Blame SOURCES/0007-negcache-make-sure-short-names-are-added-to-sub-doma.patch

bf7bd7
From 0dc81a52e2836010974e9f71b1f3e47c20fd498d Mon Sep 17 00:00:00 2001
bf7bd7
From: Sumit Bose <sbose@redhat.com>
bf7bd7
Date: Fri, 9 Oct 2020 11:56:21 +0200
bf7bd7
Subject: [PATCH 7/8] negcache: make sure short names are added to sub-domains
bf7bd7
bf7bd7
If short names are used with filter_users or filter_groups in a
bf7bd7
[domain/...] section they should be added to the sub-domains of this
bf7bd7
domain as well.
bf7bd7
bf7bd7
Resolves: https://github.com/SSSD/sssd/issues/5238
bf7bd7
bf7bd7
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
bf7bd7
---
bf7bd7
 src/responder/common/negcache.c  | 105 +++++++------
bf7bd7
 src/tests/cmocka/test_negcache.c | 254 +++++++++++++++++++++++++++++++
bf7bd7
 2 files changed, 312 insertions(+), 47 deletions(-)
bf7bd7
bf7bd7
diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c
bf7bd7
index 139218420..9ee39ce3e 100644
bf7bd7
--- a/src/responder/common/negcache.c
bf7bd7
+++ b/src/responder/common/negcache.c
bf7bd7
@@ -971,6 +971,7 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
bf7bd7
     char *name = NULL;
bf7bd7
     struct sss_domain_info *dom = NULL;
bf7bd7
     struct sss_domain_info *domain_list = rctx->domains;
bf7bd7
+    struct sss_domain_info *ddom;
bf7bd7
     char *domainname = NULL;
bf7bd7
     char *conf_path = NULL;
bf7bd7
     TALLOC_CTX *tmpctx = talloc_new(NULL);
bf7bd7
@@ -1013,39 +1014,44 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
bf7bd7
                 continue;
bf7bd7
             }
bf7bd7
 
bf7bd7
-            if (domainname && strcmp(domainname, dom->name)) {
bf7bd7
-                DEBUG(SSSDBG_TRACE_FUNC,
bf7bd7
-                      "Mismatch between domain name (%s) and name "
bf7bd7
-                          "set in FQN  (%s), assuming %s is UPN\n",
bf7bd7
-                          dom->name, domainname, filter_list[i]);
bf7bd7
-                ret = sss_ncache_set_upn(ncache, true, dom, filter_list[i]);
bf7bd7
+            /* Check domain and its sub-domains */
bf7bd7
+            for (ddom = dom; ddom != NULL;
bf7bd7
+                        ddom = get_next_domain(ddom, SSS_GND_ALL_SUBDOMAINS)) {
bf7bd7
+
bf7bd7
+                if (domainname && strcmp(domainname, ddom->name)) {
bf7bd7
+                    DEBUG(SSSDBG_TRACE_FUNC,
bf7bd7
+                          "Mismatch between domain name (%s) and name "
bf7bd7
+                              "set in FQN  (%s), assuming %s is UPN\n",
bf7bd7
+                              ddom->name, domainname, filter_list[i]);
bf7bd7
+                    ret = sss_ncache_set_upn(ncache, true, ddom, filter_list[i]);
bf7bd7
+                    if (ret != EOK) {
bf7bd7
+                        DEBUG(SSSDBG_OP_FAILURE,
bf7bd7
+                              "sss_ncache_set_upn failed (%d [%s]), ignored\n",
bf7bd7
+                              ret, sss_strerror(ret));
bf7bd7
+                    }
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
+
bf7bd7
+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
bf7bd7
+                if (fqname == NULL) {
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
+
bf7bd7
+                ret = sss_ncache_set_upn(ncache, true, ddom, fqname);
bf7bd7
                 if (ret != EOK) {
bf7bd7
                     DEBUG(SSSDBG_OP_FAILURE,
bf7bd7
                           "sss_ncache_set_upn failed (%d [%s]), ignored\n",
bf7bd7
                           ret, sss_strerror(ret));
bf7bd7
                 }
bf7bd7
-                continue;
bf7bd7
-            }
bf7bd7
-
bf7bd7
-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
bf7bd7
-            if (fqname == NULL) {
bf7bd7
-                continue;
bf7bd7
-            }
bf7bd7
-
bf7bd7
-            ret = sss_ncache_set_upn(ncache, true, dom, fqname);
bf7bd7
-            if (ret != EOK) {
bf7bd7
-                DEBUG(SSSDBG_OP_FAILURE,
bf7bd7
-                      "sss_ncache_set_upn failed (%d [%s]), ignored\n",
bf7bd7
-                      ret, sss_strerror(ret));
bf7bd7
-            }
bf7bd7
-            ret = sss_ncache_set_user(ncache, true, dom, fqname);
bf7bd7
-            talloc_zfree(fqname);
bf7bd7
-            if (ret != EOK) {
bf7bd7
-                DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
-                      "Failed to store permanent user filter for [%s]"
bf7bd7
-                          " (%d [%s])\n", filter_list[i],
bf7bd7
-                          ret, sss_strerror(ret));
bf7bd7
-                continue;
bf7bd7
+                ret = sss_ncache_set_user(ncache, true, ddom, fqname);
bf7bd7
+                talloc_zfree(fqname);
bf7bd7
+                if (ret != EOK) {
bf7bd7
+                    DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
+                          "Failed to store permanent user filter for [%s]"
bf7bd7
+                              " (%d [%s])\n", filter_list[i],
bf7bd7
+                              ret, sss_strerror(ret));
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
             }
bf7bd7
         }
bf7bd7
     }
bf7bd7
@@ -1161,27 +1167,32 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
bf7bd7
                 continue;
bf7bd7
             }
bf7bd7
 
bf7bd7
-            if (domainname && strcmp(domainname, dom->name)) {
bf7bd7
-                DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
-                      "Mismatch between domain name (%s) and name "
bf7bd7
-                          "set in FQN  (%s), skipping group %s\n",
bf7bd7
-                          dom->name, domainname, name);
bf7bd7
-                continue;
bf7bd7
-            }
bf7bd7
+            /* Check domain and its sub-domains */
bf7bd7
+            for (ddom = dom;
bf7bd7
+                        ddom != NULL && (ddom == dom || ddom->parent != NULL);
bf7bd7
+                        ddom = get_next_domain(ddom, SSS_GND_ALL_DOMAINS)) {
bf7bd7
+                if (domainname && strcmp(domainname, ddom->name)) {
bf7bd7
+                    DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
+                          "Mismatch between domain name (%s) and name "
bf7bd7
+                              "set in FQN  (%s), skipping group %s\n",
bf7bd7
+                              ddom->name, domainname, name);
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
 
bf7bd7
-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
bf7bd7
-            if (fqname == NULL) {
bf7bd7
-                continue;
bf7bd7
-            }
bf7bd7
+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
bf7bd7
+                if (fqname == NULL) {
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
 
bf7bd7
-            ret = sss_ncache_set_group(ncache, true, dom, fqname);
bf7bd7
-            talloc_zfree(fqname);
bf7bd7
-            if (ret != EOK) {
bf7bd7
-                DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
-                      "Failed to store permanent group filter for [%s]"
bf7bd7
-                          " (%d [%s])\n", filter_list[i],
bf7bd7
-                          ret, strerror(ret));
bf7bd7
-                continue;
bf7bd7
+                ret = sss_ncache_set_group(ncache, true, ddom, fqname);
bf7bd7
+                talloc_zfree(fqname);
bf7bd7
+                if (ret != EOK) {
bf7bd7
+                    DEBUG(SSSDBG_CRIT_FAILURE,
bf7bd7
+                          "Failed to store permanent group filter for [%s]"
bf7bd7
+                              " (%d [%s])\n", filter_list[i],
bf7bd7
+                              ret, strerror(ret));
bf7bd7
+                    continue;
bf7bd7
+                }
bf7bd7
             }
bf7bd7
         }
bf7bd7
     }
bf7bd7
diff --git a/src/tests/cmocka/test_negcache.c b/src/tests/cmocka/test_negcache.c
bf7bd7
index b3a379227..fb306b110 100644
bf7bd7
--- a/src/tests/cmocka/test_negcache.c
bf7bd7
+++ b/src/tests/cmocka/test_negcache.c
bf7bd7
@@ -119,6 +119,8 @@ static int setup(void **state)
bf7bd7
     int ret;
bf7bd7
     struct test_state *ts;
bf7bd7
 
bf7bd7
+    test_dom_suite_setup(TESTS_PATH);
bf7bd7
+
bf7bd7
     ts = talloc(NULL, struct test_state);
bf7bd7
     assert_non_null(ts);
bf7bd7
 
bf7bd7
@@ -133,6 +135,7 @@ static int setup(void **state)
bf7bd7
 static int teardown(void **state)
bf7bd7
 {
bf7bd7
     struct test_state *ts = talloc_get_type_abort(*state, struct test_state);
bf7bd7
+    test_dom_suite_cleanup(TESTS_PATH, TEST_CONF_DB, TEST_DOM_NAME);
bf7bd7
     talloc_free(ts);
bf7bd7
     return 0;
bf7bd7
 }
bf7bd7
@@ -921,6 +924,255 @@ static void test_sss_ncache_reset_prepopulate(void **state)
bf7bd7
     assert_int_equal(ret, EEXIST);
bf7bd7
 }
bf7bd7
 
bf7bd7
+/* The main purpose of test_sss_ncache_short_name_in_domain is to test that
bf7bd7
+ * short names in the filter_users or filter_groups options in a [domain/...]
bf7bd7
+ * section are properly added to the related sub-domains as well (if there are
bf7bd7
+ * any) and not added to domains from other [domain/...] sections. For
bf7bd7
+ * completeness entries with fully-qualified names of the parent and the
bf7bd7
+ * sub-domain and the generic UPN are added as well.
bf7bd7
+ *
bf7bd7
+ * The result should of course be independent of the present domains. To
bf7bd7
+ * verify this the domains are added one after the other and the negative
bf7bd7
+ * cache is repopulated each time.
bf7bd7
+ *
bf7bd7
+ * With the given domains, users and group we have to following expectations:
bf7bd7
+ *  - the short name entry will be added to the domain and all sub-domains as
bf7bd7
+ *    name and as upn by expanding it to a fully-qualified name with the
bf7bd7
+ *    domain name or sub-domain name respectively
bf7bd7
+ *  - the fully-qualified name from the parent domain is added as name and upn
bf7bd7
+ *    to the parent domain and as upn to all sub-domains
bf7bd7
+ *  - the fully-qualified name from the sub-domain is added as name to the
bf7bd7
+ *    sub-domain and as upn to the parent and all sub-domains
bf7bd7
+ *  - the generic upn is nowhere added as name and as upn to the parent and all
bf7bd7
+ *    sub-domains
bf7bd7
+ *  - none of the names is added to a different parent domain
bf7bd7
+ *
bf7bd7
+ * The following table should illustrated the expectations:
bf7bd7
+ *
bf7bd7
+ * user (name):
bf7bd7
+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
bf7bd7
+ *-----------------+-----------+-----------------------+--------------------------+------------
bf7bd7
+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  MISSING                 |  MISSING
bf7bd7
+ * subTEST_DOM_NAME|  PRESENT  |  MISSING              |  PRESENT                 |  MISSING
bf7bd7
+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING
bf7bd7
+ *
bf7bd7
+ * user (upn):
bf7bd7
+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
bf7bd7
+ *-----------------+-----------+-----------------------+--------------------------+------------
bf7bd7
+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT
bf7bd7
+ * subTEST_DOM_NAME|  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT
bf7bd7
+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING
bf7bd7
+ *
bf7bd7
+ *
bf7bd7
+ *
bf7bd7
+ * groups:
bf7bd7
+ *                 | shortgroup | parentg@TEST_DOM_NAME | subdomg@subTEST_DOM_NAME
bf7bd7
+ *-----------------+------------+-----------------------+-------------------------
bf7bd7
+ * TEST_DOM_NAME   |  PRESENT   |  PRESENT              |  MISSING
bf7bd7
+ * subTEST_DOM_NAME|  PRESENT   |  MISSING              |  PRESENT
bf7bd7
+ * TEST_DOM_NAME2  |  MISSING   |  MISSING              |  MISSING
bf7bd7
+ *
bf7bd7
+ *
bf7bd7
+ * The following expect_*() implement checks for the expextations:
bf7bd7
+ */
bf7bd7
+
bf7bd7
+static void expect_in_parent(struct sss_nc_ctx *ncache,
bf7bd7
+                             struct sss_domain_info *dom)
bf7bd7
+{
bf7bd7
+    int ret;
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom, "shortuser");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom, "shortuser@"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom, "parentu");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom, "parentu@"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom, "subdomu");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom, "subdomu@sub"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom, "upn");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom, "upn@upn.dom");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom, "shortgroup");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom, "parentg");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom, "subdomg");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+}
bf7bd7
+
bf7bd7
+static void expect_in_subdomain(struct sss_nc_ctx *ncache,
bf7bd7
+                                struct sss_domain_info *sub_dom)
bf7bd7
+{
bf7bd7
+    int ret;
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, sub_dom, "shortuser");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, sub_dom, "shortuser@sub"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, sub_dom, "subdomu");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, sub_dom, "subdomu@sub"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, sub_dom, "upn");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, sub_dom, "upn@upn.dom");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, sub_dom, "parentu");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, sub_dom, "parentu@"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, sub_dom, "shortgroup");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, sub_dom, "parentg");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, sub_dom, "subdomg");
bf7bd7
+    assert_int_equal(ret, EEXIST);
bf7bd7
+}
bf7bd7
+static void expect_no_entries_in_dom(struct sss_nc_ctx *ncache,
bf7bd7
+                                     struct sss_domain_info *dom2)
bf7bd7
+{
bf7bd7
+    int ret;
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom2, "shortuser");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom2, "shortuser"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom2, "parentu");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom2, "parentu@"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom2, "subdomu");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom2, "subdomu@sub"TEST_DOM_NAME);
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_user_in_ncache(ncache, dom2, "upn");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+    ret = sss_ncache_check_upn(ncache, dom2, "upn@upn.dom");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom2, "shortgroup");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom2, "parentg");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+
bf7bd7
+    ret = check_group_in_ncache(ncache, dom2, "subdomg");
bf7bd7
+    assert_int_equal(ret, ENOENT);
bf7bd7
+}
bf7bd7
+
bf7bd7
+static void test_sss_ncache_short_name_in_domain(void **state)
bf7bd7
+{
bf7bd7
+    int ret;
bf7bd7
+    struct test_state *ts;
bf7bd7
+    struct tevent_context *ev;
bf7bd7
+    struct sss_nc_ctx *ncache;
bf7bd7
+    struct sss_test_ctx *tc;
bf7bd7
+    struct sss_domain_info *dom;
bf7bd7
+    struct sss_domain_info *dom2;
bf7bd7
+    struct sss_domain_info *sub_dom;
bf7bd7
+
bf7bd7
+    struct sss_test_conf_param params[] = {
bf7bd7
+        { "filter_users", "shortuser, parentu@"TEST_DOM_NAME", "
bf7bd7
+          "subdomu@sub"TEST_DOM_NAME", upn@upn.dom" },
bf7bd7
+        { "filter_groups", "shortgroup, parentg@"TEST_DOM_NAME", "
bf7bd7
+          "subdomg@sub"TEST_DOM_NAME },
bf7bd7
+        { NULL, NULL },
bf7bd7
+    };
bf7bd7
+
bf7bd7
+    const char *nss_filter_users[] = { params[0].value, NULL};
bf7bd7
+    const char *nss_filter_groups[] = { params[1].value, NULL};
bf7bd7
+
bf7bd7
+    ts = talloc_get_type_abort(*state, struct test_state);
bf7bd7
+
bf7bd7
+    ev = tevent_context_init(ts);
bf7bd7
+    assert_non_null(ev);
bf7bd7
+
bf7bd7
+    dom = talloc_zero(ts, struct sss_domain_info);
bf7bd7
+    assert_non_null(dom);
bf7bd7
+    dom->name = discard_const_p(char, TEST_DOM_NAME);
bf7bd7
+    sss_domain_set_state(dom, DOM_ACTIVE);
bf7bd7
+
bf7bd7
+    ts->nctx = mock_nctx(ts);
bf7bd7
+    assert_non_null(ts->nctx);
bf7bd7
+
bf7bd7
+    tc = create_dom_test_ctx(ts, TESTS_PATH, TEST_CONF_DB,
bf7bd7
+                             TEST_DOM_NAME, TEST_ID_PROVIDER, params);
bf7bd7
+    assert_non_null(tc);
bf7bd7
+
bf7bd7
+    ret = confdb_add_param(tc->confdb, true, "config/domain/"TEST_DOM_NAME,
bf7bd7
+                           "filter_users", nss_filter_users);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    ret = confdb_add_param(tc->confdb, true, "config/domain"TEST_DOM_NAME,
bf7bd7
+                           "filter_groups", nss_filter_groups);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    ncache = ts->ctx;
bf7bd7
+    ts->rctx = mock_rctx(ts, ev, dom, ts->nctx);
bf7bd7
+    assert_non_null(ts->rctx);
bf7bd7
+    ts->rctx->cdb = tc->confdb;
bf7bd7
+
bf7bd7
+    ret = sss_names_init(ts, tc->confdb, TEST_DOM_NAME, &dom->names);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    /* Add another domain */
bf7bd7
+    dom2 = talloc_zero(ts, struct sss_domain_info);
bf7bd7
+    assert_non_null(dom2);
bf7bd7
+    dom2->name = discard_const_p(char, TEST_DOM_NAME"2");
bf7bd7
+    sss_domain_set_state(dom2, DOM_ACTIVE);
bf7bd7
+    dom->next = dom2;
bf7bd7
+    dom2->names = dom->names;
bf7bd7
+
bf7bd7
+    expect_in_parent(ncache, dom);
bf7bd7
+    expect_no_entries_in_dom(ncache, dom2);
bf7bd7
+
bf7bd7
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    expect_in_parent(ncache, dom);
bf7bd7
+    expect_no_entries_in_dom(ncache, dom2);
bf7bd7
+
bf7bd7
+    /* Add a sub domain */
bf7bd7
+    sub_dom = talloc_zero(ts, struct sss_domain_info);
bf7bd7
+    assert_non_null(sub_dom);
bf7bd7
+    sub_dom->name = discard_const_p(char, "sub"TEST_DOM_NAME);
bf7bd7
+    sss_domain_set_state(sub_dom, DOM_ACTIVE);
bf7bd7
+    sub_dom->parent = dom;
bf7bd7
+    dom->subdomains = sub_dom;
bf7bd7
+    sub_dom->names = dom->names;
bf7bd7
+
bf7bd7
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
bf7bd7
+    assert_int_equal(ret, EOK);
bf7bd7
+
bf7bd7
+    expect_in_parent(ncache, dom);
bf7bd7
+    expect_in_subdomain(ncache, sub_dom);
bf7bd7
+    expect_no_entries_in_dom(ncache, dom2);
bf7bd7
+}
bf7bd7
+
bf7bd7
 static void test_sss_ncache_reset(void **state)
bf7bd7
 {
bf7bd7
     errno_t ret;
bf7bd7
@@ -1083,6 +1335,8 @@ int main(void)
bf7bd7
                                         setup, teardown),
bf7bd7
         cmocka_unit_test_setup_teardown(test_sss_ncache_reset_prepopulate,
bf7bd7
                                         setup, teardown),
bf7bd7
+        cmocka_unit_test_setup_teardown(test_sss_ncache_short_name_in_domain,
bf7bd7
+                                        setup, teardown),
bf7bd7
         cmocka_unit_test_setup_teardown(test_sss_ncache_reset,
bf7bd7
                                         setup, teardown),
bf7bd7
         cmocka_unit_test_setup_teardown(test_sss_ncache_locate_uid_gid,
bf7bd7
-- 
bf7bd7
2.21.3
bf7bd7