Bug 785908 - ldap_*_search_base doesn't fully limit the group / netgroup search base correctly
Summary: ldap_*_search_base doesn't fully limit the group / netgroup search base corre...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Stephen Gallagher
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-01-30 21:06 UTC by Stephen Gallagher
Modified: 2020-05-02 16:23 UTC (History)
4 users (show)

Fixed In Version: sssd-1.8.0-2.el6.beta2
Doc Type: Bug Fix
Doc Text:
No documentation required
Clone Of:
Environment:
Last Closed: 2012-06-20 11:54:45 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 2002 0 None None None 2020-05-02 16:23:51 UTC
Red Hat Product Errata RHBA-2012:0747 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2012-06-19 19:31:43 UTC

Description Stephen Gallagher 2012-01-30 21:06:01 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/960

A group within the ldap_group_search_base can contain a member group which is outside this search base.  When SSSD then pulls down the members of that parent group it should *not* expand the group outside of the group search base.  Currently this appears to get resolved, meaning groups from outside of the group search base are expanded.

Comment 2 Amith 2012-04-27 00:13:15 UTC
Verified on sssd-1.8.0-22.el6.x86_64.
The beaker script is available at: ​https://svn.devel.redhat.com//repos/SSSDtetframework/branches/sssd-RHEL6.3/Functional/Tests-for-LDAP-ID-and-LDAP-AUTH/bugzilla-automation.sh
The output of the beaker automation script is given below:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Verify BZ release ticket #341 :- ldap_*_search_base dosen't fully limit the group search base
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running '/usr/bin/getent group'
:: [   PASS   ] :: Running '/usr/bin/getent group > /tmp/grp_file'
:: [   PASS   ] :: File '/tmp/grp_file' should contain 'Group111'
:: [   PASS   ] :: File '/tmp/grp_file' should contain 'Group22'
:: [   LOG    ] :: Duration: 30s
:: [   LOG    ] :: Assertions: 16 good, 0 bad
:: [   PASS   ] :: RESULT: Verify BZ release ticket #341 :- ldap_*_search_base dosen't fully limit the group search base

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Verify BZ release ticket #341 :- ldap_*_search_base dosen't fully limit the Netgroup search base
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running '/usr/bin/getent netgroup Seceng'
:: [   PASS   ] :: Running '/usr/bin/getent netgroup Seceng > /tmp/grp_file'
:: [   PASS   ] :: File '/tmp/grp_file' should contain '(h1, QEuser, example.com)'
:: [   PASS   ] :: File '/tmp/grp_file' should not contain '(h3, Coreuser, example.com)'
:: [   LOG    ] :: Duration: 32s
:: [   LOG    ] :: Assertions: 11 good, 0 bad
:: [   PASS   ] :: RESULT: Verify BZ release ticket #341 :- ldap_*_search_base dosen't fully limit the Netgroup search base

Comment 3 Stephen Gallagher 2012-06-12 13:34:09 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation required

Comment 5 errata-xmlrpc 2012-06-20 11:54:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0747.html


Note You need to log in before you can comment on or make changes to this bug.