From 41da9ddfd084024ba9ca20b6d3c0b531c0473231 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 2 Aug 2019 12:07:51 +0200 Subject: [PATCH] Don't qualify users from files domain when default_domain_suffix is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves: https://pagure.io/SSSD/sssd/issue/4052 The files domain should always be non-qualified. The usual rules like qualification of all domains except the one set with default_domain_suffix should not apply. Reviewed-by: Michal Židek --- src/confdb/confdb.c | 7 ++++-- src/man/sssd.conf.5.xml | 8 ++++++- src/tests/intg/test_files_provider.py | 31 +++++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 3 deletions(-) diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c index f6fdbc3aa..be65310dc 100644 --- a/src/confdb/confdb.c +++ b/src/confdb/confdb.c @@ -1049,7 +1049,8 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb, /* Determine if user/group names will be Fully Qualified * in NSS interfaces */ - if (default_domain != NULL) { + if (default_domain != NULL + && is_files_provider(domain) == false) { DEBUG(SSSDBG_CONF_SETTINGS, "Default domain suffix set. Changing default for " "use_fully_qualified_names to True.\n"); @@ -1064,7 +1065,9 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb, goto done; } - if (default_domain != NULL && domain->fqnames == false) { + if (default_domain != NULL + && domain->fqnames == false + && is_files_provider(domain) == false) { DEBUG(SSSDBG_FATAL_FAILURE, "Invalid configuration detected (default_domain_suffix is used " "while use_fully_qualified_names was set to false).\n"); diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 304a6a170..c81012357 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -412,7 +412,13 @@ to log in. Setting this option changes default of use_fully_qualified_names to True. It is not allowed to use this option together with - use_fully_qualified_names set to False. + use_fully_qualified_names set to False. One + exception from this rule are domains with + id_provider=files that always try + to match the behaviour of nss_files + and therefore their output is not + qualified even when the default_domain_suffix + option is used. Default: not set diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py index 784bfa91f..9f3aad994 100644 --- a/src/tests/intg/test_files_provider.py +++ b/src/tests/intg/test_files_provider.py @@ -310,6 +310,22 @@ def domain_resolution_order(request): return None +@pytest.fixture +def default_domain_suffix(request): + conf = unindent("""\ + [sssd] + domains = files + services = nss + default_domain_suffix = foo + + [domain/files] + id_provider = files + """).format(**locals()) + create_conf_fixture(request, conf) + create_sssd_fixture(request) + return None + + @pytest.fixture def override_homedir_and_shell(request): conf = unindent("""\ @@ -1206,6 +1222,21 @@ def test_files_with_domain_resolution_order(add_user_with_canary, check_user(USER1) +def test_files_with_default_domain_suffix(add_user_with_canary, + default_domain_suffix): + """ + Test that when using domain_resolution_order the user won't be using + its fully-qualified name. + """ + ret = poll_canary(call_sssd_getpwuid, CANARY["uid"]) + if ret is False: + return NssReturnCode.NOTFOUND, None + + res, found_user = call_sssd_getpwuid(USER1["uid"]) + assert res == NssReturnCode.SUCCESS + assert found_user == USER1 + + def test_files_with_override_homedir(add_user_with_canary, override_homedir_and_shell): res, user = sssd_getpwnam_sync(USER1["name"]) -- 2.20.1