SSSD / sssd

#284 proxy ldap with use_fully_qualified_names = TRUE does not return FQN if -s sss not specified
Closed: Invalid Opened by jgalipea.

Closed: Invalid
Reopen Issue

Description
With a proxy LDAP domain configured with use fully qualified names set to true, if -s not specified with getent, the users are returned non fully qualified.[[BR]]

sssd.conf tested[[BR]]

[sssd]
config_file_version = 2
domains = LDAP
sbus_timeout = 30
services = nss, pam
[nss]
entry_cache_timeout = 30
entry_negative_timeout  = 1
enum_cache_timeout = 30
filter_groups = root
filter_users = root
[pam]
[domain/LDAP]
auth_provider = proxy
cache_credentials = TRUE
enumerate = TRUE
id_provider = proxy
min_id = 1000
proxy_lib_name = ldap
proxy_pam_target = sssdproxyldap
use_fully_qualified_names = TRUE

Results[[BR]]

[root@sssd-rhel564 ~]# getent passwd puser1@LDAP
puser1:x:1001:1001::/export/puser1:
[root@sssd-rhel564 ~]# getent -s sss passwd puser1@LDAP
puser1@LDAP:x:1001:1001::/export/puser1:
[jgalipea@jgalipea ~]$ ssh root@jennyv1.bos.redhat.com

Unable to readily reproduce. Closing bug. If it happens again, we can reopen.

resolution: => worksforme
status: new => closed

Sorry ... davido just reproduced too. Looks like a cache issue, being revealed by switching configuration settings.

resolution: worksforme =>
status: closed => reopened

I could reproduce this just by changing the use_fully_qualified_names attribute in /etc/sssd/sssd.conf in the IPA domain section. In this particular example I changed it from commented out to use_fully_qualified_names = true. Correct output is returned if you re-run the getent query.

Console output as follows:

[root@alice ~]# cat /etc/sssd/sssd.conf | grep fully
use_fully_qualified_names = false
;use_fully_qualified_names = true
[root@alice ~]# getent passwd ipauser01
ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
[root@alice ~]# vi /etc/sssd/sssd.conf
[root@alice ~]# service sssd restart
Stopping sssd: [ OK ]
Starting sssd: [ OK ]
[root@alice ~]# getent passwd ipauser01@IPA
[root@alice ~]# getent passwd -s sss ipauser01@IPA
ipauser01@IPA:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
[root@alice ~]# getent passwd ipauser01@IPA
ipauser01@IPA:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
[root@alice ~]#

Ok before re-opening ping me with a solid reproduceable case :-)

milestone: NEEDS_TRIAGE =>
resolution: => worksforme
status: reopened => closed

I can not automate a test without knowing the exact way to reproduce. So, if we figure it out - I will then add a test for regression.

tests: 1 => 0

Fields changed

rhbz: => 0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1326

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
defect
SSSD
master
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.