Hi,

memberUid attribute has case-sensitive comparison defined but when we
construct memberUid for AD users (coming through SSSD), they are
normalized to lower case. Interestingly enough, 'uid' attribute has
case-insensitive comparison.

Work around the issue by low-casing the memberUid search term value when
it is a fully-qualified name (user@domain), meaning we do ask for a SSSD
user.

This is the patch on top of my ID views support patch.

https://bugzilla.redhat.com/show_bug.cgi?id=1130131
--
/ Alexander Bokovoy
From e90135b7a477d15c4349e7d46e4cbf2730a66d71 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <aboko...@redhat.com>
Date: Thu, 9 Oct 2014 13:52:38 +0300
Subject: [PATCH 2/2] slapi-nis: normalize memberUid search filter when
 searching AD users

memberUid attribute uses IA5 String comparison which is case-sensitive.
At the same time, uid attribute uses case-insensitive comparison.

When memberUid is constructed for groups from AD, SSSD normalizes names
to a lower case. slapi-nis records these entries as they produced by SSSD.
However, the search filter is not modified, thus case-sensitive comparison
of memberUid attribute may fail match of the original term.

Workaround the issue by low-casing memberUid term in the search filter
if it includes '@' sign, meaning we are searching on fully-qualified user
name provided by SSSD.

https://bugzilla.redhat.com/show_bug.cgi?id=1130131
---
 src/back-sch-nss.c | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/src/back-sch-nss.c b/src/back-sch-nss.c
index 26d4b8c..12ae589 100644
--- a/src/back-sch-nss.c
+++ b/src/back-sch-nss.c
@@ -60,7 +60,7 @@ bvstrprefix(const struct berval *bval, const char *s)
 
        len = strlen(s);
        if (len < bval->bv_len) {
-               return strncasecmp(bval->bv_val, s, len) != 0;
+               return slapi_utf8ncasecmp((unsigned char *) bval->bv_val, 
(unsigned char *) s, len) != 0;
        }
 
        return 1;
@@ -75,9 +75,9 @@ bvstrcasecmp(const struct berval *bval, const char *s)
 
        len = strlen(s);
        if (len == bval->bv_len) {
-               return strncasecmp(bval->bv_val, s, len);
+               return slapi_utf8ncasecmp((unsigned char *) bval->bv_val, 
(unsigned char *) s, len);
        }
-       c = strncasecmp(bval->bv_val, s, MIN(bval->bv_len, len));
+       c = slapi_utf8ncasecmp((unsigned char *) bval->bv_val, (unsigned char 
*) s, MIN(bval->bv_len, len));
        if (c != 0) {
                return c;
        }
@@ -111,6 +111,35 @@ backend_search_filter_has_cn_uid(Slapi_Filter *filter, 
void *arg)
                } else if (0 == strcasecmp(filter_type, "cn")) {
                        config->name_set = TRUE;
                } else if (0 == strcasecmp(filter_type, "memberUid")) {
+                       /* memberUid is case-sensitive in RFC 2307 but uid is 
case-insensitive
+                        * When memberUid is generated for SSSD-provided 
entries, it is low-cased,
+                        * we need to low case the filter value to actually 
match it.
+                        * However, we will do it only for fully qualified 
names as they are coming from SSSD. */
+                       char *memberUid = NULL;
+                       char *lwMemberUid = NULL;
+                       unsigned int i = 0;
+
+                       for (i=0; i < bval->bv_len ; i++) {
+                               if (bval->bv_val[i] == '@')
+                                       break;
+                       }
+
+                       if (i < bval->bv_len) {
+                               memberUid = slapi_ch_malloc(bval->bv_len + 1);
+                               if (memberUid != NULL) {
+                                       memcpy(memberUid, bval->bv_val, 
bval->bv_len);
+                                       memberUid[bval->bv_len] = '\0';
+                                       lwMemberUid = (char *) 
slapi_utf8StrToLower((unsigned char*) memberUid);
+                                       if (lwMemberUid != NULL) {
+                                               struct berval bval_lw = {0, 
NULL};
+                                               bval_lw.bv_len = strlen((const 
char *) lwMemberUid);
+                                               bval_lw.bv_val = lwMemberUid;
+                                               slapi_ber_bvdone(bval);
+                                               slapi_ber_bvcpy(bval, &bval_lw);
+                                       }
+                                       slapi_ch_free_string(&memberUid);
+                               }
+                       }
                        config->name_set = TRUE;
                        config->search_members = TRUE;
                } else if ((0 == strcasecmp(filter_type, "objectClass")) &&
-- 
2.1.0

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to