freeipa

#9245 `extdom` plugin can return object from a wrong domain.
Closed: fixed by frenaud. Opened by atikhonov.

Closed: fixed
Reopen Issue

Issue

extdom plugin can return object from a wrong domain.

Steps to Reproduce

  1. At IPA server with trust to AD: configure SSSD to handle multiple domains (for example: IPA/AD + 'local files'; note, that on some distributions 'local files' domain is configured implicitly).
  2. At IPA client: lookup by id an object that can only be found in 'local files' at server.

Actual behavior

Search returns an object, pretending this object was found in trusted AD domain (while object was actually found in 'local files' at server):

getent group 48
apache@win19-mdaq.test:*:48:

Expected behavior

This lookup doesn't yield anything.

Version/Release/Distribution

Seen on ipa-4.9, but most probably all supported versions are affected.

Additional info:

The issue is that pack_ber_user()/pack_ber_group() skip domain verification if found object isn't FQDN.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2117167

PR: https://github.com/freeipa/freeipa/pull/6468

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2117167

Issue linked to bug 2117167

master:

  • f0c26fe0946a6ff4382235c9caf723777d3b9699 extdom: internal functions should be static
  • b381acb3d0576f26343ac7a2aad3284b7dec2dfb extdom: make sure result doesn't miss domain part
  • 147123e6b9fcbb570608651d248945c93f81fc01 extdom: avoid sss_nss_getorigby() calls when get_r_wrapper() returns object from a wrong domain (performance optimization)

ipa-4-10:

  • 113cb8d715cf7bed8bcc36845940acc20fed8e60 extdom: internal functions should be static
  • 4685f9d881c09fa317cb68fba1b94c29e48a7a8b extdom: make sure result doesn't miss domain part
  • 1360c8b09f0862fe961fbb015f55d6b3cbd9aee9 extdom: avoid sss_nss_getorigby() calls when get_r_wrapper() returns object from a wrong domain (performance optimization)

ipa-4-9:

  • 666357649f4dfb8254cb3707e97e12c69e6714f7 extdom: internal functions should be static
  • 3de618f75416afd6c087c243fe35755739d229a4 extdom: make sure result doesn't miss domain part
  • a07cece0c006b3a89fc467284244f979d39f0209 extdom: avoid sss_nss_getorigby() calls when get_r_wrapper() returns object from a wrong domain (performance optimization)

ipa-4-6:

  • f943bbd4317149b98befc3517b05020f6ede4c33 extdom: internal functions should be static
  • 326b1df419f6c4e35077ffeaefbd42e10dda4560 extdom: make sure result doesn't miss domain part
  • e3b0398bf1acb202acdd39861fa33b6e8a47bd62 extdom: avoid sss_nss_getorigby() calls when get_r_wrapper() returns object from a wrong domain (performance optimization)

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.