[SSSD] [PATCH] IPA: Fix checking of trust in originalDN

Lukas Slebodnik lslebodn at redhat.com
Mon Dec 1 09:24:23 UTC 2014


ehlo,

another result of my IPA <-> AD trust issues.

patch is attached.

LS
-------------- next part --------------
>From 04f07630df690dcbddfa5e4db1cb19935cf6444e Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 28 Nov 2014 14:32:29 +0100
Subject: [PATCH 2/2] IPA: Fix checking of trust in originalDN

In function ipa_subdom_get_forest the comment contains says:
 "We are only interested in the member domain objects.
  In IPA the forest root object is stored as e.g.
  cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the
  forest are children of the forest root object e.g.
  cn=SUB.AD.DOM,cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com"

The member domain objects contains 6 components in dn, which cuased
error messages for forest root object.

[ipa_subdom_get_forest] (0x4000):
    Checking if we need the forest name for
    [cn=adtest.dom,cn=ad,cn=trusts,dc=example,dc=test].
[ipa_subdom_get_forest] (0x0400): 4th component is not 'trust', nothing to do.
---
 src/providers/ipa/ipa_subdomains.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 6fdb0befa32f96d01c9b3666a3ef9c8331a83242..c1b07c54cafb5fb6256b6bb33322ff3ab4e2aa9b 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -612,7 +612,7 @@ static errno_t ipa_subdom_get_forest(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    if (ldb_dn_get_comp_num(dn) < 5) {
+    if (ldb_dn_get_comp_num(dn) < 6) {
         /* We are only interested in the member domain objects. In IPA the
          * forest root object is stored as e.g.
          * cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the
-- 
2.1.0



More information about the sssd-devel mailing list