sss_get_domain_name: check for fq name first

[Pavel Březina]

Hi,
my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda 
broke authentication (thx ab).

The problem was that sysdb_get_user_attr is often called with fully 
qualified name and we basically ended up with "user@domain@domain" name.

One solution would be to translate the name to fq format in IFP. Other 
would be to change the other places so they use just name without the 
domain part. But since sysdb_get_user_attr now calls sss_get_domain_name 
in the same way as other sysdb functions does I think the best solution 
here is to check the name format in this function and response as 
appropriate.

[Jakub Hrozek]

On Mon, Oct 13, 2014 at 04:30:53PM +0200, Pavel Březina wrote:
> Hi,
> my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda
> broke authentication (thx ab).
>
> The problem was that sysdb_get_user_attr is often called with fully
> qualified name and we basically ended up with "user@domain@domain" name.
>
> One solution would be to translate the name to fq format in IFP. Other would
> be to change the other places so they use just name without the domain part.
> But since sysdb_get_user_attr now calls sss_get_domain_name in the same way
> as other sysdb functions does I think the best solution here is to check the
> name format in this function and response as appropriate.

This patch fixed AD subdomain authentication for me.

I'm sorry for the bad review the first time around.

ACK to both.

[Jakub Hrozek]

On Tue, Oct 14, 2014 at 02:23:16PM +0200, Jakub Hrozek wrote:
> On Mon, Oct 13, 2014 at 04:30:53PM +0200, Pavel Březina wrote:
> > Hi,
> > my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda
> > broke authentication (thx ab).
> >
> > The problem was that sysdb_get_user_attr is often called with fully
> > qualified name and we basically ended up with "user@domain@domain" name.
> >
> > One solution would be to translate the name to fq format in IFP. Other would
> > be to change the other places so they use just name without the domain part.
> > But since sysdb_get_user_attr now calls sss_get_domain_name in the same way
> > as other sysdb functions does I think the best solution here is to check the
> > name format in this function and response as appropriate.
>
> This patch fixed AD subdomain authentication for me.
>
> I'm sorry for the bad review the first time around.
>
> ACK to both.

* master: 09a36be00ddcf1d7bd5b8a368143d5b2e2f4fb68
          7a153394bdeb77325b7e4ee1502a1e89fa306f5a