[SSSD] [PATCH] cache_req: check all domains for lookups by certificate

Pavel Březina pbrezina at redhat.com
Wed Nov 11 11:57:23 UTC 2015


On 11/10/2015 10:48 AM, Sumit Bose wrote:
> Hi,
>
> this patch is the equivalent of 374268c5eda35e8bbc2fef30752299199439cffe
> "fix upn cache_req for sub-domain users" for lookups by certificates.
>
> bye,
> Sumit
>
>
> 0001-cache_req-check-all-domains-for-lookups-by-certifica.patch
>
>
>  From 78ac47bfdbb9c91dddefb4de06dcdf41e7035c6a Mon Sep 17 00:00:00 2001
> From: Sumit Bose<sbose at redhat.com>
> Date: Mon, 12 Oct 2015 13:00:28 +0200
> Subject: [PATCH] cache_req: check all domains for lookups by certificate
>
> Like lookup by ID or by UPN the match for lookups by certificate can be
> found in any domain and all sub-domains must be included in the search.
> ---
>   src/responder/common/responder_cache_req.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/src/responder/common/responder_cache_req.c b/src/responder/common/responder_cache_req.c
> index fc63f84f1725b98398d383983c385c01508c73b6..a6fff2253c4057eb7239373be18ab15ba161b3dc 100644
> --- a/src/responder/common/responder_cache_req.c
> +++ b/src/responder/common/responder_cache_req.c
> @@ -982,6 +982,7 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
>           * qualified names instead. */
>           while (state->domain != NULL && state->check_next
>                   && state->domain->fqnames
> +                && state->input->type != CACHE_REQ_USER_BY_CERT
>                   && !cache_req_input_is_upn(state->input)) {
>               state->domain = get_next_domain(state->domain, 0);
>           }
> @@ -1010,9 +1011,9 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
>
>           /* we will continue with the following domain the next time */
>           if (state->check_next) {
> -            if (cache_req_input_is_upn(state->input)) {
> -                state->domain = get_next_domain(state->domain,
> -                                                SSS_GND_DESCEND);
> +            if (cache_req_input_is_upn(state->input)
> +                    || state->input->type != CACHE_REQ_USER_BY_CERT ) {
> +                state->domain = get_next_domain(state->domain, SSS_GND_DESCEND);

Shouldn't this say if state->input->type IS EQUAL TO cert?

>               } else {
>                   state->domain = get_next_domain(state->domain, 0);
>               }
> -- 2.1.0
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>



More information about the sssd-devel mailing list