Bug 1746951

Summary: ipa-extdom-extop plugin doesn't allow @ in group name
Product: Red Hat Enterprise Linux 8 Reporter: Tomas Halman <thalman>
Component: ipaAssignee: Tomas Halman <thalman>
Status: CLOSED ERRATA QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.0CC: amore, ddas, fcami, frenaud, ksiddiqu, mkosek, pasik, pcech, rcritten, tscherf, twoerner
Target Milestone: rcKeywords: TestCaseProvided
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-28 15:43:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1383520    

Description Tomas Halman 2019-08-29 14:55:41 UTC
Description of problem:

The ipa-extdom-extop plugin has just one method for resolving group names and user name '@' character is used for detecting user principal name which may have alternative suffixes.

Username (the short part before @) can't contain '@' but group name can. This shared logic doesn't work for groups like my@group.

Protocol for SSSD<->ipa-extdom-extop communication protocol has to be extended to add separated calls for user and group resolution.

This change will also improve the response time in groupname resolution because the original call tries resolve the name as username and when it fails it tries to resolve it as groupname.

Comment 12 anuja 2020-02-20 09:17:51 UTC
Test verified using existing automation: test_integration/test_sssd.py::TestSSSDWithAdTrust::test_extdom_group
Using version: 
ipa-server-4.8.4-6.module+el8.2.0+5773+68ace8c5.x86_64
ipa-client-4.8.4-6.module+el8.2.0+5774+71f22ff9.x86_64

Test log:
===================================================== test session starts =====================================================
platform linux -- Python 3.6.8, pytest-3.4.2, py-1.5.3, pluggy-0.6.0 -- /usr/libexec/platform-python
cachedir: .pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-179.el8.x86_64-x86_64-with-redhat-8.2-Ootpa', 'Packages': {'pytest': '3.4.2', 'py': '1.5.3', 'pluggy': '0.6.0'}, 'Plugins': {'metadata': '1.8.0', 'html': '1.22.1', 'sourceorder': '0.5', 'multihost': '3.0'}}
rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile:
plugins: metadata-1.8.0, html-1.22.1, sourceorder-0.5, multihost-3.0
collected 10 items                                                                                                            

test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_disabled_by_default[ipa] PASSED                     [ 10%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_disabled_by_default[ad] PASSED                      [ 20%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_disabled_with_value_0[ipa] PASSED                   [ 30%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_disabled_with_value_0[ad] PASSED                    [ 40%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_enabled_when_configured[ipa] PASSED                 [ 50%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_auth_cache_enabled_when_configured[ad] PASSED                  [ 60%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_is_user_filtered[ad] PASSED                                    [ 70%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_is_user_filtered[fakeuser] PASSED                              [ 80%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_extdom_group PASSED                                            [ 90%]
test_integration/test_sssd.py::TestSSSDWithAdTrust::test_external_group_paging PASSED                                   [100%]

--------------------------- generated xml file: /usr/lib/python3.6/site-packages/ipatests/junit.xml ---------------------------
================================================ 10 passed in 1024.88 seconds =================================================
[root@runner ipatests]# 

Based on this marking bz as verified.

Comment 18 errata-xmlrpc 2020-04-28 15:43:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:1640