Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionKaushik Banerjee
2012-03-23 08:08:17 UTC
Description of problem:
ldap_user_authorized_host doesn't read non-default value
Version-Release number of selected component (if applicable):
sssd-1.8.0-17
How reproducible:
Always
Steps to Reproduce:
1. Add a user with attribute "gecos: host1.example.com":
dn: uid=kau10,ou=Users,dc=example,dc=com
objectClass: account
objectClass: posixAccount
cn: Kau10
uidNumber: 101010
gidNumber: 101010
homeDirectory: /home/kau10
loginShell: /bin/bash
userPassword:: U2VjcmV0MTIz
uid: kau10
gecos: host1.example.com
host: host1.example.com
2. Edit sssd.conf and add:
access_provider=ldap
ldap_access_order=host
ldap_user_authorized_host = gecos
3. Restart sssd with clear cache.
4. Login as the user.
Actual results:
Login fails.
Following messages are seen in the log:
[sdap_get_map] (0x0200): Option ldap_user_authorized_host has value gecos
[sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [user]
[sdap_access_host_send] (0x0020): Missing hosts. Access denied
Expected results:
sssd should get the hostname from gecos attribute of the user and allow login.
Additional info:
Login is successful after I set "ldap_user_authorized_host = host" in sssd.conf.
This issue can be reproduced only when I set "ldap_user_authorized_host =
gecos".
I added added another ldap attribute "description: host1.example.com" to
the user and the issue is no longer seen when I set
"ldap_user_authorized_host = description".
Also, I tried with "ldap_user_gecos = description" and
"ldap_user_authorized_host = gecos" and it works fine in this case.
This is the case because you have used gecos for *both* user's gecos and the authorizedHost attribute. In this case, the first match (which is user's gecos) wins.
As you noted, everything works fine if you also mapped the ldap_user_gecos attribute onto something else.
I don't think this is a bug.
Comment 4Stephen Gallagher
2012-03-26 17:26:52 UTC
(In reply to comment #3)
> This is the case because you have used gecos for *both* user's gecos and the
> authorizedHost attribute. In this case, the first match (which is user's gecos)
> wins.
>
> As you noted, everything works fine if you also mapped the ldap_user_gecos
> attribute onto something else.
>
> I don't think this is a bug.
It is a bug. We're supposed to be explicitly handling the possibility of having the same attribute address act as more than one option. This was added so we could support using "cn" for multiple options (specifically).
Comment 5Stephen Gallagher
2012-03-28 12:17:06 UTC