[SSSD] [PATCH] NSS: Ignore default_domain for netgroups

Jakub Hrozek jhrozek at redhat.com
Wed Aug 13 07:53:33 UTC 2014


On Tue, Aug 12, 2014 at 02:27:59PM +0200, Pavel Březina wrote:
> On 08/10/2014 06:42 PM, Jakub Hrozek wrote:
> >Hi,
> >
> >I think we shouldn't honor the default_domain_suffix for netgroup lookups
> >at all. The main use case for the option is to avoid entering the domain
> >for users from AD trusts, where you don't have netgroups on the AD
> >side. Moreover, netgroups don't play well eith fully qualified lookups
> >either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).
> >
> >Using default_domain_suffix for netgroups is actually harmful, because
> >hostgroups defined on an IPA server are translated into netgroups, so
> >honoring the suffix breaks sudo rules in the trust case.
> >
> >As a side-effect, this patch should fix
> >https://fedorahosted.org/sssd/ticket/2400
> 
> This sounds reasonable. Ack.

Sorry, I forgot to send pushmail:
    * master: e6d441518531e7931e29dd8c65a3448a213e3865
    * sssd-1-11: 484a9f2fc6952199096ea5afb486b3eddb545c20 



More information about the sssd-devel mailing list