[SSSD] [PATCH] LDAP: Do not impose sizelimit=1 for single-entry searches

Jakub Hrozek jhrozek at redhat.com
Thu Jul 23 08:57:53 UTC 2015


On Thu, Jul 23, 2015 at 09:39:00AM +0200, Lukas Slebodnik wrote:
> On (21/07/15 21:33), Jakub Hrozek wrote:
> >Hi,
> >
> >the attached patch fixes regression tracked by
> >https://fedorahosted.org/sssd/ticket/2723
> >
> >Please see the commit message for more details.
> 
> >From 2f4e2e6d5e8f29f5b2cdd9f0b825edc172da57ea Mon Sep 17 00:00:00 2001
> >From: Jakub Hrozek <jhrozek at redhat.com>
> >Date: Tue, 21 Jul 2015 21:00:27 +0200
> >Subject: [PATCH] LDAP: imposing sizelimit=1 for single-entry searches breaks
> > overlapping domains
> >
> >https://fedorahosted.org/sssd/ticket/2723
> >
> >In case there are overlapping sdap domains, a search for a single user
> >might match and return multiple entries. For instance, with AD domains
> >represented by search bases:
> >    DC=win,DC=trust,DC=test
> >    DC=child,DC=win,DC=trust,DC=test
> >
> >A search for user from win.trust.test would be based at:
> >    DC=win,DC=trust,DC=test
> >but would match both search bases and return both users.
> >
> >Instead of performing complex filtering, just save both users. The
> >responder would select the entry that matches the user's search.
> Patch works
> but do we need to store all users?

No, but the number of users we store is at maximum the number of
subdomains, so I didn't think it was an issue.

> 
> IIRC we have a code where we choose user based on the best match of
> domain dn and used dn.

Yes, we have sdap_domain_get_by_dn(). I tried to remove regression with
as minimal patch as possible (restore previous behaviour).

I can also work on additional patch that matches the original DN based
on base DN of sdap_domain if you prefer.. Something like:

    entry_match = None
    for entry in matched_entries:
        if sdap_domain_get_by_dn(entry) == be_req_domain:
            entry_match = entry
            break

    if entry_match == None:
        raise NoMatchError



More information about the sssd-devel mailing list