[SSSD] [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

Jakub Hrozek jhrozek at redhat.com
Mon Jul 8 14:16:50 UTC 2013


Hi,

Alexander found a long-standing bug that was revealed by the recent
getsidbynam code. The getsidbynam code in the NSS responder searches
users by name using sysdb_search_user_by_name() which in turn constructs
the user DN based on username and sysdb domain name. But this is fragile
when it comes to case-insensitive domains as the RDN contains the
original name verbatim (think Administrator at AD.EXAMPLE.COM) but the
input can be any combination of upper and lower case.

I think it it safest to just do a subtree search instead and search using
both name and the lowercased alias. This would make the API more robust.

Also I realized that there is an ugly inconsistency when it comes to
subdomain users which have a FQDN in the name attribute (and by
extension RDN). Some sysdb functions treat the name paramater in input
as "plain name" and append the domain name in case the domain is a
subdomain, some rely on the caller doing so. I think we should
definitely standardize the API one way or another.
-------------- next part --------------
>From e05ba152bd26e77501c765b36073a62220f3ecf1 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 8 Jul 2013 16:04:24 +0200
Subject: [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

---
 src/db/sysdb_ops.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index 710a23b098398dd9c4ba9ec875e501fd6af6876d..ff8fb0085d356e5e4ca0062885284a998dfcdb0b 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -248,6 +248,8 @@ int sysdb_search_user_by_name(TALLOC_CTX *mem_ctx,
     struct ldb_message **msgs = NULL;
     struct ldb_dn *basedn;
     size_t msgs_count = 0;
+    char *sanitized_name;
+    char *filter;
     int ret;
 
     tmp_ctx = talloc_new(NULL);
@@ -255,13 +257,26 @@ int sysdb_search_user_by_name(TALLOC_CTX *mem_ctx,
         return ENOMEM;
     }
 
-    basedn = sysdb_user_dn(sysdb, tmp_ctx, domain, name);
+    basedn = ldb_dn_new_fmt(tmp_ctx, sysdb->ldb,
+                            SYSDB_TMPL_USER_BASE, domain->name);
     if (!basedn) {
         ret = ENOMEM;
         goto done;
     }
 
-    ret = sysdb_search_entry(tmp_ctx, sysdb, basedn, LDB_SCOPE_BASE, NULL,
+    ret = sss_filter_sanitize(tmp_ctx, name, &sanitized_name);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    filter = talloc_asprintf(tmp_ctx, SYSDB_PWNAM_FILTER, sanitized_name,
+                             sanitized_name);
+    if (!filter) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = sysdb_search_entry(tmp_ctx, sysdb, basedn, LDB_SCOPE_SUBTREE, filter,
                              attrs?attrs:def_attrs, &msgs_count, &msgs);
     if (ret) {
         goto done;
-- 
1.8.3.1



More information about the sssd-devel mailing list