Bug 1243823
| Summary: | Request flood when a legacy user logs in | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Steeve Goveas <sgoveas> | ||||
| Component: | slapi-nis | Assignee: | Alexander Bokovoy <abokovoy> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7.1 | CC: | dpal, jhrozek, mvarun | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
Cause:
For Schema Compatibility plugin in IdM, when searching for groups by their member name, in the case there are no groups in cn=groups map that have certain memberUid as a member, we look at a possibility that this user might be coming from a trusted AD forest and was not queried via SSSD yet.
Consequence:
A logical flow causes infinite calls to SSSD.
Fix:
In case there is no '@' separator between user name and domain of the searched member user, consider such search as not valid for lookups in SSSD because all users from a trusted AD forest are always fully qualified.
Result:
No more infinite calls to SSSD when searching groups by a member name.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-11-19 13:23:28 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Steeve Goveas
2015-07-16 12:19:40 UTC
Created attachment 1052736 [details]
proposed patch
Proposed patch attached. The patch survives the testcase in the environment where original bug was found.
Verified.
Version
sssd-1.13.0-36.el7.x86_64
ipa-server-4.2.0-12.el7.x86_64
slapi-nis-0.54-5.el7.x86_64
Verified by running exising automation.
+-----------------------------------------------------------------------------------------+
Test:[/ipa-server/rhel72/ipa-trust-functional/root]: [ Pass(61/61): 100% ]
+-----------------------------------------------------------------------------------------+
:: [ PASS ] ipa-trust-functional startup: Initial setup
:: [ PASS ] ipa_trust_func_install_master: Install IPA Master
:: [ PASS ] ipa_trust_func_install_client1: Install 1st IPA Client
:: [ PASS ] ipa_trust_func_setup_master: Setup Trust From MASTER with AD1
:: [ PASS ] ipa_trust_func_legacy_prepare: Prepare master and legacy clients
:: [ PASS ] ipa_trust_func_install_legacy_client: Trust legacy client install
:: [ PASS ] ipa_trust_func_add_ad_users1: setting unum to timestamp
:: [ PASS ] ipa_trust_func_add_ad_users2: setting vars using unum
:: [ PASS ] ipa_trust_func_add_ad_users3: setup ad users for tests
:: [ PASS ] ipa_trust_func_ipauser_0001: Getent and id for ipa users/groups
:: [ PASS ] ipa_trust_func_ipauser_0002_setup: IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ipauser_0002: IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ipauser_0002_cleanup: IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ipauser_0003_setup: Disabled IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ipauser_0003: Disabled IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ipauser_0003_cleanup: Disabled IPA user login to legacy client
:: [ PASS ] ipa_trust_func_ssh_0003: AD user, password, lower domain
:: [ PASS ] ipa_trust_func_ssh_0011: AD user1 to AD user2, password
:: [ PASS ] ipa_trust_func_ssh_0012_setup: AD usernew, no password, added user
:: [ PASS ] ipa_trust_func_ssh_0012: AD usernew, password, added user, legacy client
:: [ PASS ] ipa_trust_func_ssh_0012_cleanup: AD usernew, no password, added user
:: [ PASS ] ipa_trust_func_ssh_0015: AD user, no password, run su cmd
:: [ PASS ] ipa_trust_func_ssh_0016: AD user, password, diff host
:: [ PASS ] ipa_trust_func_ssh_0024_setup: AD user, account is disabled
:: [ PASS ] ipa_trust_func_ssh_0024: AD user, account is disabled
:: [ PASS ] ipa_trust_func_ssh_0024_cleanup: AD user, account is disabled
:: [ PASS ] ipa_trust_func_ssh_sub_0003: AD user, password, lower domain
:: [ PASS ] ipa_trust_func_ssh_sub_0011: AD user1 to AD user2, password
:: [ PASS ] ipa_trust_func_ssh_sub_0012_setup: AD usernew, no password, added user
:: [ PASS ] ipa_trust_func_ssh_sub_0012: AD usernew, password, added user, legacy client
:: [ PASS ] ipa_trust_func_ssh_sub_0012_cleanup: AD usernew, no password, added user
:: [ PASS ] ipa_trust_func_ssh_sub_0015: AD user, no password, run su cmd
:: [ PASS ] ipa_trust_func_ssh_sub_0016: AD user, password, diff host
:: [ PASS ] ipa_trust_func_ssh_sub_0024_setup: AD user, account is disabled
:: [ PASS ] ipa_trust_func_ssh_sub_0024: AD user, account is disabled
:: [ PASS ] ipa_trust_func_ssh_sub_0024_cleanup: AD user, account is disabled
:: [ PASS ] ipa_trust_func_user_0009: su lower realm
:: [ PASS ] ipa_trust_func_user_0011: homedir access commands
:: [ PASS ] ipa_trust_func_user_0016: check child user in forest group
:: [ PASS ] ipa_trust_func_user_0018: user in multiple ad groups
:: [ PASS ] ipa_trust_func_user_sub_0009: su lower realm
:: [ PASS ] ipa_trust_func_user_sub_0011: homedir access commands
:: [ PASS ] ipa_trust_func_user_sub_0016: check child user in forest group
:: [ PASS ] ipa_trust_func_user_sub_0018: user in multiple ad groups
:: [ PASS ] ipa_trust_func_sudo_setup: setup for sudo tests
:: [ PASS ] ipa_trust_func_sudo_setup2: client side setup for sudo tests
:: [ PASS ] ipa_trust_func_ipasudo_0001_setup: allow ipauser to run cmd as root
:: [ PASS ] ipa_trust_func_ipasudo_0001: allow ipauser to run cmd as root
:: [ PASS ] ipa_trust_func_ipasudo_0001_cleanup: allow ipauser to run cmd as root
:: [ PASS ] ipa_trust_func_ipasudo_0002_setup: allow ipauser1 to run cmd as ipauser2
:: [ PASS ] ipa_trust_func_ipasudo_0002: allow ipauser1 to run cmd as ipauser2
:: [ PASS ] ipa_trust_func_ipasudo_0002_cleanup: allow ipauser1 to run cmd as ipauser2
:: [ PASS ] ipa_trust_func_ipasudo_0003_setup: deny ipauser to run cmd as root, via deny-command
:: [ PASS ] ipa_trust_func_ipasudo_0003: deny ipauser to run cmd as root, via deny-command
:: [ PASS ] ipa_trust_func_ipasudo_0003_cleanup: deny ipauser to run cmd as root, via deny-command
:: [ PASS ] ipa_trust_func_sudo_cleanup: cleanup after sudo tests
:: [ PASS ] ipa-trust-functional cleanup
:: [ PASS ] ipa_trust_func_add_ad_users1: setting unum to timestamp
:: [ PASS ] ipa_trust_func_add_ad_users2: setting vars using unum
:: [ PASS ] ipa_trust_func_remove_ad_users_cleanup: cleanup ad users created for tests
:: [ PASS ] /ipa-server/rhel72/ipa-trust-functional/root
+----------------------------------------------------------------------+
Fail / unfinished / ABORT [ Fail(0/61): 0% ]
+----------------------------------------------------------------------+
Document the issue. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2438.html |