Learn more about these different git repos.
Other Git URLs
https://bugzilla.redhat.com/show_bug.cgi?id=806209 (Red Hat Enterprise Linux 6)
Description of problem: ldap_user_authorized_host doesn't read non-default value Version-Release number of selected component (if applicable): sssd-1.8.0-17 How reproducible: Always Steps to Reproduce: 1. Add a user with attribute "gecos: host1.example.com": dn: uid=kau10,ou=Users,dc=example,dc=com objectClass: account objectClass: posixAccount cn: Kau10 uidNumber: 101010 gidNumber: 101010 homeDirectory: /home/kau10 loginShell: /bin/bash userPassword:: U2VjcmV0MTIz uid: kau10 gecos: host1.example.com host: host1.example.com 2. Edit sssd.conf and add: access_provider=ldap ldap_access_order=host ldap_user_authorized_host = gecos 3. Restart sssd with clear cache. 4. Login as the user. Actual results: Login fails. Following messages are seen in the log: [sdap_get_map] (0x0200): Option ldap_user_authorized_host has value gecos [sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [user] [sdap_access_host_send] (0x0020): Missing hosts. Access denied Expected results: sssd should get the hostname from gecos attribute of the user and allow login. Additional info: Login is successful after I set "ldap_user_authorized_host = host" in sssd.conf. This issue can be reproduced only when I set "ldap_user_authorized_host = gecos". I added added another ldap attribute "description: host1.example.com" to the user and the issue is no longer seen when I set "ldap_user_authorized_host = description". Also, I tried with "ldap_user_gecos = description" and "ldap_user_authorized_host = gecos" and it works fine in this case. Comment 3 Jakub Hrozek 2012-03-26 13:15:29 EDT This is the case because you have used gecos for *both* user's gecos and the authorizedHost attribute. In this case, the first match (which is user's gecos) wins. As you noted, everything works fine if you also mapped the ldap_user_gecos attribute onto something else. I don't think this is a bug. Comment 4 Stephen Gallagher 2012-03-26 13:26:52 EDT (In reply to comment #3) > This is the case because you have used gecos for *both* user's gecos and the > authorizedHost attribute. In this case, the first match (which is user's gecos) > wins. > > As you noted, everything works fine if you also mapped the ldap_user_gecos > attribute onto something else. > > I don't think this is a bug. It is a bug. We're supposed to be explicitly handling the possibility of having the same attribute address act as more than one option. This was added so we could support using "cn" for multiple options (specifically).
Fields changed
blockedby: => blocking: => coverity: => feature_milestone: => milestone: NEEDS_TRIAGE => SSSD 1.11.0 (LTM) tests: => 0 testsupdated: => 0 upgrade: => 0
proposed_priority: => Optional
This ticket has been evaluated for inclusion into SSSD 1.10 release and was decided to be excluded since it does not match the main goals and themes of the release. It might be considered for later releases.
milestone: SSSD 1.11.0 (LTM) => SSSD 1.12
This was already implemented in eed2073
changelog: => design: => design_review: => 0 fedora_test_page: => mark: => 0 resolution: => duplicate review: => 0 selected: => sensitive: => 0 status: new => closed
Metadata Update from @sgallagh: - Issue set to the milestone: SSSD 1.14
SSSD is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in SSSD's github repository.
This issue has been cloned to Github and is available here: - https://github.com/SSSD/sssd/issues/2321
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Login to comment on this ticket.