From c3d6cc9a374bd2d31af9ee35fda8c054fcab7c86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
Date: Wed, 8 Mar 2023 14:28:54 +0100
Subject: [PATCH] AD: Do not use the shortcut when filter_groups is set.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When using 'id <user>', a shortcut avoids creating the proper group
object but, instead, one where the SID is the group name is created.
This prevents a proper filtering of groups which requires the actual
group name.

Not using the shortcut will retrieve the group names and the filtering
will work.

Resolves: https://github.com/SSSD/sssd/issues/6617

Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>

Reference:https://github.com/SSSD/sssd/commit/c3d6cc9a374bd2d31af9ee35fda8c054fcab7c86
Conflict:NA

---
 src/providers/ldap/sdap_async_initgroups_ad.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/providers/ldap/sdap_async_initgroups_ad.c b/src/providers/ldap/sdap_async_initgroups_ad.c
index d76b7c8b8..f5c88e2fb 100644
--- a/src/providers/ldap/sdap_async_initgroups_ad.c
+++ b/src/providers/ldap/sdap_async_initgroups_ad.c
@@ -1591,6 +1591,8 @@ sdap_ad_tokengroups_initgroups_send(TALLOC_CTX *mem_ctx,
     struct tevent_req *req = NULL;
     struct tevent_req *subreq = NULL;
     errno_t ret;
+    bool use_shortcut;
+    char **param = NULL;
 
     req = tevent_req_create(mem_ctx, &state,
                             struct sdap_ad_tokengroups_initgroups_state);
@@ -1611,9 +1613,22 @@ sdap_ad_tokengroups_initgroups_send(TALLOC_CTX *mem_ctx,
      * to avoid having to transfer and retain members when the fake
      * tokengroups object without name is replaced by the full group object
      */
+    use_shortcut = false;
     if (state->use_id_mapping
             && !IS_SUBDOMAIN(state->domain)
-            && state->domain->ignore_group_members == false) {
+            && !state->domain->ignore_group_members) {
+        ret = confdb_get_param(id_ctx->be->cdb, mem_ctx, id_ctx->be->conf_path,
+                               CONFDB_NSS_FILTER_GROUPS, &param);
+        if (ret == EOK) {
+            use_shortcut = (param == NULL || param[0] == NULL);
+            talloc_free(param);
+        } else {
+            DEBUG(SSSDBG_MINOR_FAILURE, "Failed to access %s: %i (%s)\n",
+                  CONFDB_NSS_FILTER_GROUPS, ret, sss_strerror(ret));
+            /* Continue without using the shortcut. Safest option. */
+        }
+    }
+    if (use_shortcut) {
         subreq = sdap_ad_tokengroups_initgr_mapping_send(state, ev, opts,
                                                          sysdb, domain, sh,
                                                          name, orig_dn,
-- 
2.33.0

