[SSSD] [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

Jakub Hrozek jhrozek at redhat.com
Mon Jul 8 20:16:05 UTC 2013


On Mon, Jul 08, 2013 at 04:01:26PM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
> > Hi,
> > 
> > Alexander found a long-standing bug that was revealed by the
> > recent getsidbynam code. The getsidbynam code in the NSS responder
> > searches users by name using sysdb_search_user_by_name() which in
> > turn constructs the user DN based on username and sysdb domain
> > name. But this is fragile when it comes to case-insensitive domains
> > as the RDN contains the original name verbatim (think
> > Administrator at AD.EXAMPLE.COM) but the input can be any combination
> > of upper and lower case.
> > 
> > I think it it safest to just do a subtree search instead and search
> > using both name and the lowercased alias. This would make the API
> > more robust.
> > 
> > Also I realized that there is an ugly inconsistency when it comes
> > to subdomain users which have a FQDN in the name attribute (and by 
> > extension RDN). Some sysdb functions treat the name paramater in
> > input as "plain name" and append the domain name in case the domain
> > is a subdomain, some rely on the caller doing so. I think we
> > should definitely standardize the API one way or another.
> > 
> 
> Ack
> 
> Compiles cleanly and passes all sysdb tests. I'd prefer it if you
> extended those tests to include alias lookups, but that doesn't have
> to block this patch.

Yes, I will re-send another version but I wanted to unblock Alexander's
testing first.

Thank you for the review.



More information about the sssd-devel mailing list