[SSSD] sss_get_domain_name: check for fq name first

Jakub Hrozek jhrozek at redhat.com
Tue Oct 14 12:31:39 UTC 2014


On Tue, Oct 14, 2014 at 02:23:16PM +0200, Jakub Hrozek wrote:
> On Mon, Oct 13, 2014 at 04:30:53PM +0200, Pavel Březina wrote:
> > Hi,
> > my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda
> > broke authentication (thx ab).
> > 
> > The problem was that sysdb_get_user_attr is often called with fully
> > qualified name and we basically ended up with "user at domain@domain" name.
> > 
> > One solution would be to translate the name to fq format in IFP. Other would
> > be to change the other places so they use just name without the domain part.
> > But since sysdb_get_user_attr now calls sss_get_domain_name in the same way
> > as other sysdb functions does I think the best solution here is to check the
> > name format in this function and response as appropriate.
> 
> This patch fixed AD subdomain authentication for me.
> 
> I'm sorry for the bad review the first time around.
> 
> ACK to both.

* master: 09a36be00ddcf1d7bd5b8a368143d5b2e2f4fb68
          7a153394bdeb77325b7e4ee1502a1e89fa306f5a



More information about the sssd-devel mailing list