-
Notifications
You must be signed in to change notification settings - Fork 270
[autobackport: sssd-2-9] cache_req: use sysdb_search_user_by_upn_with_view_res() #8323
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: sssd-2-9
Are you sure you want to change the base?
[autobackport: sssd-2-9] cache_req: use sysdb_search_user_by_upn_with_view_res() #8323
Conversation
The new call will apply overrides to a user object which was searched by UPN or email address before returning it. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 794e80f)
To make sure any overrides are applied to the user even when searched by UPN or email address sysdb_search_user_by_upn_with_view_res() is now used in the cache request code. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 43f22b9)
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit fe61b85)
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 6d8f9d7)
Add a system test to verify that IPA ID view overrides are correctly applied when looking up a user by email address. The test creates a user with an email, applies ID view overrides (login, uid, gid, home), and verifies that the overridden values are returned when looking up the user by: - original name - overridden name - email address Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com> Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 6413f60)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request backports the usage of sysdb_search_user_by_upn_with_view_res to ensure user overrides are applied when searching by UPN or email. The changes involve refactoring to use this new function and removing the old sysdb_getpwupn. The accompanying tests for both IPA ID views and local overrides are well-structured and correctly validate the new functionality. However, I've found a critical issue in the implementation of the new function sysdb_search_user_by_upn_with_view_res that could lead to incorrect lookup failures.
| } | ||
|
|
||
| *out_res = orig_obj; | ||
| return ret; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The function may incorrectly return ENOENT if sysdb_add_overrides_to_object returns it, which happens when no override is found for a user. This would signal to the caller that the user was not found, even though the original user object was successfully retrieved. The function should return EOK if the user is found, regardless of whether overrides exist.
return EOK;
This is an automatic backport of PR#7998 cache_req: use sysdb_search_user_by_upn_with_view_res() to branch sssd-2-9, created by @sumit-bose.
Caution
@sumit-bose The patches did not apply cleanly. It is necessary to resolve conflicts before merging this pull request. Commits that introduced conflict are marked with
CONFLICT!.You can push changes to this pull request
Original commits
794e80f - sysdb: add sysdb_search_user_by_upn_with_view_res()
43f22b9 - cache_req: use sysdb_search_user_by_upn_with_view_res()
fe61b85 - sysdb:: remove sysdb_getpwupn()
6d8f9d7 - tests: lookup user with overrides with email
6413f60 - tests: add IPA ID view test for user lookup by email
Backported commits
Conflicting Files Information (check for deleted and re-added files)
Original Pull Request Body
To make sure any overrides are applied to the user even when searched by
UPN or email address sysdb_search_user_by_upn_with_view_res() is now used
in the cache request code.