[SSSD] [PATCH] GPO: use SDAP_SASL_AUTHID as samAccountName

Sumit Bose sbose at redhat.com
Tue Sep 1 12:57:36 UTC 2015


Hi,

this patch contains a fix for https://fedorahosted.org/sssd/ticket/2692.
If uses the SDAP_SASL_AUTHID config option because it already contains
the right NetBIOS name in the AD case.

I basically tested the patch on a host with a long hostname. Without the
patch I see:

[ad_gpo_connect_done] (0x0400): sam_account_name is LONG-HOSTNAME-GPO-TEST$

with the patch it is changed to 

[ad_gpo_connect_done] (0x0400): sam_account_name is LONG-HOSTNAME-G$

and gpo's are found and downloaded. It would be nice is someone can do a
regression test on a host with a shorter name as well.

With this patch the only remaining caller for sss_krb5_get_primary() is
in the same source file. Shall it be made static and removed from
sss_krb5.h?

bye,
Sumit
-------------- next part --------------
From 2ae82f68c247d29f560e173baf3d77399714b3f7 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 1 Sep 2015 13:30:19 +0200
Subject: [PATCH] GPO: use SDAP_SASL_AUTHID as samAccountName

The samAccountName for AD hosts is the hosts NetBIOS name with a
trailing $. Since there is a size limit on NetBIOS names long DNS names
must be truncated to find a matching entry in the AD LDAP tree.

The NetBIOS name is already needed during kinit/SASL bind where the
SDAP_SASL_AUTHID config option is used. Since the GPO lookup code is
only reached after the SASL bind was successful we can safely assume
that the name is correct and use it for the GPO lookup.

Resolves https://fedorahosted.org/sssd/ticket/2692
---
 src/providers/ad/ad_gpo.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index ffd8ac5dd15233788b254cd00a19b5dfc4d127d1..7c9f8ad1eb32076d68ae2c8ea7e8b173bbf9f427 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -1651,7 +1651,7 @@ ad_gpo_connect_done(struct tevent_req *subreq)
     struct tevent_req *req;
     struct ad_gpo_access_state *state;
     char *filter;
-    char *sam_account_name;
+    const char *sam_account_name;
     char *domain_dn;
     int dp_error;
     errno_t ret;
@@ -1721,7 +1721,9 @@ ad_gpo_connect_done(struct tevent_req *subreq)
     DEBUG(SSSDBG_TRACE_ALL, "server_hostname from uri: %s\n",
           state->server_hostname);
 
-    sam_account_name = sss_krb5_get_primary(state, "%S$", state->ad_hostname);
+    /* SDAP_SASL_AUTHID contains the name used for kinit and SASL bind which
+     * in the AD case is the NetBIOS name. */
+    sam_account_name = dp_opt_get_string(state->opts->basic, SDAP_SASL_AUTHID);
     if (sam_account_name == NULL) {
         ret = ENOMEM;
         goto done;
@@ -1744,7 +1746,6 @@ ad_gpo_connect_done(struct tevent_req *subreq)
                              state->opts->user_map[SDAP_OC_USER].name,
                              state->opts->user_map[SDAP_AT_USER_NAME].name,
                              sam_account_name);
-    talloc_zfree(sam_account_name);
     if (filter == NULL) {
         ret = ENOMEM;
         goto done;
-- 
2.1.0



More information about the sssd-devel mailing list