IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-11-02 20:30:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipasam: allow search of users by user principal name (UPN)

Browse Source 
lookup_name() in Samba may call PASSDB API to search by a UPN (e.g.
username@suffix). Support this call by detecting '@' in the passed name
and setting up filter to be

  (&(objectClass=ipaNTUserAttrs)(objectClass=krbPrincipalAux)(krbPrincipalName:caseIgnoreIA5Match:=%s))

instead of

  (&(objectClass=ipaNTUserAttrs)(uid=%s))

The result of the search would still contain a proper user entry as we
always have krbPrincipalName in LDAP entries of IPA users. Note that the
match must be case-insensitive because otherwise krbPrincipalName is
matched with exact case in the schema. We use the same matching override
in KDB driver already.

Fixes: https://pagure.io/freeipa/issue/8661
Signed-of-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Alexander Bokovoy authored and Rob Crittenden committed 2021-01-22 12:21:33 -05:00
1 parent e6f8d8bc9b
commit 75882516c4
1 file changed
+25 -4
Download Patch File Download Diff File Expand all files Collapse all files
daemons/ipa-sam/ipa_sam.c
+25 -4
View File
@@ -3855,6 +3855,7 @@ static NTSTATUS ipasam_getsampwnam(struct pdb_methods *methods,
LDAPMessage *entry = NULL;
int ret;
int count;
bool search_for_upn = false;
lastidx = strlen(sname);
if (lastidx > 0) {
@@ -3877,16 +3878,36 @@ static NTSTATUS ipasam_getsampwnam(struct pdb_methods *methods,
return NT_STATUS_NO_MEMORY;
}
if (strchr(sname, '@') != NULL) {
search_for_upn = true;
}
escaped_user = escape_ldap_string(tmp_ctx, sname);
if (escaped_user == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s))",
LDAP_ATTRIBUTE_OBJECTCLASS,
LDAP_OBJ_SAMBASAMACCOUNT,
LDAP_ATTRIBUTE_UID, escaped_user);
if (search_for_upn) {
/* Search krbPrincipalName case-insensitive for UPN suffixes to
* match because default matching rule is case-sensitive for
* IA5String */
filter = talloc_asprintf(tmp_ctx,
"(&(%s=%s)(%s=%s)(%s:caseIgnoreIA5Match:=%s))",
LDAP_ATTRIBUTE_OBJECTCLASS,
LDAP_OBJ_SAMBASAMACCOUNT,
LDAP_ATTRIBUTE_OBJECTCLASS,
LDAP_OBJ_KRB_PRINCIPAL_AUX,
LDAP_ATTRIBUTE_KRB_PRINCIPAL,
escaped_user);
} else {
filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s))",
LDAP_ATTRIBUTE_OBJECTCLASS,
LDAP_OBJ_SAMBASAMACCOUNT,
LDAP_ATTRIBUTE_UID, escaped_user);
}
if (filter == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;