6764555 IPA: Handle empty nisDomainName

Authored and Committed by jhrozek 6 years ago
    IPA: Handle empty nisDomainName
    
    Resolves:
    https://pagure.io/SSSD/sssd/issue/3573
    
    If nisdomain=, i.e. a blank NIS domain name, sssd was not processing the
    netgroup at all. This is not in agreement with man innetgr which says "Any of
    the elements in a triple can be empty, which means that anything matches. The
    functions described here allow access to the netgroup databases".
    
    This patch instead returns an empty domain as well, which eventually
    produces the same output as if the netgroup was requested from the
    compat tree.
    
    To reproduce the bug:
    $ ipa netgroup-add
    Netgroup name: emptydom
    -------------------------
    Added netgroup "emptydom"
    -------------------------
      Netgroup name: emptydom
      NIS domain name: ipa.test
      IPA unique ID: 164bc15a-f4b3-11e7-acdb-525400ca6df3
    $ ipa netgroup-add-member
    Netgroup name: emptydom
    [member user]: admin
    [member group]:
    [member host]:
    [member host group]:
    [member netgroup]:
      Netgroup name: emptydom
      NIS domain name: ipa.test
      Member User: admin
    -------------------------
    Number of members added 1
    -------------------------
    $ ipa netgroup-mod --nisdomain="" emptydom
    ----------------------------
    Modified netgroup "emptydom"
    ----------------------------
      Netgroup name: emptydom
      Member User: admin
    
    Then run:
        getent negroup emptydom
    without the patch, the netgroup won't be resolvable. It will resolve to
    a netgroup triple that looks like this after the patch:
        emptydom              (-,admin,)
    
    Reviewed-by: Fabiano FidĂȘncio <fidencio@redhat.com>