[SSSD] [PATCH] IPA: warn if full_name_format is customized in server mode

Jakub Hrozek jhrozek at redhat.com
Wed Jul 17 16:13:50 UTC 2013


https://fedorahosted.org/sssd/ticket/2009

If the IPA server mode is on and the SSSD is running on the IPA server,
then the server's extdom plugin calls getpwnam_r to read info about trusted
users from the AD server and return them to the clients that called the
extended operation.

The SSSD returns the subdomain users fully-qualified, ie "user at domain"
by default. The format of the fully qualified name is configurable.

However, the extdom plugin returns the user name without the domain
component.

With this patch, when ipa_server_mode is on, warn if the full_name_format
is set to a non-default value. That would prompt the admin to change the
format if he changed it to something exotic.
-------------- next part --------------
>From ea124bb09064355cd49733ce9ba82cea2e37d39d Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 12 Jul 2013 15:19:02 +0200
Subject: [PATCH] IPA: warn if full_name_format is customized in server mode

https://fedorahosted.org/sssd/ticket/2009

If the IPA server mode is on and the SSSD is running on the IPA server,
then the server's extdom plugin calls getpwnam_r to read info about trusted
users from the AD server and return them to the clients that called the
extended operation.

The SSSD returns the subdomain users fully-qualified, ie "user at domain"
by default. The format of the fully qualified name is configurable.

However, the extdom plugin returns the user name without the domain
component.

With this patch, when ipa_server_mode is on, warn if the full_name_format
is set to a non-default value. That would prompt the admin to change the
format if he changed it to something exotic.
---
 src/confdb/confdb.h                |  2 ++
 src/providers/ipa/ipa_subdomains.c | 17 +++++++++++++++++
 src/util/usertools.c               |  2 +-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 01eade2b5a6628416964d16f65e37698f4a9db65..3e88b78f3ef4f8e98ac6a1a0e7552f6a232bbbc4 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -71,6 +71,8 @@
 /* Both monitor and domains */
 #define CONFDB_NAME_REGEX   "re_expression"
 #define CONFDB_FULL_NAME_FORMAT "full_name_format"
+#define CONFDB_DEFAULT_FULL_NAME_FORMAT "%1$s@%2$s%3$s"
+#define CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD "%1$s@%2$s"
 
 /* Responders */
 #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout"
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 7910e246699e265d1ddd54c66eca6e7c434df204..a09f07ac9473b105d01273980c5c294d838b26a2 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1118,6 +1118,23 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
         return EOK;
     }
 
+    /* The IPA code relies on the default FQDN format to unparse user
+     * names. Warn loudly if the full_name_format was customized on the
+     * IPA server
+     */
+    if ((strcmp(be_ctx->domain->names->fq_fmt,
+               CONFDB_DEFAULT_FULL_NAME_FORMAT) != 0)
+            && (strcmp(be_ctx->domain->names->fq_fmt,
+                       CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD) != 0)) {
+        DEBUG(SSSDBG_FATAL_FAILURE, ("%s is set to a non-default value [%s] " \
+              "lookups of subdomain users will likely fail!\n",
+              CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt));
+        sss_log(SSS_LOG_ERR, "%s is set to a non-default value [%s] " \
+                "lookups of subdomain users will likely fail!\n",
+                CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt);
+        /* Attempt to continue */
+    }
+
     realm = dp_opt_get_string(id_ctx->ipa_options->basic, IPA_KRB5_REALM);
     if (realm == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm for IPA?\n"));
diff --git a/src/util/usertools.c b/src/util/usertools.c
index dc863ce82d21a857cc6a28bb963e0e729c38b583..7ec14b35118b8edb930314050339719539f0f7ff 100644
--- a/src/util/usertools.c
+++ b/src/util/usertools.c
@@ -306,7 +306,7 @@ int sss_names_init(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb,
     }
 
     if (!fq_fmt) {
-        fq_fmt = talloc_strdup(tmpctx, "%1$s@%2$s");
+        fq_fmt = talloc_strdup(tmpctx, CONFDB_DEFAULT_FULL_NAME_FORMAT);
         if (!fq_fmt) {
             ret = ENOMEM;
             goto done;
-- 
1.8.3.1



More information about the sssd-devel mailing list