Fixed upstream.

Temporarily moving bugs to MODIFIED to work around errata tool bug

Can you please add steps to reproduce/verify this bug?  Thanks!

1. This test requires a setup with trusts.
2. Start the SSSD service. Make sure it's online after it starts.
3. Look into /var/lib/sss/pubconf/krb5.include.d/
  - Before the patch, there would file a file named domain_realm_$IPA_DOMAIN. Typically, the IPA domain contains dots and before the patch, the file would contain dots as well. This caused libkrb5 to skip the file
  - After the patch, the dots should be substituted for underscores. On my test setup, the file is called domain_realm_ipatest_example_com (and my domain is called IPATEST.EXAMPLE.COM)

* File exists with underscores after ipa server install and before trust add

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]

[root@dhcp207-218 ~]# echo Secret123 | ipa trust-add adtest.qe --type ad --admin administrator --password
--------------------------------------------------
Added Active Directory trust for realm "adtest.qe"
--------------------------------------------------
  Realm name: adtest.qe
  Domain NetBIOS name: ADTEST
  Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879
  SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,
                          S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
  SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,
                          S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
  Trust direction: Two-way trust
  Trust type: Active Directory domain
  Trust status: Established and verified

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]

[root@dhcp207-218 ~]# ipa trustdomain-find adtest.qe
  Domain name: adtest.qe
  Domain NetBIOS name: ADTEST
  Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879
  Domain enabled: True

  Domain name: pune.adtest.qe
  Domain NetBIOS name: PUNE
  Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112
  Domain enabled: True
----------------------------
Number of entries returned 2
----------------------------

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]

[root@dhcp207-218 ~]# getent passwd testu1.qe
testu1.qe:*:839001108:839001108:testu1 user:/home/pune.adtest.qe/testu1:

* File contents get added as expected after a while or when a lookup is done for a user in trusted domain

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]
.adtest.qe = ADTEST.QE
adtest.qe = ADTEST.QE
.pune.adtest.qe = PUNE.ADTEST.QE
pune.adtest.qe = PUNE.ADTEST.QE
[capaths]
PUNE.ADTEST.QE = {
  NEWDOM.QE = ADTEST.QE
}
NEWDOM.QE = {
  PUNE.ADTEST.QE = ADTEST.QE
}

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.