[SSSD] [PATCH] NSS: Ignore default_domain for netgroups

Pavel Březina pbrezina at redhat.com
Tue Aug 12 12:27:59 UTC 2014


On 08/10/2014 06:42 PM, Jakub Hrozek wrote:
> Hi,
>
> I think we shouldn't honor the default_domain_suffix for netgroup lookups
> at all. The main use case for the option is to avoid entering the domain
> for users from AD trusts, where you don't have netgroups on the AD
> side. Moreover, netgroups don't play well eith fully qualified lookups
> either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).
>
> Using default_domain_suffix for netgroups is actually harmful, because
> hostgroups defined on an IPA server are translated into netgroups, so
> honoring the suffix breaks sudo rules in the trust case.
>
> As a side-effect, this patch should fix
> https://fedorahosted.org/sssd/ticket/2400

This sounds reasonable. Ack.




More information about the sssd-devel mailing list