mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
443a99060c
When working with aliased entries, we need a reliable way to detect whether two principals reference the same database entry. This is important in S4U checks. Ideally, we should be using SIDs for these checks as S4U requires PAC record presence which cannot be issued without a SID associated with an entry. This is true for user principals and a number of host/service principals associated with Samba. Other service principals do not have SIDs because we do not allocate POSIX IDs to them in FreeIPA. When PAC is issued for these principals, they get SID of a domain computer or domain controller depending on their placement (IPA client or IPA server). Since 389-ds always returns unique entry DN for the same entry, rely on this value instead. We could have used ipaUniqueID but for Kerberos principals created through the KDB (kadmin/kdb5_util) we don't have ipaUniqueID in the entry. Fixes: https://pagure.io/freeipa/issue/9031 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> |
||
|---|---|---|
| .. | ||
| dnssec | ||
| ipa-kdb | ||
| ipa-otpd | ||
| ipa-sam | ||
| ipa-slapi-plugins | ||
| ipa-version.h.in | ||
| Makefile.am | ||