From 41da9ddfd084024ba9ca20b6d3c0b531c0473231 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Fri, 2 Aug 2019 12:07:51 +0200
Subject: [PATCH] Don't qualify users from files domain when
 default_domain_suffix is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves:
https://pagure.io/SSSD/sssd/issue/4052

The files domain should always be non-qualified. The usual rules like
qualification of all domains except the one set with
default_domain_suffix should not apply.

Reviewed-by: Michal Židek <mzidek@redhat.com>
---
 src/confdb/confdb.c                   |  7 ++++--
 src/man/sssd.conf.5.xml               |  8 ++++++-
 src/tests/intg/test_files_provider.py | 31 +++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
index f6fdbc3aa..be65310dc 100644
--- a/src/confdb/confdb.c
+++ b/src/confdb/confdb.c
@@ -1049,7 +1049,8 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
 
     /* Determine if user/group names will be Fully Qualified
      * in NSS interfaces */
-    if (default_domain != NULL) {
+    if (default_domain != NULL
+             && is_files_provider(domain) == false) {
         DEBUG(SSSDBG_CONF_SETTINGS,
               "Default domain suffix set. Changing default for "
               "use_fully_qualified_names to True.\n");
@@ -1064,7 +1065,9 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
         goto done;
     }
 
-    if (default_domain != NULL && domain->fqnames == false) {
+    if (default_domain != NULL
+            && domain->fqnames == false
+            && is_files_provider(domain) == false) {
         DEBUG(SSSDBG_FATAL_FAILURE,
               "Invalid configuration detected (default_domain_suffix is used "
               "while use_fully_qualified_names was set to false).\n");
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 304a6a170..c81012357 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -412,7 +412,13 @@
                                 to log in. Setting this option changes default
                                 of use_fully_qualified_names to True. It is not
                                 allowed to use this option together with
-                                use_fully_qualified_names set to False.
+                                use_fully_qualified_names set to False. One
+                                exception from this rule are domains with
+                                <quote>id_provider=files</quote> that always try
+                                to match the behaviour of nss_files
+                                and therefore their output is not
+                                qualified even when the default_domain_suffix
+                                option is used.
                             </para>
                             <para>
                                 Default: not set
diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py
index 784bfa91f..9f3aad994 100644
--- a/src/tests/intg/test_files_provider.py
+++ b/src/tests/intg/test_files_provider.py
@@ -310,6 +310,22 @@ def domain_resolution_order(request):
     return None
 
 
+@pytest.fixture
+def default_domain_suffix(request):
+    conf = unindent("""\
+        [sssd]
+        domains             = files
+        services            = nss
+        default_domain_suffix = foo
+
+        [domain/files]
+        id_provider = files
+    """).format(**locals())
+    create_conf_fixture(request, conf)
+    create_sssd_fixture(request)
+    return None
+
+
 @pytest.fixture
 def override_homedir_and_shell(request):
     conf = unindent("""\
@@ -1206,6 +1222,21 @@ def test_files_with_domain_resolution_order(add_user_with_canary,
     check_user(USER1)
 
 
+def test_files_with_default_domain_suffix(add_user_with_canary,
+                                          default_domain_suffix):
+    """
+    Test that when using domain_resolution_order the user won't be using
+    its fully-qualified name.
+    """
+    ret = poll_canary(call_sssd_getpwuid, CANARY["uid"])
+    if ret is False:
+        return NssReturnCode.NOTFOUND, None
+
+    res, found_user = call_sssd_getpwuid(USER1["uid"])
+    assert res == NssReturnCode.SUCCESS
+    assert found_user == USER1
+
+
 def test_files_with_override_homedir(add_user_with_canary,
                                      override_homedir_and_shell):
     res, user = sssd_getpwnam_sync(USER1["name"])
-- 
2.20.1