[SSSD] [RFC] Change default regular-expressions for user names

Simo Sorce simo at redhat.com
Thu May 22 12:49:34 UTC 2014


On Thu, 2014-05-22 at 10:11 +0200, Sumit Bose wrote:
> Hi,
> 
> I would like to use getpwnam() to find the POSIX user for a given
> Kerberos principal. To achieve this I have to change the
> regular-expression we use to split the user name into name and domain
> components because we use '@' as a delimiter here and Kerberos
> principals contain an '@' as well.
> 
> My idea is to allow an '@' in the name part so that 'a at b@c' is split
> into the name part 'a at b' and the domain part 'c'. A name containing an
> '@' will then be considered as a Kerberos principal by SSSD and used
> accordingly. If the domain is not known and the Kerberos principal
> should be searched in all known domains a single '@' at the end, e.g.
> 'a at b@' shall indicate that the argument is a Kerberos principal.
> 
> I would like to know if you agree with this approach, if you have
> concerns and other suggestions?
> 
> As a side node. While looking at this I found some oddities in the
> current regular-expressions. E.g. currently '@' is not allowed in the
> name part, but in the domain part when '@' is the separator. This leads
> to a splitting of 'a at b@c' to name 'a' and domain 'b at c'. For AD-style
> names with '\' as a separator '@' is allowed in names, i.e. 'a\b at c' will
> be result in name 'b at c' and domain 'a' (so in theory I could use this
> scheme to send a Kerberos principal to SSSD, but for me this looks even
> stranger than my suggestion above, it hard to use on the command-line
> and does not solve the case where the domain is not known). I will try
> to fix those inconsistencies as well.

I don't like this much.

Instinctively I would say the current scheme should be just fine, if you
pass in name at REALM you get REALM as the domain name. If they match (bar
case), then you search for name as the username. If they do not match
and you end up finding no domain, then we can internally decide to
search all domain using name at REALM as the principal in a ldb_search().

Where does this break ?

Is it possible to have a user foo in domain example.com that has a
principal of bar at EXAMPLE.COM ? And at the same time also have a user
'bar' in the same domain ?
Is this the case you are trying to handle ? How likely is it ?

Btw, I was thinking whether we should handle cases where you pass in
things like root/admin at REALM this would require some special mapping
rules ... have you thought about these cases ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list