ac62484 ipa-kdb: simplify trusted domain parent search

1 file Authored by abbra 3 years ago , Committed by mbabinsk 3 years ago ,
    ipa-kdb: simplify trusted domain parent search
    In terms of cross-forest trust parent domain is the root domain of
    the forest because we only have trust established with the forest root.
    In FreeIPA LDAP store all sub-domains stored in cn=<forest root="">,
    cn=ad,cn=trusts,... subtree. Thus, a first RDN after cn=ad is the
    forest root domain. This allows us to simplify logic of finding
    the parent domain.
    For complex hierachical forests with more than two levels of
    sub-domains, this will still be true because of the forest trust:
    as forest trust is established to the forest root domain, any
    communication to any sub-domain must traverse forest root domain's
    domain controller.
    Note that SSSD also generated incorrectly CA paths information
    for forests with non-hierarchical tree-roots. In such cases
    IPA KDC got confused and mistakenly assumed direct trust to the
    non-hierarchical tree-root instead of going through the forest
    root domain. See for
    Reviewed-By: Martin Babinsky <>
file modified
+14 -13