From e795c094ac6ccc8a33e247ba56b93c35ed9cf57d Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 17 Mar 2017 14:10:52 +0100 Subject: [PATCH] extdom: do reverse search for domain separator To avoid issues which @-signs in the short user or group names it is better to search for the domain separator starting at the end of the fully-qualified name. Reviewed-By: Alexander Bokovoy Reviewed-By: David Kupka --- daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c b/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c index e629247fd771e374d50486d836cd3b0d8d32a78a..aa1ff10dfbf51b87a367261202b39d1346bd337a 100644 --- a/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c +++ b/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c @@ -515,7 +515,7 @@ int pack_ber_user(struct ipa_extdom_ctx *ctx, char *short_user_name = NULL; short_user_name = strdup(user_name); - if ((locat = strchr(short_user_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { + if ((locat = strrchr(short_user_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { if (strcasecmp(locat+1, domain_name) == 0 ) { locat[0] = '\0'; } else { @@ -626,7 +626,7 @@ int pack_ber_group(enum response_types response_type, char *short_group_name = NULL; short_group_name = strdup(group_name); - if ((locat = strchr(short_group_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { + if ((locat = strrchr(short_group_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { if (strcasecmp(locat+1, domain_name) == 0 ) { locat[0] = '\0'; } else { @@ -901,7 +901,7 @@ static int handle_sid_or_cert_request(struct ipa_extdom_ctx *ctx, goto done; } - sep = strchr(fq_name, SSSD_DOMAIN_SEPARATOR); + sep = strrchr(fq_name, SSSD_DOMAIN_SEPARATOR); if (sep == NULL) { set_err_msg(req, "Failed to split fully qualified name"); ret = LDAP_OPERATIONS_ERROR; -- 2.12.1