Bug 1827729

Summary: subdomain lookup fails when certmaprule contains DN
Product: Red Hat Enterprise Linux 8 Reporter: Alexey Tikhonov <atikhono>
Component: sssdAssignee: Sumit Bose <sbose>
Status: CLOSED ERRATA QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.2CC: grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, spoore, thalman, tscherf
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: sync-to-jira
Fixed In Version: sssd-2.3.0-1.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 02:05:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Alexey Tikhonov 2020-04-24 16:18:49 UTC 
This bug was initially created as a copy of Bug #1568083

I am copying this bug because: to track fix for RHEL8



Description of problem:

I'm seeing AD Trust lookups fail when I have certmaprules using DNs for the rule names.

#  Start with a working AD Trust in IPA:

[root@rhel7-1 ~]# id aduser1
uid=1627001114(aduser1) gid=1627001114(aduser1) groups=1627001114(aduser1),1627000513(domain users)

[root@rhel7-1 ~]# ipa certmaprule-add 'CN=adca,DC=ad,DC=test' --maprule='(userCertificate;binary={cert!bin})' --matchrule='<ISSUER>CN=adca,DC=ad,DC=test' --domain=ipa2.test
---------------------------------------------------------------
Added Certificate Identity Mapping Rule "CN=adca,DC=ad,DC=test"
---------------------------------------------------------------
  Rule name: CN=adca,DC=ad,DC=test
  Mapping rule: (userCertificate;binary={cert!bin})
  Matching rule: <ISSUER>CN=adca,DC=ad,DC=test
  Domain name: ipa2.test
  Enabled: TRUE

[root@rhel7-1 ~]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

[root@rhel7-1 ~]# id aduser1
id: aduser1: no such user


Version-Release number of selected component (if applicable):
sssd-1.16.0-19.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1.  Setup IPA Master with AD Trust
2.  Add certmaprule with name set to a DN matching AD
3.  reset SSSD and try a lookup

Actual results:
fails

Expected results:
works

Additional info:

sssd_domain log entries seen

(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_certmap_add] (0x0040): ldb_add failed.
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [Invalid DN syntax]
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_certmap_add] (0x0400): Error: 14 (Bad address)
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_update_certmap] (0x0040): sysdb_certmap_add failed.
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_certmap_parse_results] (0x0040): sysdb_update_certmap failed(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_certmap_done] (0x0040): Unable to parse certmap results [14]: Bad address
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_refresh_certmap_done] (0x0020): Failed to read certificate mapping rules [14]: Bad address
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_handler_done] (0x0020): Unable to refresh subdomains [14]: Bad address
Comment 1 Alexey Tikhonov 2020-04-24 16:21:57 UTC 
* `master`
    * 27a3c0cf354bf2e85f50d7b4650d8a22120a5691 - sysdb: sanitize certmap rule name before using it in DN
    * 0003eda98b1db04bb3410af5f65d62e2426e426a - ipa: add missing new-line in debug message
Comment 4 Scott Poore 2020-08-19 20:25:25 UTC 
Manual Verification:

Version ::

sssd-2.3.0-7.el8.x86_64

Results ::

[root@rhel8-7 ipatests]# id testuser
uid=1627001135(testuser) gid=1627001135(testuser) groups=1627001135(testuser),1627000513(domain users)

[root@rhel8-7 ipatests]# ipa certmaprule-add 'CN=adca,DC=ad,DC=test' --maprule='(userCertificate;binary={cert!bin})' --matchrule='<ISSUER>CN=adca,DC=ad,DC=test' --domain=smartcard.test
---------------------------------------------------------------
Added Certificate Identity Mapping Rule "CN=adca,DC=ad,DC=test"
---------------------------------------------------------------
  Rule name: CN=adca,DC=ad,DC=test
  Mapping rule: (userCertificate;binary={cert!bin})
  Matching rule: <ISSUER>CN=adca,DC=ad,DC=test
  Domain name: smartcard.test
  Enabled: TRUE

[root@rhel8-7 ipatests]# id testuser
uid=1627001135(testuser) gid=1627001135(testuser) groups=1627001135(testuser),1627000513(domain users)

[root@rhel8-7 ipatests]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

[root@rhel8-7 ipatests]# id testuser
uid=1627001135(testuser) gid=1627001135(testuser) groups=1627001135(testuser),1627000513(domain users)
Comment 7 errata-xmlrpc 2020-11-04 02:05:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4569