Bug 806209 - ldap_user_authorized_host = gecos doesn't work
ldap_user_authorized_host = gecos doesn't work
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: SSSD Maintainers
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-23 04:08 EDT by Kaushik Banerjee
Modified: 2016-01-07 08:01 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-07 08:01:17 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kaushik Banerjee 2012-03-23 04:08:17 EDT
Description of problem:
ldap_user_authorized_host doesn't read non-default value

Version-Release number of selected component (if applicable):
sssd-1.8.0-17

How reproducible:
Always

Steps to Reproduce:
1. Add a user with attribute "gecos: host1.example.com":
dn: uid=kau10,ou=Users,dc=example,dc=com
objectClass: account
objectClass: posixAccount
cn: Kau10
uidNumber: 101010
gidNumber: 101010
homeDirectory: /home/kau10
loginShell: /bin/bash
userPassword:: U2VjcmV0MTIz
uid: kau10
gecos: host1.example.com
host: host1.example.com

2. Edit sssd.conf and add:
access_provider=ldap
ldap_access_order=host
ldap_user_authorized_host = gecos

3. Restart sssd with clear cache.

4. Login as the user.
  
Actual results:
Login fails.

Following messages are seen in the log:
[sdap_get_map] (0x0200): Option ldap_user_authorized_host has value gecos
[sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [user]
[sdap_access_host_send] (0x0020): Missing hosts. Access denied

Expected results:
sssd should get the hostname from gecos attribute of the user and allow login.

Additional info:
Login is successful after I set "ldap_user_authorized_host = host" in sssd.conf.
Comment 2 Kaushik Banerjee 2012-03-26 11:09:07 EDT
This issue can be reproduced only when I set "ldap_user_authorized_host = 
gecos".

I added added another ldap attribute "description: host1.example.com" to 
the user and the issue is no longer seen when I set 
"ldap_user_authorized_host = description".

Also, I tried with "ldap_user_gecos = description" and 
"ldap_user_authorized_host = gecos" and it works fine in this case.
Comment 3 Jakub Hrozek 2012-03-26 13:15:29 EDT
This is the case because you have used gecos for *both* user's gecos and the authorizedHost attribute. In this case, the first match (which is user's gecos) wins.

As you noted, everything works fine if you also mapped the ldap_user_gecos attribute onto something else.

I don't think this is a bug.
Comment 4 Stephen Gallagher 2012-03-26 13:26:52 EDT
(In reply to comment #3)
> This is the case because you have used gecos for *both* user's gecos and the
> authorizedHost attribute. In this case, the first match (which is user's gecos)
> wins.
> 
> As you noted, everything works fine if you also mapped the ldap_user_gecos
> attribute onto something else.
> 
> I don't think this is a bug.

It is a bug. We're supposed to be explicitly handling the possibility of having the same attribute address act as more than one option. This was added so we could support using "cn" for multiple options (specifically).
Comment 5 Stephen Gallagher 2012-03-28 08:17:06 EDT
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1279
Comment 9 Jakub Hrozek 2016-01-07 08:01:17 EST
This functionality was implemented in commit eed2073f6f7bed7df0327b9fc0f2d410975d5332 which made it to upstream release 1.12

Note You need to log in before you can comment on or make changes to this bug.