[PATCH] NSS: Ignore default_domain for netgroups

[Jakub Hrozek]

Hi,

I think we shouldn't honor the default_domain_suffix for netgroup lookups
at all. The main use case for the option is to avoid entering the domain
for users from AD trusts, where you don't have netgroups on the AD
side. Moreover, netgroups don't play well eith fully qualified lookups
either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).

Using default_domain_suffix for netgroups is actually harmful, because
hostgroups defined on an IPA server are translated into netgroups, so
honoring the suffix breaks sudo rules in the trust case.

As a side-effect, this patch should fix
https://fedorahosted.org/sssd/ticket/2400

[Pavel Březina]

On 08/10/2014 06:42 PM, Jakub Hrozek wrote:
> Hi,
>
> I think we shouldn't honor the default_domain_suffix for netgroup lookups
> at all. The main use case for the option is to avoid entering the domain
> for users from AD trusts, where you don't have netgroups on the AD
> side. Moreover, netgroups don't play well eith fully qualified lookups
> either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).
>
> Using default_domain_suffix for netgroups is actually harmful, because
> hostgroups defined on an IPA server are translated into netgroups, so
> honoring the suffix breaks sudo rules in the trust case.
>
> As a side-effect, this patch should fix
> https://fedorahosted.org/sssd/ticket/2400

This sounds reasonable. Ack.

[Jakub Hrozek]

On Tue, Aug 12, 2014 at 02:27:59PM +0200, Pavel Březina wrote:
> On 08/10/2014 06:42 PM, Jakub Hrozek wrote:
> > Hi,
> >
> > I think we shouldn't honor the default_domain_suffix for netgroup lookups
> > at all. The main use case for the option is to avoid entering the domain
> > for users from AD trusts, where you don't have netgroups on the AD
> > side. Moreover, netgroups don't play well eith fully qualified lookups
> > either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).
> >
> > Using default_domain_suffix for netgroups is actually harmful, because
> > hostgroups defined on an IPA server are translated into netgroups, so
> > honoring the suffix breaks sudo rules in the trust case.
> >
> > As a side-effect, this patch should fix
> > https://fedorahosted.org/sssd/ticket/2400
>
> This sounds reasonable. Ack.

Sorry, I forgot to send pushmail:
    * master: e6d441518531e7931e29dd8c65a3448a213e3865
    * sssd-1-11: 484a9f2fc6952199096ea5afb486b3eddb545c20