diff options
| author | Jakub Hrozek <jhrozek@redhat.com> | 2015-07-21 11:44:03 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-07-31 10:19:52 +0200 |
| commit | 6fe057efb981ee4b45dcadf131c03f8501fce28d (patch) | |
| tree | 605a5da06ee5da238a8be51a508d89cbfadb6026 /README | |
| parent | 4b1a46396caf656095e5f5e90d43996bdeaba0f3 (diff) | |
| download | sssd-6fe057efb981ee4b45dcadf131c03f8501fce28d.tar.gz sssd-6fe057efb981ee4b45dcadf131c03f8501fce28d.tar.xz sssd-6fe057efb981ee4b45dcadf131c03f8501fce28d.zip | |
IPA: Remove MPG groups if getgrgid was called before getpw()
https://fedorahosted.org/sssd/ticket/2724
This bug only affects IPA clients that are connected to IPA servers with
AD trust and ID mapping in effect.
If an IPA client calls getgrgid() for an ID that matches a user, the
user's private group would be returned and stored as a group entry.
Subsequent queries for that user would fail, because MPG domains impose
uniqueness restriction for both the ID and name space across groups and
users.
To work around that, we remove the UPG groups in MPG domains during a
group lookup.
Reviewed-by: Sumit Bose <sbose@redhat.com>
Diffstat (limited to 'README')
0 files changed, 0 insertions, 0 deletions