[SSSD] [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

Stephen Gallagher sgallagh at redhat.com
Mon Jul 8 20:01:26 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
> Hi,
> 
> Alexander found a long-standing bug that was revealed by the
> recent getsidbynam code. The getsidbynam code in the NSS responder
> searches users by name using sysdb_search_user_by_name() which in
> turn constructs the user DN based on username and sysdb domain
> name. But this is fragile when it comes to case-insensitive domains
> as the RDN contains the original name verbatim (think
> Administrator at AD.EXAMPLE.COM) but the input can be any combination
> of upper and lower case.
> 
> I think it it safest to just do a subtree search instead and search
> using both name and the lowercased alias. This would make the API
> more robust.
> 
> Also I realized that there is an ugly inconsistency when it comes
> to subdomain users which have a FQDN in the name attribute (and by 
> extension RDN). Some sysdb functions treat the name paramater in
> input as "plain name" and append the domain name in case the domain
> is a subdomain, some rely on the caller doing so. I think we
> should definitely standardize the API one way or another.
> 

Ack

Compiles cleanly and passes all sysdb tests. I'd prefer it if you
extended those tests to include alias lookups, but that doesn't have
to block this patch.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlHbGpYACgkQeiVVYja6o6M3LgCfVA+LDOVlLC7R7wktJhR9RhmO
mQYAn1IkMcUHctMGK6xinx8SR894laa0
=V2NK
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list