Bug 1445445

Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3385

* master: 92d8b072f8c521e1b4effe109b5caedabd36ed6f

Moving this one back to assigned because, there are problems with lookups to multiple domains.  I'm also marking this one as depends on bug #1449726.

Results:

Testing just with base level dbus-send shows only the IPA user when running on an IPA Client.  When run from an IPA Server with an AD Trust it does show both IPA and AD Users configured with the cert (or certmapdata).


Search from IPA Server:

[root@auto-hv-02-guest08 testing]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat /root/testing/demosc1_cert1.crt)" uint32:10
method return sender=:1.1114 -> dest=:1.1118 reply_serial=2
   array [
      object path "/org/freedesktop/sssd/infopipe/Users/testrelm_2etest/576400131"
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401105"
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401106"
   ]


Search from IPA Client:

[root@auto-hv-02-guest03 testing]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat /root/testing/demosc1_cert1.crt)" uint32:10
method return sender=:1.36 -> dest=:1.37 reply_serial=2
   array [
      object path "/org/freedesktop/sssd/infopipe/Users/testrelm_2etest/576400131"
   ]


When I remove the certificate from the IPA server and rerun the search, I can then see the AD Users configured with the cert:

[root@auto-hv-02-guest08 ~]# ipa user-mod demosc1 --certificate=''
-----------------------
Modified user "demosc1"
-----------------------
  User login: demosc1
  First name: demosc
  Last name: demosc1
  Home directory: /home/demosc1
  Login shell: /bin/sh
  Principal name: demosc1
  Principal alias: demosc1
  Email address: demosc1
  UID: 576400131
  GID: 576400131
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True


Search from IPA Client again after cert removed from IPA user:

[root@auto-hv-02-guest03 ~]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat /root/testing/demosc1_cert1.crt)" uint32:10 ; date
method return sender=:1.68 -> dest=:1.72 reply_serial=2
   array [
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401105"
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401106"
   ]
Wed May 17 12:56:48 EDT 2017

# ^^^ Note there was a delay in getting expected returns but, we're looking into that issue separately.

Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3405

(In reply to Sumit Bose from comment #8)
> Upstream ticket:
> https://pagure.io/SSSD/sssd/issue/3405

This upstream ticket fixes the delay of about 1 minute which was seen in some tests.

Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3407

(In reply to Sumit Bose from comment #10)
> Upstream ticket:
> https://pagure.io/SSSD/sssd/issue/3407

This upstream ticket should fix the actual lookup failure.

Ticket 3407 was fixed with commit eb7095099b2dd0afb1d028dbc15d8c5a897d90f8

Should this be moved to ON_QA if the fixed in version is updated?  Is this ready for me to test?

(In reply to Scott Poore from comment #13)
> Should this be moved to ON_QA if the fixed in version is updated?  Is this
> ready for me to test?

I would prefer to only move the BZ to ON_QA when all three related upstream tickets are fixed. So far we still need to fix #3405.

That said, at least according to comment #11, since upstream #3407 is fixed, it would worth be retesting to see if you at least see an improvement.

Additional fixes from Ticket 3407:

master:
* eb404bcdbbff7e080a93d816e17b8cec04f79fc4
* 3e3034199b44e01899ec7ba8152fef3738a0e093

Fixes for ticket 3405

master:
* 29ee3e0945f8935a2eb01913ba00b540e0a94f01

Verified.

Version ::

sssd-1.15.2-43.el7.x86_64

Results ::

# On Server:

[root@auto-hv-02-guest08 testing]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat /root/testing/demosc1.crt)" uint32:10
method return sender=:1.706 -> dest=:1.707 reply_serial=2
   array [
      object path "/org/freedesktop/sssd/infopipe/Users/testrelm_2etest/1505600004"
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401105"
   ]


# On Client:

[root@dhcp129-184 testing]# ipa certmaprule-find
-------------------------------------------
1 Certificate Identity Mapping Rule matched
-------------------------------------------
  Rule name: testrealm_and_ipaadcs12r2
  Mapping rule: (|(userCertificate;binary={cert!bin})(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500}))
  Matching rule: <ISSUER>CN=Certificate Authority,O=TESTRELM.TEST
  Domain name: testrelm.test, ipaadcs12r2.test
  Enabled: TRUE
----------------------------
Number of entries returned 1
----------------------------


[root@dhcp129-184 testing]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat /root/testing/demosc1.crt)" uint32:10
method return sender=:1.1269 -> dest=:1.1272 reply_serial=2
   array [
      object path "/org/freedesktop/sssd/infopipe/Users/testrelm_2etest/1505600004"
      object path "/org/freedesktop/sssd/infopipe/Users/ipaadcs12r2_2etest/1664401105"
   ]


[root@dhcp129-184 testing]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

[root@dhcp129-184 testing]# ipa certmap-match /root/testing/demosc1.crt
---------------
2 users matched
---------------
  Domain: TESTRELM.TEST
  User logins: demosc1

  Domain: ipaadcs12r2.test
  User logins: tempuser1
----------------------------
Number of entries returned 2
----------------------------

[root@dhcp129-184 testing]# su - demosc3 -c "su - demosc1 -c whoami"
PIN for demosc1 (OpenSC Card)
demosc1

[root@dhcp129-184 testing]# su - demosc3 -c "su - tempuser1 -c whoami"
PIN for demosc1 (OpenSC Card)
tempuser1

[root@dhcp129-184 testing]# su - demosc3 -c "su - tempuser2 -c whoami"
Password: 
su: Authentication failure

^^ Last test is expected to fail because the cert is not assigned or mapped for that user.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:2294