SSSD / sssd

#2172 Enabling ldap_id_mapping doesn't exclude uidNumber in filter
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1037653

Description of problem:
Enabling ldap_id_mapping doesn't exclude uidNumber in filter
Version-Release number of selected component (if applicable):
1.11.2-10
How reproducible:
Always
Steps to Reproduce:
1. sssd.conf domain section:
[domain/ADTEST]
debug_level = 0xFFF0
id_provider = ldap
ldap_uri = ldap://<ad server>
ldap_id_mapping = true
ldap_schema = ad
ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
ldap_default_authtok = XXXXX
2. Lookup an AD user
Actual results:
User lookup fails. Domain log shows:
(Tue Dec  3 16:19:08 2013) [sssd[be[ADTEST]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccou
ntName=user1_dom1)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumb
er=0))))][DC=example,DC=com]
Expected results:
User lookup should work
Additional info:

Fields changed

blockedby: =>
blocking: =>
changelog: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
milestone: NEEDS_TRIAGE => SSSD 1.11.3
review: True => 0
selected: =>
testsupdated: => 0

Fields changed

owner: somebody => lslebodn
status: new => assigned

Fields changed

patch: 0 => 1

Moving tickets that didn't make 1.11.3 to 1.11.4

milestone: SSSD 1.11.3 => SSSD 1.11.4

Fields changed

priority: major => critical
  • master:
    • cdcca90249aadb72bf2978a63c202c5b68642224
    • 1e4a582e29c119e2c0e58a02dcb41b829e6b5e39
    • 16b27fcceebcbbaeefaf5b9bdf2dec3065adba4a
  • sssd-1-11:
    • 0a33b13e2125de2be64ba2add63021abfc973492
    • 507c0d939b7882e5708ac2c7589f67be2af89892
    • 2e5645a2b50a9cfa96ec68f3b01fe33bb270cfa1

resolution: => fixed
status: assigned => closed

Two additional fixes landed upstream:
- master:
- 21e7b7d99a85b895f99e45d176524033cd40618c
- 8c41a21bc98eec99a16258c7b4d79f456d85f856
- sssd-1-11:
- cb0f731edf9f2d80f4b6f6429a2065fe03ea7872
- 5a3c166f6622ffb537d86a5954b29f9c70cabe22

Fields changed

changelog: => The fix makes it possible to use id_provider=ldap along with id_mapping without specifying the domain SID manually.

Metadata Update from @jhrozek:
- Issue assigned to lslebodn
- Issue set to the milestone: SSSD 1.11.4

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3214

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Low
defect
SSSD
None
0
1
https://bugzilla.redhat.com/show_bug.cgi?id=1037653
None
0
0
The fix makes it possible to use `id_provider=ldap` along with id_mapping without specifying the domain SID manually.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.