Bug 1568083 - subdomain lookup fails when certmaprule contains DN
Summary: subdomain lookup fails when certmaprule contains DN
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.5
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: ipa-qe
Whiteboard: sync-to-jira
Depends On:
TreeView+ depends on / blocked
Reported: 2018-04-16 18:07 UTC by Scott Poore
Modified: 2020-09-29 19:49 UTC (History)
13 users (show)

Fixed In Version: sssd-1.16.5-2.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-09-29 19:49:11 UTC
Target Upstream Version:

Attachments (Terms of Use)
sssd logs (108.54 KB, application/x-gzip)
2018-04-16 18:19 UTC, Scott Poore
no flags Details

System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 4730 0 None closed subdomain lookup fails when certmaprule contains DN 2021-01-14 15:09:27 UTC
Red Hat Product Errata RHBA-2020:3904 0 None None None 2020-09-29 19:49:41 UTC

Description Scott Poore 2018-04-16 18:07:13 UTC
Description of problem:

I'm seeing AD Trust lookups fail when I have certmaprules using DNs for the rule names.

#  Start with a working AD Trust in IPA:

[root@rhel7-1 ~]# id aduser1@ad.test
uid=1627001114(aduser1@ad.test) gid=1627001114(aduser1@ad.test) groups=1627001114(aduser1@ad.test),1627000513(domain users@ad.test)

[root@rhel7-1 ~]# ipa certmaprule-add 'CN=adca,DC=ad,DC=test' --maprule='(userCertificate;binary={cert!bin})' --matchrule='<ISSUER>CN=adca,DC=ad,DC=test' --domain=ipa2.test
Added Certificate Identity Mapping Rule "CN=adca,DC=ad,DC=test"
  Rule name: CN=adca,DC=ad,DC=test
  Mapping rule: (userCertificate;binary={cert!bin})
  Matching rule: <ISSUER>CN=adca,DC=ad,DC=test
  Domain name: ipa2.test
  Enabled: TRUE

[root@rhel7-1 ~]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

[root@rhel7-1 ~]# id aduser1@ad.test
id: aduser1@ad.test: no such user

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.  Setup IPA Master with AD Trust
2.  Add certmaprule with name set to a DN matching AD
3.  reset SSSD and try a lookup

Actual results:

Expected results:

Additional info:

sssd_domain log entries seen

(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_certmap_add] (0x0040): ldb_add failed.
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [Invalid DN syntax]
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_certmap_add] (0x0400): Error: 14 (Bad address)
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sysdb_update_certmap] (0x0040): sysdb_certmap_add failed.
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_certmap_parse_results] (0x0040): sysdb_update_certmap failed(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_certmap_done] (0x0040): Unable to parse certmap results [14]: Bad address
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_refresh_certmap_done] (0x0020): Failed to read certificate mapping rules [14]: Bad address
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
(Mon Apr 16 13:01:49 2018) [sssd[be[ipa2.test]]] [ipa_subdomains_handler_done] (0x0020): Unable to refresh subdomains [14]: Bad address

Comment 2 Scott Poore 2018-04-16 18:19:22 UTC
Created attachment 1422669 [details]
sssd logs

Comment 3 Jakub Hrozek 2018-04-26 09:51:45 UTC
Upstream ticket:

Comment 4 Jakub Hrozek 2019-03-07 21:37:28 UTC
I'm sorry, but we will not have the capacity to address this bug in 7.7, given that the work has not started and the devel freeze is in about three weeks. Therefore I'm moving the bug to 7.8.

Please push back if you think this bug is important to be fixed in 7.7.

Comment 9 Pavel Březina 2020-04-03 09:27:24 UTC
* `master`
    * 27a3c0cf354bf2e85f50d7b4650d8a22120a5691 - sysdb: sanitize certmap rule name before using it in DN
    * 0003eda98b1db04bb3410af5f65d62e2426e426a - ipa: add missing new-line in debug message
* `sssd-1-16`
    * f68b4dae7faea871b925fd551aefd6c428200cc4 - sysdb: sanitize certmap rule name before using it in DN
    * e4f3cf65bfcb4190a9c057e247fd53b631667078 - ipa: add missing new-line in debug message

Comment 13 Sergio Oliveira Campos 2020-06-08 13:44:48 UTC
Test added in upstream

Comment 15 Michal Polovka 2020-06-15 11:27:43 UTC
Verified by running upstream test in downstream RHEL 7.9.

Comment 17 errata-xmlrpc 2020-09-29 19:49:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.