IPA: warn if full_name_format is customized in server mode

https://fedorahosted.org/sssd/ticket/2009

If the IPA server mode is on and the SSSD is running on the IPA server,
then the server's extdom plugin calls getpwnam_r to read info about trusted
users from the AD server and return them to the clients that called the
extended operation.

The SSSD returns the subdomain users fully-qualified, ie "user@domain"
by default. The format of the fully qualified name is configurable.

However, the extdom plugin returns the user name without the domain
component.

With this patch, when ipa_server_mode is on, warn if the full_name_format
is set to a non-default value. That would prompt the admin to change the
format if he changed it to something exotic.

3 files changed, 20 insertions, 1 deletions

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 01eade2b5..3e88b78f3 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -71,6 +71,8 @@
 /* Both monitor and domains */
 #define CONFDB_NAME_REGEX   "re_expression"
 #define CONFDB_FULL_NAME_FORMAT "full_name_format"
+#define CONFDB_DEFAULT_FULL_NAME_FORMAT "%1$s@%2$s%3$s"
+#define CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD "%1$s@%2$s"
 
 /* Responders */
 #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout"
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 7910e2466..a09f07ac9 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1118,6 +1118,23 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
         return EOK;
     }
 
+    /* The IPA code relies on the default FQDN format to unparse user
+     * names. Warn loudly if the full_name_format was customized on the
+     * IPA server
+     */
+    if ((strcmp(be_ctx->domain->names->fq_fmt,
+               CONFDB_DEFAULT_FULL_NAME_FORMAT) != 0)
+            && (strcmp(be_ctx->domain->names->fq_fmt,
+                       CONFDB_DEFAULT_FULL_NAME_FORMAT_OLD) != 0)) {
+        DEBUG(SSSDBG_FATAL_FAILURE, ("%s is set to a non-default value [%s] " \
+              "lookups of subdomain users will likely fail!\n",
+              CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt));
+        sss_log(SSS_LOG_ERR, "%s is set to a non-default value [%s] " \
+                "lookups of subdomain users will likely fail!\n",
+                CONFDB_FULL_NAME_FORMAT, be_ctx->domain->names->fq_fmt);
+        /* Attempt to continue */
+    }
+
     realm = dp_opt_get_string(id_ctx->ipa_options->basic, IPA_KRB5_REALM);
     if (realm == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm for IPA?\n"));
diff --git a/src/util/usertools.c b/src/util/usertools.c
index dc863ce82..7ec14b351 100644
--- a/src/util/usertools.c
+++ b/src/util/usertools.c
@@ -306,7 +306,7 @@ int sss_names_init(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb,
     }
 
     if (!fq_fmt) {
-        fq_fmt = talloc_strdup(tmpctx, "%1$s@%2$s");
+        fq_fmt = talloc_strdup(tmpctx, CONFDB_DEFAULT_FULL_NAME_FORMAT);
         if (!fq_fmt) {
             ret = ENOMEM;
             goto done;