Description of problem:
If short username resolution is enabled in the config file for a trusted
domain:
[domain/main_domain/trusted_domain]
use_fully_qualified_names = False
then sssd always returns a shortname. But, the shortname, when used as an
input, always routes into the main_domain. This leads to a schizophrenic
situation, where login through some PAM applications like su first runs
getpwnam, receives the UID and primary GID of the user from trusted domain, but
the rest of the PAM conversation, including checking the credentials is done
against the parent domain.
Version-Release number of selected component (if applicable):
sssd-1.15.2-29.el7
How reproducible:
always
Steps to Reproduce:
1. join sssd to an AD forest with multiple domains
2. configure one of the trusted domains to use shortnames only
3. run:
"su - user@trusted_domain"
4. enter credentials of user@main_domain
Actual results:
you're logged in
Expected results:
you should be denied access
Additional info: