From a63e00fd3464524c012687c85cd67fa0468ba913 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Wed, 25 Mar 2020 12:10:35 +0100 Subject: [PATCH] sysdb: check if the id override belongs to requested domain Steps to reproduce: 1. Setup an id override (administrator@ad.vm: uid -> 10001) 2. Request user by name to fill cache ``` $ id Administrator@ad.vm uid=10001(administrator@ad.vm) ... ``` 3. Request user by id and see that domain part is missing ``` $ id 10001 uid=10001(administrator) ... ``` First, the uid is looked up in IPA domain and the override object is found when we hit `sysdb_search_override_by_id` because id values are not qualified. Therefore the origin object (administrator@ad.vm) is returned as part of IPA domain. We need to check if the original object belongs to the requested domain. Resolves: https://pagure.io/SSSD/sssd/issue/4173 Reviewed-by: Alexey Tikhonov (cherry picked from commit 1b84c3a1f17f59e134bb882f0f15109d18599193) --- src/db/sysdb_views.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/db/sysdb_views.c b/src/db/sysdb_views.c index 73213ae28..08c31c9b0 100644 --- a/src/db/sysdb_views.c +++ b/src/db/sysdb_views.c @@ -1261,6 +1261,7 @@ static errno_t sysdb_search_override_by_id(TALLOC_CTX *mem_ctx, int ret; const char *orig_obj_dn; const char *filter; + const struct ldb_val *orig_domain; tmp_ctx = talloc_new(NULL); if (!tmp_ctx) { @@ -1330,6 +1331,23 @@ static errno_t sysdb_search_override_by_id(TALLOC_CTX *mem_ctx, goto done; } + /* Check if the found override object belongs to an object in this + * domain. The base dn is in the form: + * name=user@domain,cn=users,cn=domain,cn=sysdb + * = 0 = 1 = 2 = 3 + */ + orig_domain = ldb_dn_get_component_val(base_dn, 2); + if (orig_domain == NULL || !orig_domain->length) { + DEBUG(SSSDBG_OP_FAILURE, "Invalid original object DN\n"); + ret = EINVAL; + goto done; + } + + if (strcmp((const char*)orig_domain->data, domain->name) != 0) { + ret = ENOENT; + goto done; + } + ret = ldb_search(domain->sysdb->ldb, tmp_ctx, &orig_res, base_dn, LDB_SCOPE_BASE, attrs, NULL); if (ret != LDB_SUCCESS) { -- 2.21.1