[SSSD] [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

Stephen Gallagher sgallagh at redhat.com
Tue Jul 9 12:16:16 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/09/2013 06:37 AM, Jakub Hrozek wrote:
> On Mon, Jul 08, 2013 at 10:16:05PM +0200, Jakub Hrozek wrote:
>> On Mon, Jul 08, 2013 at 04:01:26PM -0400, Stephen Gallagher
>> wrote:
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>> 
>>> On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
>>>> Hi,
>>>> 
>>>> Alexander found a long-standing bug that was revealed by the 
>>>> recent getsidbynam code. The getsidbynam code in the NSS
>>>> responder searches users by name using
>>>> sysdb_search_user_by_name() which in turn constructs the user
>>>> DN based on username and sysdb domain name. But this is
>>>> fragile when it comes to case-insensitive domains as the RDN
>>>> contains the original name verbatim (think 
>>>> Administrator at AD.EXAMPLE.COM) but the input can be any
>>>> combination of upper and lower case.
>>>> 
>>>> I think it it safest to just do a subtree search instead and
>>>> search using both name and the lowercased alias. This would
>>>> make the API more robust.
>>>> 
>>>> Also I realized that there is an ugly inconsistency when it
>>>> comes to subdomain users which have a FQDN in the name
>>>> attribute (and by extension RDN). Some sysdb functions treat
>>>> the name paramater in input as "plain name" and append the
>>>> domain name in case the domain is a subdomain, some rely on
>>>> the caller doing so. I think we should definitely standardize
>>>> the API one way or another.
>>>> 
>>> 
>>> Ack
>>> 
>>> Compiles cleanly and passes all sysdb tests. I'd prefer it if
>>> you extended those tests to include alias lookups, but that
>>> doesn't have to block this patch.
>> 
>> Yes, I will re-send another version but I wanted to unblock
>> Alexander's testing first.
>> 
>> Thank you for the review.
> 
> Attached is a version of the patch that also adds a unit test. I
> also attached just the unit test so you can quickly verify that the
> test failed without the sysdb patch.
> 

Ack to these patches.

I'd still like to see some tests in the sysdb suite for dealing with
aliases in the users and groups, though. I'll file a separate RFE for
that.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlHb/xAACgkQeiVVYja6o6P7vwCffowoHai87hVPsxVJPywIMOdI
5W0An3W5Lw+Mrb7Ljpf87EHDYLK3XwXi
=ZSUj
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list