[SSSD] [PATCH] SYSDB: Don't operate with aliases same as name

Jakub Hrozek jhrozek at redhat.com
Fri Nov 23 18:41:07 UTC 2012


On Fri, Nov 23, 2012 at 10:22:43AM +0100, Ondrej Kos wrote:
> On 22/11/12 19:03, Jakub Hrozek wrote:
> >On Thu, Nov 22, 2012 at 04:51:50PM +0100, Jakub Hrozek wrote:
> >>On Mon, Nov 19, 2012 at 01:43:13PM +0100, Ondrej Kos wrote:
> >>>On 11/19/2012 01:36 PM, Ondrej Kos wrote:
> >>>>On 11/16/2012 05:02 PM, Jakub Hrozek wrote:
> >>>>>On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
> >>>>>>On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
> >>>>>>>fixes https://fedorahosted.org/sssd/ticket/1628
> >>>>>>>
> >>>>>>>When user's alias was the same as pw_name, the sysdb search was
> >>>>>>>failing.
> >>>>>>>This resulted into not contacting the provider again.
> >>>>>>
> >>>>>>Ack
> >>>>>>
> >>>>>>The name is *usually* the same as alias, we just try to canonicalize the
> >>>>>>result of the proxy provider. In 90% of cases, the canonicalization just
> >>>>>>yields the same real name as the name requested (which was passed as an
> >>>>>>alias).
> >>>>>
> >>>>>Actually, nack. Sorry, I didn't take a deep enough look the first time
> >>>>>around. The issue really lies in the ghost users as I originally
> >>>>>thought.
> >>>>>
> >>>>>This patch only fixes the symptom, not the cause. The bug can
> >>>>>still persist if some other part of the code stores the same string in
> >>>>>name and the alias. That might be weird, but it's two different
> >>>>>attributes, so why not and it actually *might* be happening in a
> >>>>>case_insensitive domain if the original name was already lowercase.
> >>>>>
> >>>>>So I think the proper fix would be to change building the filter in
> >>>>>sysdb_add_user() to only include the alias if it differs from the
> >>>>>primary name -OR- only delete the aliases from the ghost attributes,
> >>>>>whichever would be more elegant.
> >>>>>_______________________________________________
> >>>>>sssd-devel mailing list
> >>>>>sssd-devel at lists.fedorahosted.org
> >>>>>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>>>>
> >>>>i modified both the filter creating and aliases removing.
> >>>>aliases for obvious reason (breaking functionality)
> >>>>filter - it was working allright, ie:
> >>>>(|(ghost=johndoe)(ghost=johndoe))   -instead of- (|(ghost=johndoe))
> >>>>but resulted into doubled search in db
> >>>>
> >>>>new patch is attached.
> >>>>
> >>>>Ondra
> >>>>
> >>>>
> >>>>
> >>>>_______________________________________________
> >>>>sssd-devel mailing list
> >>>>sssd-devel at lists.fedorahosted.org
> >>>>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>>>
> >>>self nack, i used wrong variable for the first check, fixed and new
> >>>patch attached..
> >>
> >>Thanks, the code works fine now but I would prefer to wrap the continue
> >>with curly braces, then I'll ack :-)
> >>
> >>if (strcmp(alias, name) == 0) {
> >>     continue;
> >>}
> >
> >The cast should also be to const char, not char, that's what strcmp
> >expects (I just made the same mistake in my code).
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
> Thanks, I updated the code and also built the patch on the current
> master. attached.
> 

Ack



More information about the sssd-devel mailing list