|
 |
f98a0d |
From ead272e1e4e9e3e605cfb91fa333310edf27b2ed Mon Sep 17 00:00:00 2001
|
|
|
f98a0d |
From: Sumit Bose <sbose@redhat.com>
|
|
|
f98a0d |
Date: Wed, 7 Jun 2023 10:45:59 +0200
|
|
|
f98a0d |
Subject: [PATCH] ad: use sAMAccountName to lookup hosts
|
|
|
f98a0d |
|
|
|
f98a0d |
To determine which GPOs apply to the host running SSSD the full DN of
|
|
|
f98a0d |
the host object in AD is needed. To fine this object we use the NetBIOS
|
|
|
f98a0d |
name of the host which is stored in AD in the sAMAccountName attribute.
|
|
|
f98a0d |
Using other attributes, e.g. if ldap_user_name is set to a different
|
|
|
f98a0d |
attribute, will most probably cause a failure since those attributes are
|
|
|
f98a0d |
not managed as expected for host object. As a result sAMAccountName
|
|
|
f98a0d |
should be hardcoded here to avoid issues.
|
|
|
f98a0d |
|
|
|
f98a0d |
Resolves: https://github.com/SSSD/sssd/issues/6766
|
|
|
f98a0d |
|
|
|
f98a0d |
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
|
|
|
f98a0d |
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
|
|
|
f98a0d |
(cherry picked from commit 67c11c2ebae843f7ddd6b857efa2e1f6449986f3)
|
|
|
f98a0d |
---
|
|
|
f98a0d |
src/providers/ad/ad_gpo.c | 3 ++-
|
|
|
f98a0d |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
f98a0d |
|
|
|
f98a0d |
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
|
|
|
f98a0d |
index 27885ef8a..c6ea859fd 100644
|
|
|
f98a0d |
--- a/src/providers/ad/ad_gpo.c
|
|
|
f98a0d |
+++ b/src/providers/ad/ad_gpo.c
|
|
|
f98a0d |
@@ -56,6 +56,7 @@
|
|
|
f98a0d |
|
|
|
f98a0d |
#define AD_AT_DN "distinguishedName"
|
|
|
f98a0d |
#define AD_AT_UAC "userAccountControl"
|
|
|
f98a0d |
+#define AD_AT_SAMACCOUNTNAME "sAMAccountName"
|
|
|
f98a0d |
#define AD_AT_CONFIG_NC "configurationNamingContext"
|
|
|
f98a0d |
#define AD_AT_GPLINK "gPLink"
|
|
|
f98a0d |
#define AD_AT_GPOPTIONS "gpOptions"
|
|
|
f98a0d |
@@ -1882,7 +1883,7 @@ ad_gpo_connect_done(struct tevent_req *subreq)
|
|
|
f98a0d |
filter = talloc_asprintf(state,
|
|
|
f98a0d |
"(&(objectclass=%s)(%s=%s))",
|
|
|
f98a0d |
state->opts->user_map[SDAP_OC_USER].name,
|
|
|
f98a0d |
- state->opts->user_map[SDAP_AT_USER_NAME].name,
|
|
|
f98a0d |
+ AD_AT_SAMACCOUNTNAME,
|
|
|
f98a0d |
sam_account_name);
|
|
|
f98a0d |
if (filter == NULL) {
|
|
|
f98a0d |
ret = ENOMEM;
|
|
|
f98a0d |
--
|
|
|
f98a0d |
2.41.0
|
|
|
f98a0d |
|