Learn more about these different git repos.
Other Git URLs
If two or more certificate matching rules with the same priority match SSSD should generate a LDAP search filter where the individual search filters are or-ed together (|(rule1)(rule2)....(ruleN)).
Currently only the filter from one of the rules is used.
Work-around: Create a single combined certmap rule where the filters from the individual rules are or-ed together.
FYI, example where I saw this:
ipa certmaprule-add testrule1 --matchrule='<ISSUER>CN=Certificate Authority,O=TESTRELM.TEST' --maprule='(ipacertmapdata=X509:{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})'
ipa certmaprule-add wholecert --matchrule='<ISSUER>CN=Certificate Authority,O=TESTRELM.TEST' --maprule='(userCertificate;binary={cert!bin})'
systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd
dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByCertificate string:"$(cat testuser1.crt)"
would sometimes fail if user had either whole cert or certmapdata.
Metadata Update from @jhrozek: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1447098
Issue linked to Bugzilla: Bug 1447098
Metadata Update from @jhrozek: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1447098, https://bugzilla.redhat.com/show_bug.cgi?id=1447945 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1447098)
Issue linked to Bugzilla: Bug 1447945
Metadata Update from @jhrozek: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1447945 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1447098, https://bugzilla.redhat.com/show_bug.cgi?id=1447945)
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 1.15.3
Metadata Update from @jhrozek: - Issue priority set to: major
Since upstream would like to release a next tarball quite soon, but at the same time this issue is not a blocker, I'm moving it to the next milestone.
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 1.15.4 (was: SSSD 1.15.3)
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 1.16.0 (was: SSSD 1.15.4)
Since we are required to release a new upstream tarball no later than Friday Oct-20, I'm moving tickets that will not be closed by that date to the next milestone, 1.16.1
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 1.16.1 (was: SSSD 1.16.0)
Metadata Update from @jhrozek: - Issue tagged with: postpone-to-2-0
Metadata Update from @jhrozek: - Issue untagged with: postpone-to-2-0 - Issue set to the milestone: SSSD 2.0 (was: SSSD 1.16.1)
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 2.1 (was: SSSD 2.0)
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 2.2 (was: SSSD 2.1)
Metadata Update from @jhrozek: - Issue set to the milestone: SSSD 2.3 (was: SSSD 2.2)
Metadata Update from @thalman: - Issue tagged with: bugzilla
SSSD is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in SSSD's github repository.
This issue has been cloned to Github and is available here: - https://github.com/SSSD/sssd/issues/4415
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @pbrezina: - Issue close_status updated to: cloned-to-github - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.