From e9c4dcdb8532297f4247b930f74a8d2e00db43d9 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Mon, 17 Jun 2019 17:59:38 +0200 Subject: [PATCH] stageuser-find: fix search with non-posix user ipa stageuser-find fails to return a staged user if it does not contain the posixaccount objectclass. The code is replacing the search filter (objectclass=posixaccount) with (|(objectclass=posixaccount)(objectclass=inetorgperson)) so it should work in theory. The issue is that on python2 the filter has been hexlified before reaching the stageuser plugin, hence filter.replace does not recognize the pattern (objectclass=posixaccount). The fix consists in creating the filter with a call to ldap.make_filter_from_attr() that will hexlify too, if needed. Fixes: https://pagure.io/freeipa/issue/7983 Reviewed-By: Rob Crittenden --- ipaserver/plugins/stageuser.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipaserver/plugins/stageuser.py b/ipaserver/plugins/stageuser.py index f417df57b..743435523 100644 --- a/ipaserver/plugins/stageuser.py +++ b/ipaserver/plugins/stageuser.py @@ -451,7 +451,8 @@ class stageuser_find(baseuser_find): self.pre_common_callback(ldap, filter, attrs_list, base_dn, scope, *keys, **options) - container_filter = "(objectclass=posixaccount)" + container_filter = ldap.make_filter_from_attr( + 'objectclass', 'posixaccount') # provisioning system can create non posixaccount stage user # but then they have to create inetOrgPerson stage user stagefilter = filter.replace(container_filter,