[SSSD] sss_get_domain_name: check for fq name first

Pavel Březina pbrezina at redhat.com
Mon Oct 13 14:30:53 UTC 2014


Hi,
my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda 
broke authentication (thx ab).

The problem was that sysdb_get_user_attr is often called with fully 
qualified name and we basically ended up with "user at domain@domain" name.

One solution would be to translate the name to fq format in IFP. Other 
would be to change the other places so they use just name without the 
domain part. But since sysdb_get_user_attr now calls sss_get_domain_name 
in the same way as other sysdb functions does I think the best solution 
here is to check the name format in this function and response as 
appropriate.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sss_get_domain_name-check-for-fq-name-first.patch
Type: text/x-patch
Size: 1363 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141013/a0d36621/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-tests-add-test-for-sss_get_domain_name.patch
Type: text/x-patch
Size: 2122 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141013/a0d36621/attachment-0001.bin>


More information about the sssd-devel mailing list