Description of problem: realmd can be fooled by combination of permit user and permit -all Version-Release number of selected component (if applicable): realmd-0.14.1-1.fc19 How reproducible: always Steps to Reproduce: [root@pkis ~]# realm list ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: kerberos-member server-software: active-directory client-software: sssd required-package: sssd required-package: adcli required-package: samba-common login-formats: %U.qe login-policy: allow-realm-logins [root@pkis ~]# cat /etc/sssd/sssd.conf [sssd] domains = ad.baseos.qe config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/ad.baseos.qe] ad_domain = ad.baseos.qe krb5_realm = AD.BASEOS.QE cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad [root@pkis ~]# [root@pkis ~]# [root@pkis ~]# realm -v permit Amy.qe * /usr/bin/systemctl restart sssd.service * Successfully changed permitted logins for realm [root@pkis ~]# cat /etc/sssd/sssd.conf [sssd] domains = ad.baseos.qe config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/ad.baseos.qe] ad_domain = ad.baseos.qe krb5_realm = AD.BASEOS.QE cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = simple simple_allow_users = amy [root@pkis ~]# [root@pkis ~]# realm -v permit --all * /usr/bin/systemctl restart sssd.service * Successfully changed permitted logins for realm [root@pkis ~]# cat /etc/sssd/sssd.conf [sssd] domains = ad.baseos.qe config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/ad.baseos.qe] ad_domain = ad.baseos.qe krb5_realm = AD.BASEOS.QE cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad simple_allow_users = amy [root@pkis ~]# realm list ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: kerberos-member server-software: active-directory client-software: sssd required-package: sssd required-package: adcli required-package: samba-common login-formats: %U.qe login-policy: allow-realm-logins [root@pkis ~]# [root@pkis ~]# realm -v permit Bender.qe * /usr/bin/systemctl restart sssd.service * Successfully changed permitted logins for realm [root@pkis ~]# realm list ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: kerberos-member server-software: active-directory client-software: sssd required-package: sssd required-package: adcli required-package: samba-common login-formats: %U.qe login-policy: allow-permitted-logins permitted-logins: amy.qe, bender.qe permitted-groups: [root@pkis ~]# cat /etc/sssd/sssd.conf [sssd] domains = ad.baseos.qe config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/ad.baseos.qe] ad_domain = ad.baseos.qe krb5_realm = AD.BASEOS.QE cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = simple simple_allow_users = amy, bender [root@pkis ~]# Actual result: Here one would expect that only Bender is allowed. Expected result: Last permit should allow only Bender.
Patch available upstream.
realmd-0.14.2-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/realmd-0.14.2-1.fc19
Package realmd-0.14.2-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing realmd-0.14.2-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-9364/realmd-0.14.2-1.fc19 then log in and leave karma (feedback).
realmd-0.14.2-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.