[SSSD] [PATCH] PAC: Skip SIDs that cannot be resolved to domain

Jakub Hrozek jhrozek at redhat.com
Mon Aug 26 09:31:06 UTC 2013


On Mon, Aug 26, 2013 at 11:17:20AM +0200, Sumit Bose wrote:
> On Mon, Aug 26, 2013 at 10:19:25AM +0200, Jakub Hrozek wrote:
> > Hi,
> > 
> > attached is a small patch I prepared when testing the PAC responder
> > patches. In my case, the user was a member of a well-known SID S-1-18-1
> > which didn't resolve into a domain and all his groups were skipped. I
> > think we should just skip the offending SID and carry on.
> 
> ACK
> 
> bye,
> Sumit

Thanks for the review. btw it seems that this SID is not part of
tokenGroups (which makes sense given that it's authentication related)
so we don't have to amend the check for builtin groups we currently
have.



More information about the sssd-devel mailing list