IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

ipaserver/dcerpc: attempt to resolve SIDs through SSSD first

Browse Source 
Attempt to resolve SIDs through SSSD first to avoid using trust
account password. This makes possible to run HBAC test requests
without being in 'trusted admins' group.

https://fedorahosted.org/freeipa/ticket/3803
This commit is contained in:
Alexander Bokovoy
2013-07-23 16:24:38 +03:00
parent 17c7d46c25
commit 7b5cc3ed83
2 changed files with 47 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipalib/plugins/hbactest.py
+3 -6
View File
@@ -400,17 +400,14 @@ class hbactest(Command):
ldap = self.api.Backend.ldap2
group_container = DN(api.env.container_group, api.env.basedn)
try:
entries, truncated = ldap.find_entries(filter_sids, ['cn', 'memberOf'], group_container)
entries, truncated = ldap.find_entries(filter_sids, ['cn'], group_container)
except errors.NotFound:
request.user.groups = []
else:
groups = []
for dn, entry in entries:
memberof_dns = entry.get('memberof', [])
for memberof_dn in memberof_dns:
if memberof_dn.endswith(group_container):
# this is a group object
groups.append(memberof_dn[0][0].value)
if dn.endswith(group_container):
groups.append(dn[0][0].value)
request.user.groups = sorted(set(groups))
else:
# try searching for a local user