{"action":"created","issue":{"url":"https://api.github.com/repos/SSSD/sssd/issues/39","repository_url":"https://api.github.com/repos/SSSD/sssd","labels_url":"https://api.github.com/repos/SSSD/sssd/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/SSSD/sssd/issues/39/comments","events_url":"https://api.github.com/repos/SSSD/sssd/issues/39/events","html_url":"https://github.com/SSSD/sssd/pull/39","id":181186716,"number":39,"title":"RESPONDER: Enable sudoRule in case insen. domains (1.13)","user":{"login":"celestian","id":1382015,"avatar_url":"https://avatars.githubusercontent.com/u/1382015?v=3","gravatar_id":"","url":"https://api.github.com/users/celestian","html_url":"https://github.com/celestian","followers_url":"https://api.github.com/users/celestian/followers","following_url":"https://api.github.com/users/celestian/following{/other_user}","gists_url":"https://api.github.com/users/celestian/gists{/gist_id}","starred_url":"https://api.github.com/users/celestian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/celestian/subscriptions","organizations_url":"https://api.github.com/users/celestian/orgs","repos_url":"https://api.github.com/users/celestian/repos","events_url":"https://api.github.com/users/celestian/events{/privacy}","received_events_url":"https://api.github.com/users/celestian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"pbrezina","id":18548882,"avatar_url":"https://avatars.githubusercontent.com/u/18548882?v=3","gravatar_id":"","url":"https://api.github.com/users/pbrezina","html_url":"https://github.com/pbrezina","followers_url":"https://api.github.com/users/pbrezina/followers","following_url":"https://api.github.com/users/pbrezina/following{/other_user}","gists_url":"https://api.github.com/users/pbrezina/gists{/gist_id}","starred_url":"https://api.github.com/users/pbrezina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbrezina/subscriptions","organizations_url":"https://api.github.com/users/pbrezina/orgs","repos_url":"https://api.github.com/users/pbrezina/repos","events_url":"https://api.github.com/users/pbrezina/events{/privacy}","received_events_url":"https://api.github.com/users/pbrezina/received_events","type":"User","site_admin":false},"assignees":[{"login":"pbrezina","id":18548882,"avatar_url":"https://avatars.githubusercontent.com/u/18548882?v=3","gravatar_id":"","url":"https://api.github.com/users/pbrezina","html_url":"https://github.com/pbrezina","followers_url":"https://api.github.com/users/pbrezina/followers","following_url":"https://api.github.com/users/pbrezina/following{/other_user}","gists_url":"https://api.github.com/users/pbrezina/gists{/gist_id}","starred_url":"https://api.github.com/users/pbrezina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbrezina/subscriptions","organizations_url":"https://api.github.com/users/pbrezina/orgs","repos_url":"https://api.github.com/users/pbrezina/repos","events_url":"https://api.github.com/users/pbrezina/events{/privacy}","received_events_url":"https://api.github.com/users/pbrezina/received_events","type":"User","site_admin":false}],"milestone":null,"comments":19,"created_at":"2016-10-05T15:24:20Z","updated_at":"2016-11-08T13:22:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/SSSD/sssd/pulls/39","html_url":"https://github.com/SSSD/sssd/pull/39","diff_url":"https://github.com/SSSD/sssd/pull/39.diff","patch_url":"https://github.com/SSSD/sssd/pull/39.patch"},"body":"This ptach is valid only for SSSD-1-13. It adds value 'ALL' to\nsudoRule attribute \"sudoUser\". So if we have case insensitive domain\nsuch sudo rule will be work for right users.\n\nResolves:\nhttps://fedorahosted.org/sssd/ticket/3203\n---\n\nThis is simple patch for solving the ticket.\nAnother solution is backport pbrezina patches what I didn't try yet.\nIf you prefer backport please tell me.\n"},"comment":{"url":"https://api.github.com/repos/SSSD/sssd/issues/comments/259134748","html_url":"https://github.com/SSSD/sssd/pull/39#issuecomment-259134748","issue_url":"https://api.github.com/repos/SSSD/sssd/issues/39","id":259134748,"user":{"login":"jhrozek","id":715522,"avatar_url":"https://avatars.githubusercontent.com/u/715522?v=3","gravatar_id":"","url":"https://api.github.com/users/jhrozek","html_url":"https://github.com/jhrozek","followers_url":"https://api.github.com/users/jhrozek/followers","following_url":"https://api.github.com/users/jhrozek/following{/other_user}","gists_url":"https://api.github.com/users/jhrozek/gists{/gist_id}","starred_url":"https://api.github.com/users/jhrozek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhrozek/subscriptions","organizations_url":"https://api.github.com/users/jhrozek/orgs","repos_url":"https://api.github.com/users/jhrozek/repos","events_url":"https://api.github.com/users/jhrozek/events{/privacy}","received_events_url":"https://api.github.com/users/jhrozek/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T13:22:53Z","updated_at":"2016-11-08T13:22:53Z","body":"On Tue, Nov 08, 2016 at 05:06:41AM -0800, celestian wrote:\n> Yes, the second patch explicitly qualifies the names. I don't know if there is possibility to add wrong domain to the given user name this way. That's the question.\n> \n> The reason for doing this is that  function ```sudosrv_get_user()``` ask for that type of name. How you can see:\n> ```\n> # grep 'administrator' *.log\n> \n> # sssd_scorpion.domain.log:\n> [be_get_account_info] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=administrator]\n> [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=administrator)(objectclass=user)(objectSID=*))][DC=scorpion,DC=domain].\n> [pam_print_data] (0x0100): ruser: administrator@scorpion.domain\n> [sssd[be[scorpion.domain]]] [pam_print_data] (0x0100): ruser: administrator@scorpion.domain\n> \n> # sssd_sudo.log:\n> [sss_parse_name_for_domains] (0x0200): name 'administrator@scorpion.domain' matched expression for domain 'scorpion.domain', user is administrator\n> [sss_parse_name_for_domains] (0x0200): name 'administrator@scorpion.domain' matched expression for domain 'scorpion.domain', user is administrator\n> [sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [administrator] from [scorpion.domain]\n> [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/scorpion.domain/administrator]\n> [sudosrv_get_user] (0x0200): Requesting info about [administrator@scorpion.domain]\n> [sudosrv_get_user] (0x0400): Returning info for user [administrator@scorpion.domain]\n\nThis is only how the DEBUG messages are formatted:\n122         DEBUG(SSSDBG_FUNC_DATA, \"Requesting info about [%s@%s]\\n\",\n123               name, dom->name);\n\nand:\n\n243         DEBUG(SSSDBG_TRACE_FUNC, \"Returning info for user [%s@%s]\\n\",\n244               cmd_ctx->username, dctx->domain->name); \n\nIn the cache I can see both administrator@win.trust.test and\nadministrator. But do we need the qualified name? Why?\n"}}
{"actor":{"display_login":"jhrozek"}}