You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
50 lines
2.0 KiB
50 lines
2.0 KiB
2 years ago
|
From a86d1740167031bf6444ff821a201164c11ba09c Mon Sep 17 00:00:00 2001
|
||
|
|
From: Sumit Bose <sbose@redhat.com>
|
||
|
|
Date: Wed, 16 Nov 2022 09:28:54 +0100
|
||
|
|
Subject: [PATCH 17/19] PAC: allow to disable UPN check
|
||
|
|
|
||
|
|
Currently it was not possible to skip the UPN check which checks if the
|
||
|
|
UPN in the PAC and the one stored in SSSD's cache are different.
|
||
|
|
Additionally the related debug message will show both principals if they
|
||
|
|
differ.
|
||
|
|
|
||
|
|
Resolves: https://github.com/SSSD/sssd/issues/6451
|
||
|
|
|
||
|
|
(cherry picked from commit 91789449b7a8b20056e1edfedd8f8cf92f7a0a2a)
|
||
|
|
|
||
|
|
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
||
|
|
---
|
||
|
|
src/providers/ad/ad_pac_common.c | 16 +++++++++++++---
|
||
|
|
1 file changed, 13 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/providers/ad/ad_pac_common.c b/src/providers/ad/ad_pac_common.c
|
||
|
|
index 0ed817111..79f79b7a7 100644
|
||
|
|
--- a/src/providers/ad/ad_pac_common.c
|
||
|
|
+++ b/src/providers/ad/ad_pac_common.c
|
||
|
|
@@ -224,9 +224,19 @@ errno_t check_upn_and_sid_from_user_and_pac(struct ldb_message *msg,
|
||
|
|
|
||
|
|
if (user_data != NULL) {
|
||
|
|
if (strcasecmp(user_data, upn_dns_info->upn_name) != 0) {
|
||
|
|
- DEBUG(SSSDBG_CRIT_FAILURE,
|
||
|
|
- "UPN of user entry and PAC do not match.\n");
|
||
|
|
- return ERR_CHECK_PAC_FAILED;
|
||
|
|
+ if (pac_check_opts & CHECK_PAC_CHECK_UPN) {
|
||
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE, "UPN of user entry [%s] and "
|
||
|
|
+ "PAC [%s] do not match.\n",
|
||
|
|
+ user_data,
|
||
|
|
+ upn_dns_info->upn_name);
|
||
|
|
+ return ERR_CHECK_PAC_FAILED;
|
||
|
|
+ } else {
|
||
|
|
+ DEBUG(SSSDBG_IMPORTANT_INFO, "UPN of user entry [%s] and "
|
||
|
|
+ "PAC [%s] do not match, "
|
||
|
|
+ "ignored.\n", user_data,
|
||
|
|
+ upn_dns_info->upn_name);
|
||
|
|
+ return EOK;
|
||
|
|
+ }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
2.37.3
|
||
|
|
|