Bug 751314 - SSSD does not sanitize broken memberUID correctly
Summary: SSSD does not sanitize broken memberUID correctly
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Stephen Gallagher
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-04 10:03 UTC by Jakub Hrozek
Modified: 2011-11-14 18:31 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
When a group contains certain incorrect multi-valued memberUID values, SSSD fails to sanitize the values properly. The memberUID value should only contain one username. As a result, SSSD creates incorrect users, using the broken memberUID values as their usernames. This, for example, causes problems during cache indexing.
Clone Of:
Environment:
Last Closed: 2011-11-14 18:31:06 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Jakub Hrozek 2011-11-04 10:03:26 UTC
Description of problem:
When a group contains certain incorrect multivalued memberUID values, SSSD fails to sanitize the value properly. The memberUID value should contain one username, so SSSD creates fake users using the broken memberUID as their username. This causes problems during cache indexing, for example.

Version-Release number of selected component (if applicable):
sssd-1.5.1-66

How reproducible:
always

Steps to Reproduce:
1. Create a group similar to this one:

dn: badmemberuid,ou=Groups,dc=example,dc=com
memberUid: userone,usertwo,userthree
gidNumber: 5418
cn: badmemberuid
objectClass: posixGroup
objectClass: top

2. getent group badmemberuid
3. ldbsearch -H /var/lib/sss/db/cache_example.com.ldb

Actual results:
The commas are not treated as special characters.

Expected results:
The commas are escaped with a '\' to sanitize them.

The DN should be sanitized and upgrades (which index the cache) should perform fine.

Comment 1 Jakub Hrozek 2011-11-04 10:05:45 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1079

Comment 3 Jakub Hrozek 2011-11-04 10:20:32 UTC
Too late for 6.2. We agreed to document this issue in release notes.


Note You need to log in before you can comment on or make changes to this bug.