[SSSD] [PATCH] Inheric home dir and shell overrides for subdomains

Jakub Hrozek jhrozek at redhat.com
Tue Jan 14 13:04:40 UTC 2014


Hi,

Jeremy Agee from our QE team found out an inconsistency in how we handle
the home directory and shell fallbacks. If the fallback is set globally
in the [nss] section, then everything works as expected and the
fallbacks are honoured for all users. However, if the fallbacks are set
in the [domain] section, then they only apply for the parent domain, not
subdomains.

I think there is no reason to not inherit the overrides. Even though
there is separate subdomain_homedir override, that parameter serves a
different use case when the primary domain (typically IPA) has POSIX
attributes, but the subdomain does not.

For AD case, I think we should just inherit these settings when creating
the subdomain. The IPA server mode would use these values and they can
be picked up by legacy clients. Non-legacy clients do not have a way to
use the homedir and shell discovered on the server as the extop only
transmits name, UID and GID.

The other patch that is attached is meant to support the default homedir
expansion that contains user name. But because subdomain users have the
FQDN in the name attribute, the 'plain' username has to be extracted from
the FQDN until Michal finishes his refactoring.
-------------- next part --------------
>From cae05c91a8b7a392035eef14c60725f729172fde Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 14 Jan 2014 10:55:39 +0100
Subject: [PATCH 1/2] UTIL: Inherit parent domain's default_shell

Some override parameters were not inherited when creating subdomains.
Especially with AD trusts, this gave strange results.
---
 src/util/domain_info_utils.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index 5e7b2f2b6229aaa73d828c0f903a10a9d27237a5..50b5f06f560a9856297be726e221cfa771ba6adc 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -275,10 +275,13 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx,
     dom->group_timeout = parent->group_timeout;
     dom->netgroup_timeout = parent->netgroup_timeout;
     dom->service_timeout = parent->service_timeout;
-    dom->override_homedir = parent->override_homedir;
     dom->names = parent->names;
 
+    dom->override_homedir = parent->override_homedir;
+    dom->fallback_homedir = parent->fallback_homedir;
     dom->subdomain_homedir = parent->subdomain_homedir;
+    dom->override_shell = parent->override_shell;
+    dom->default_shell = parent->default_shell;
 
     if (parent->sysdb == NULL) {
         DEBUG(SSSDBG_OP_FAILURE, ("Missing sysdb context in parent domain.\n"));
-- 
1.8.4.2

-------------- next part --------------
>From 24392dabab55c847777b35ccaa26d9b5de44ed40 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 14 Jan 2014 11:10:25 +0100
Subject: [PATCH 2/2] NSS: Use plain user name when expanding homedir

---
 src/responder/nss/nsssrv_cmd.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index b051e2994989c4c6aae2058a4651a2f4a216bbca..ddd8372ff8fc5022e6cee16d75b767b057bd4a5c 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -172,13 +172,24 @@ static const char *get_homedir_override(TALLOC_CTX *mem_ctx,
                                         struct ldb_message *msg,
                                         struct nss_ctx *nctx,
                                         struct sss_domain_info *dom,
-                                        const char *name,
+                                        const char *orig_name,
                                         uint32_t uid)
 {
     const char *homedir;
+    char *name;
+    char *domname;
+    errno_t ret;
 
     homedir = ldb_msg_find_attr_as_string(msg, SYSDB_HOMEDIR, NULL);
 
+    /* Subdomain users store FQDN in their name attribute */
+    ret = sss_parse_name(mem_ctx, dom->names, orig_name, &domname, &name);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE, ("Could not parse [%s] into "
+              "name-value components.\n", orig_name));
+        return NULL;
+    }
+
     /* Check whether we are unconditionally overriding the server
      * for home directory locations.
      */
-- 
1.8.4.2



More information about the sssd-devel mailing list