diff options
| author | Sumit Bose <sbose@redhat.com> | 2013-08-06 11:10:10 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-08-26 11:44:42 +0200 |
| commit | 5c28b1bdb9f180590bdfec947bd2df52351912a8 (patch) | |
| tree | e3c9d33da08b1fa11279ed5712282462aa9e5201 /src/responder | |
| parent | 1e9930690691360d8963eecea4918b36b6d51013 (diff) | |
| download | sssd-5c28b1bdb9f180590bdfec947bd2df52351912a8.tar.gz sssd-5c28b1bdb9f180590bdfec947bd2df52351912a8.tar.bz2 sssd-5c28b1bdb9f180590bdfec947bd2df52351912a8.zip | |
PAC: do not create users with missing GID
If the user entry does not exist in the cache and a primary GID cannot
be found it does not make sense to create a user entry.
Diffstat (limited to 'src/responder')
| -rw-r--r-- | src/responder/pac/pacsrv_cmd.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/responder/pac/pacsrv_cmd.c b/src/responder/pac/pacsrv_cmd.c index e5152006..bcdcdc46 100644 --- a/src/responder/pac/pacsrv_cmd.c +++ b/src/responder/pac/pacsrv_cmd.c @@ -575,6 +575,20 @@ static errno_t save_pac_user(struct pac_req_ctx *pr_ctx) ret = sysdb_search_user_by_uid(tmp_ctx, sysdb, pr_ctx->dom, pwd->pw_uid, attrs, &msg); if (ret == ENOENT) { + if (pwd->pw_gid == 0 && !pr_ctx->dom->mpg) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Primary group RID from the PAC " \ + "cannot be translated into a GID for " \ + "user [%s]. Typically this happens " \ + "when UIDs and GIDs are read from AD " \ + "and the primary AD group does not " \ + "have a GID assigned. Make sure the " \ + "user is created by the ID provider " \ + "before GSSAPI based authentication " \ + "is used in this case.", pwd->pw_name)); + ret = EINVAL; + goto done; + } + ret = sysdb_store_user(sysdb, pr_ctx->dom, pwd->pw_name, NULL, pwd->pw_uid, pwd->pw_gid, pwd->pw_gecos, pwd->pw_dir, |