[SSSD] [PATCH] sysdb: remove ghosts in all sub-domains as well

Sumit Bose sbose at redhat.com
Fri Jan 23 15:39:03 UTC 2015


Hi,

this patch fixes an issue with the handling of universal groups. You can
reproduce it with the following steps either with the AD provider in an
AD forest with multiple domains or with the IPA provider and trust to an
AD forest with multiple domains and a universal group:
- start with an empty cache
- getent group universal_group at dom1.ad
- ldbsearch -H /path/to/cache name=universal_group at dom1.ad

the cached object only has ghost members because no users are resolved

- getent passwd group_member at dom2.ad
- ldbsearch -H /path/to/cache name=universal_group at dom1.ad

if a group member from a different domain than the group itself is
resolved the ghost entry is not removed.

bye,
Sumit
-------------- next part --------------
From c36241e2e1c115b989cb0beec7f54229fc87ab04 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 23 Jan 2015 14:39:07 +0100
Subject: [PATCH] sysdb: remove ghosts in all sub-domains as well

If a user is a member is a group in a different sub-domain, e.g with
universal groups in AD, the ghost attribute might not be properly
removed from the group object if the user is resolved. The reason is
that only groups from the domain of the user were search for ghost
attributes. This patch increases the search-base to all sub-domains of
the configured SSSD domain.

Resolves https://fedorahosted.org/sssd/ticket/2567
---
 src/db/sysdb_ops.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index b12540b68d1c81c419455416294f3449dd84914e..0c254d8cdad1144c32aad7e470fa2a35cd24b38b 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -1219,8 +1219,9 @@ sysdb_remove_ghostattr_from_groups(struct sss_domain_info *domain,
         ERROR_OUT(ret, EINVAL, done);
     }
 
-    tmpdn = ldb_dn_new_fmt(tmp_ctx, domain->sysdb->ldb,
-                            SYSDB_TMPL_GROUP_BASE, domain->name);
+    /* To cover cross-domain group-membership we must search in all
+     * sub-domains. */
+    tmpdn = ldb_dn_new(tmp_ctx, domain->sysdb->ldb, SYSDB_BASE);
     if (!tmpdn) {
         ret = ENOMEM;
         goto done;
-- 
2.1.0



More information about the sssd-devel mailing list