Bug 1525511

Summary: Fix idmap_rid dependency on trusted domain list
Product: Red Hat Enterprise Linux 7 Reporter: Andreas Schneider <asn>
Component: sambaAssignee: Andreas Schneider <asn>
Status: CLOSED ERRATA QA Contact: Robin Hack <rhack>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.5CC: asn, gdeschner, jarrpa, mpanaous, rhack
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 07:59:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andreas Schneider 2017-12-13 13:08:32 UTC 
Description of problem:
In the xid to SID mapping function idmap_rid uses the trusted domain list to get the SID for the mapping domain.

But the idmap child may lack trusted domains in the case when before trusted domains enumeration finished a winbindd idmapping request came in that triggered the idmap child fork.

When it forks, the idmap child inherits the trusted domain list of the parent which is not yet complete. Even after the parent finishes trusted domain enumeration, xid2sid idmapping requets will continue to fail, so a transient error becomes a permanent one.

A successful authentication otoh will prime the idmap caches, so xid2sid will work as long as the cache remains valid. But obviously after flushing the cache or just cache expiration the idmapping will fail again.

The fix is to pass the domain sid as an additional argument to the idmap xid2sid mapping functions. To get the sid, we call lsalookupnames on the domain name of all domains in the mapping request


QA: We don't have a test for this. Would probably need testing with two domain forests and a child domain in one of the forests. So when we auth from a user from the child domain idmap_rid might fail because the idmap child doesn't know about it.

SanityOnly?
Comment 1 Andreas Schneider 2018-04-03 12:08:08 UTC 
*** Bug 1491716 has been marked as a duplicate of this bug. ***
Comment 5 errata-xmlrpc 2018-10-30 07:59:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:3056