From 8a18e0f42e45a29ca78f5ec2c21987cd8df3474d Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 23 Jan 2015 14:39:07 +0100 Subject: [PATCH 177/177] sysdb: remove ghosts in all sub-domains as well If a user is a member is a group in a different sub-domain, e.g with universal groups in AD, the ghost attribute might not be properly removed from the group object if the user is resolved. The reason is that only groups from the domain of the user were search for ghost attributes. This patch increases the search-base to all sub-domains of the configured SSSD domain. Resolves https://fedorahosted.org/sssd/ticket/2567 Reviewed-by: Jakub Hrozek (cherry picked from commit fc2146c108e28d50bbf691925cedf9592142dd14) --- src/db/sysdb_ops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c index b12540b68d1c81c419455416294f3449dd84914e..0c254d8cdad1144c32aad7e470fa2a35cd24b38b 100644 --- a/src/db/sysdb_ops.c +++ b/src/db/sysdb_ops.c @@ -1219,8 +1219,9 @@ sysdb_remove_ghostattr_from_groups(struct sss_domain_info *domain, ERROR_OUT(ret, EINVAL, done); } - tmpdn = ldb_dn_new_fmt(tmp_ctx, domain->sysdb->ldb, - SYSDB_TMPL_GROUP_BASE, domain->name); + /* To cover cross-domain group-membership we must search in all + * sub-domains. */ + tmpdn = ldb_dn_new(tmp_ctx, domain->sysdb->ldb, SYSDB_BASE); if (!tmpdn) { ret = ENOMEM; goto done; -- 2.1.0