RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

If there is a problem in the parsing of a group in IPA using the get_ipa_groupname() function, there is no information about what caused the problem is returned or emitted in the debugging log.  There are eight distinct failure modes; four of them cause the group to be silently ignored, while the other four cause the failure of all group parsing.

Version-Release number of selected component (if applicable):

How reproducible:

Always

1. Cause a replication failure, or any other problem that would cause ldb_dn_validate() to fail with an EINVAL.
2. Try to log in on a system with HBAC.

Actual results:

3. Service is denied.

Expected results:

3. Invalid records would be ignored, and any remaining rules that would allow users to be logged in are acted on.

Additional info:

I have a git commit that would emit more debugging information for the exit conditions in get_ipa_groupname().

changing component to sssd - get_ipa_groupname() is an sssd function

*** This bug has been marked as a duplicate of bug 1202245 ***