[SSSD] [PATCH] DB: sysdb_search_user_by_name: search by both name and alias

Jakub Hrozek jhrozek at redhat.com
Tue Jul 9 12:40:32 UTC 2013


On Tue, Jul 09, 2013 at 08:16:16AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 07/09/2013 06:37 AM, Jakub Hrozek wrote:
> > On Mon, Jul 08, 2013 at 10:16:05PM +0200, Jakub Hrozek wrote:
> >> On Mon, Jul 08, 2013 at 04:01:26PM -0400, Stephen Gallagher
> >> wrote:
> >>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >>> 
> >>> On 07/08/2013 10:16 AM, Jakub Hrozek wrote:
> >>>> Hi,
> >>>> 
> >>>> Alexander found a long-standing bug that was revealed by the 
> >>>> recent getsidbynam code. The getsidbynam code in the NSS
> >>>> responder searches users by name using
> >>>> sysdb_search_user_by_name() which in turn constructs the user
> >>>> DN based on username and sysdb domain name. But this is
> >>>> fragile when it comes to case-insensitive domains as the RDN
> >>>> contains the original name verbatim (think 
> >>>> Administrator at AD.EXAMPLE.COM) but the input can be any
> >>>> combination of upper and lower case.
> >>>> 
> >>>> I think it it safest to just do a subtree search instead and
> >>>> search using both name and the lowercased alias. This would
> >>>> make the API more robust.
> >>>> 
> >>>> Also I realized that there is an ugly inconsistency when it
> >>>> comes to subdomain users which have a FQDN in the name
> >>>> attribute (and by extension RDN). Some sysdb functions treat
> >>>> the name paramater in input as "plain name" and append the
> >>>> domain name in case the domain is a subdomain, some rely on
> >>>> the caller doing so. I think we should definitely standardize
> >>>> the API one way or another.
> >>>> 
> >>> 
> >>> Ack
> >>> 
> >>> Compiles cleanly and passes all sysdb tests. I'd prefer it if
> >>> you extended those tests to include alias lookups, but that
> >>> doesn't have to block this patch.
> >> 
> >> Yes, I will re-send another version but I wanted to unblock
> >> Alexander's testing first.
> >> 
> >> Thank you for the review.
> > 
> > Attached is a version of the patch that also adds a unit test. I
> > also attached just the unit test so you can quickly verify that the
> > test failed without the sysdb patch.
> > 
> 
> Ack to these patches.
> 

Pushed to master and sssd-1-10

> I'd still like to see some tests in the sysdb suite for dealing with
> aliases in the users and groups, though. I'll file a separate RFE for
> that.

Thank you. It would be nice to extend the coverage along with
making the API consistent wrt accepting FQDN or just name when storing a
subdomain user (which is one of the main alias use cases along with the
AD provider).

The ticket to make the API consistent is:
https://fedorahosted.org/sssd/ticket/2011



More information about the sssd-devel mailing list