue really lies in the ghost users as I originally
> thought.
>
> This patch only fixes the symptom, not the cause. The bug can
> still persist if some other part of the code stores the same string in
> name and the alias. That might be weird, but it's two different
> attributes, so why not and it actually *might* be happening in a
> case_insensitive domain if the original name was already lowercase.
>
> So I think the proper fix would be to change building the filter in
> sysdb_add_user() to only include the alias if it differs from the
> primary name -OR- only delete the aliases from the ghost attributes,
> whichever would be more elegant.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
i modified both the filter creating and aliases removing.
aliases for obvious reason (breaking functionality)
filter - it was working allright, ie:
(|(ghost=johndoe)(ghost=johndoe)) -instead of- (|(ghost=johndoe))
but resulted into doubled search in db
new patch is attached.
Ondra
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1013 Brno 1 office
irc: okos @ #brno
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SYSDB-Don-t-operate-with-aliases-same-as-name.patch
Type: text/x-patch
Size: 1438 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121119/ef9f1117/attachment.bin>
More information about the sssd-devel
mailing list