SSSD / sssd

#2421 Dereference code errors out when dereferencing entries protected by ACIs
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

The dereference code currently fails completely when processing initgroups of an IPA user who is a member of some Role or linked to a Permission against a new (4.0) IPA server.

This is because in 4.0, IPA switched to a different permission model that no longer allows the host principal to read the rbac and pbac containers. The current dereference code errors out when it can't read even the objectclass of an entry.

This bug could be also triggered outside IPA, just by restricting the ACI on the linked entry.

Fields changed

owner: somebody => jhrozek
status: new => assigned

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1135432

rhbz: => [https://bugzilla.redhat.com/show_bug.cgi?id=1135432 1135432]

Fields changed

patch: 0 => 1

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.11.7

master:
- 2284e50c801a53541016eb9a5af00d1250d36afb
- 0321da68a393943797ea8cb9eb5e9672431ff8f4
sssd-1-11:
- ffe42e0158df6e4b2aad91e9a0cd75aff05be8c4

resolution: => fixed
status: assigned => closed

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue set to the milestone: SSSD 1.11.7

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3463

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
0
1
defect
SSSD
1.12.0
https://bugzilla.redhat.com/show_bug.cgi?id=1135432
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.