[SSSD] sss_get_domain_name: check for fq name first

Jakub Hrozek jhrozek at redhat.com
Tue Oct 14 12:23:16 UTC 2014


On Mon, Oct 13, 2014 at 04:30:53PM +0200, Pavel Březina wrote:
> Hi,
> my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda
> broke authentication (thx ab).
> 
> The problem was that sysdb_get_user_attr is often called with fully
> qualified name and we basically ended up with "user at domain@domain" name.
> 
> One solution would be to translate the name to fq format in IFP. Other would
> be to change the other places so they use just name without the domain part.
> But since sysdb_get_user_attr now calls sss_get_domain_name in the same way
> as other sysdb functions does I think the best solution here is to check the
> name format in this function and response as appropriate.

This patch fixed AD subdomain authentication for me.

I'm sorry for the bad review the first time around.

ACK to both.



More information about the sssd-devel mailing list