[SSSD] [PATCH] SYSDB: Don't operate with aliases same as name

Ondrej Kos okos at redhat.com
Mon Nov 19 12:43:13 UTC 2012


On 11/19/2012 01:36 PM, Ondrej Kos wrote:
> On 11/16/2012 05:02 PM, Jakub Hrozek wrote:
>> On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
>>> On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
>>>> fixes https://fedorahosted.org/sssd/ticket/1628
>>>>
>>>> When user's alias was the same as pw_name, the sysdb search was
>>>> failing.
>>>> This resulted into not contacting the provider again.
>>>
>>> Ack
>>>
>>> The name is *usually* the same as alias, we just try to canonicalize the
>>> result of the proxy provider. In 90% of cases, the canonicalization just
>>> yields the same real name as the name requested (which was passed as an
>>> alias).
>>
>> Actually, nack. Sorry, I didn't take a deep enough look the first time
>> around. The issue really lies in the ghost users as I originally
>> thought.
>>
>> This patch only fixes the symptom, not the cause. The bug can
>> still persist if some other part of the code stores the same string in
>> name and the alias. That might be weird, but it's two different
>> attributes, so why not and it actually *might* be happening in a
>> case_insensitive domain if the original name was already lowercase.
>>
>> So I think the proper fix would be to change building the filter in
>> sysdb_add_user() to only include the alias if it differs from the
>> primary name -OR- only delete the aliases from the ghost attributes,
>> whichever would be more elegant.
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>
> i modified both the filter creating and aliases removing.
> aliases for obvious reason (breaking functionality)
> filter - it was working allright, ie:
> (|(ghost=johndoe)(ghost=johndoe))   -instead of- (|(ghost=johndoe))
> but resulted into doubled search in db
>
> new patch is attached.
>
> Ondra
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
self nack, i used wrong variable for the first check, fixed and new 
patch attached..

-- 
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech

phone: +420-532-294-558
cell:  +420-736-417-909
ext:   82-62558
loc:   1013 Brno 1 office
irc:   okos @ #brno
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SYSDB-Don-t-operate-with-aliases-same-as-name.patch
Type: text/x-patch
Size: 1438 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121119/23745e9f/attachment.bin>


More information about the sssd-devel mailing list