From 9dc57ef77e276773b91c567f83498a69d382ba13 Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Mon, 26 Feb 2024 14:05:31 +0100 Subject: [PATCH] idviews: Use ipaAnchorUUID without DCERPC bindings for SID anchors SID anchors are only resolvable on servers with DCERPC bindings installed. On non agent replica these bindings are not installed and therefore group and role management if there are AD user idoverride members. If there is an ipaUserOverride for the anchor, the ipaoriginaluid is returned. Fixes: https://pagure.io/freeipa/issue/9544 Signed-off-by: Thomas Woerner Reviewed-By: Alexander Bokovoy --- ipaserver/plugins/idviews.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/ipaserver/plugins/idviews.py b/ipaserver/plugins/idviews.py index ee05ba162..a9a7eed5c 100644 --- a/ipaserver/plugins/idviews.py +++ b/ipaserver/plugins/idviews.py @@ -694,6 +694,20 @@ def resolve_anchor_to_object_name(ldap, obj_type, anchor): if type_correct: return name + else: + # Without the DCERPC bindings the sid is not resolvable, return + # ipaAnchorUUID + _dn = DN(("cn", api.packages[0].idviews.DEFAULT_TRUST_VIEW_NAME), + api.env.container_views + api.env.basedn) + try: + entry = ldap.find_entry_by_attr(attr="ipaanchoruuid", + value=anchor, + object_class="ipaUserOverride", + attrs_list=["ipaoriginaluid"], + base_dn=_dn) + return entry.single_value("ipaoriginaluid") + except (errors.EmptyResult, errors.NotFound): + pass # No acceptable object was found raise errors.NotFound(