Lennart Poettering
0322fe3220
This PR fixes userdb lookups for NSS users that are resolved through an alias but returned with a canonical user name. Some NSS providers, such as SSSD, can successfully resolve a user by an alias-like name, for example a Kerberos/AD UPN (for example testuser@example.test) while returning a passwd record with the canonical login name. The original lookup name was not preserved. Later, the userdb worker checked whether the returned record matched the requested name with user_record_matches_user_name(). Since the requested name was testuser@example.test, but the record only contained testuser, the lookup was rejected as: `io.systemd.UserDatabase.ConflictingRecordFound` This also caused pam_systemd to fail opening sessions for such users with: `pam_systemd(...:session): Failed to get user record` In my case, this broke graphical logins for Samba users logging in with a UPN on systems where SSSD canonicalizes the NSS result. My solution preserves the requested name as a UserRecord alias when an NSS lookup by name succeeds but the returned pw_name differs from the requested name. This allows user_record_matches_user_name() to accept the canonicalized NSS result instead of treating it as a conflicting record. The patch does not invent new aliases. It only records the name that NSS itself already accepted and resolved successfully. I'm not an expert on working with systemd, so I'm asking for a review of my PR.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release