[SSSD] [PATCH] PAC: do not delete originalDN if present

Jakub Hrozek jhrozek at redhat.com
Mon Jun 24 13:14:38 UTC 2013


On Mon, Jun 24, 2013 at 02:01:32PM +0200, Sumit Bose wrote:
> Hi,
> 
> this patch fixes an issue Jakub found when using IPA user and HBAC rules
> with current SSSD master tree. Please see commit message for details.
> 
> I've opened https://fedorahosted.org/sssd/ticket/1996 to improve the
> update scheme.
> 
> bye,
> Sumit

This patch fixes the issue for me and since we have a ticket open to
track the problem in a more systematic way, I'm fine with this.

Ack

btw we also discussed that we shouldn't resolve the groups via PAC for
local IPA users but should just stick to dereferencing the memberof
attribute:
https://fedorahosted.org/sssd/ticket/1995



More information about the sssd-devel mailing list