[SSSD] [PATCH] PAC: Skip SIDs that cannot be resolved to domain
Jakub Hrozek
jhrozek at redhat.com
Mon Aug 26 09:49:57 UTC 2013
On Mon, Aug 26, 2013 at 11:31:06AM +0200, Jakub Hrozek wrote:
> On Mon, Aug 26, 2013 at 11:17:20AM +0200, Sumit Bose wrote:
> > On Mon, Aug 26, 2013 at 10:19:25AM +0200, Jakub Hrozek wrote:
> > > Hi,
> > >
> > > attached is a small patch I prepared when testing the PAC responder
> > > patches. In my case, the user was a member of a well-known SID S-1-18-1
> > > which didn't resolve into a domain and all his groups were skipped. I
> > > think we should just skip the offending SID and carry on.
> >
> > ACK
> >
> > bye,
> > Sumit
>
> Thanks for the review. btw it seems that this SID is not part of
> tokenGroups (which makes sense given that it's authentication related)
> so we don't have to amend the check for builtin groups we currently
> have.
Pushed to master.
More information about the sssd-devel
mailing list