Skip to content

[autobackport: sssd-2-9] SUBID: add LDAP provider support#8253

Merged
alexey-tikhonov merged 12 commits into
SSSD:sssd-2-9from
sssd-bot:SSSD-sssd-backport-pr8097-to-sssd-2-9
Dec 2, 2025
Merged

[autobackport: sssd-2-9] SUBID: add LDAP provider support#8253
alexey-tikhonov merged 12 commits into
SSSD:sssd-2-9from
sssd-bot:SSSD-sssd-backport-pr8097-to-sssd-2-9

Conversation

@sssd-bot

@sssd-bot sssd-bot commented Dec 2, 2025

Copy link
Copy Markdown
Contributor

This is an automatic backport of PR#8097 SUBID: add LDAP provider support to branch sssd-2-9, created by @alexey-tikhonov.

Caution

@alexey-tikhonov The patches did not apply cleanly. It is necessary to resolve conflicts before merging this pull request. Commits that introduced conflict are marked with CONFLICT!.

You can push changes to this pull request

git remote add sssd-bot [email protected]:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8097-to-sssd-2-9
git checkout SSSD-sssd-backport-pr8097-to-sssd-2-9
git push sssd-bot SSSD-sssd-backport-pr8097-to-sssd-2-9 --force

Original commits
1d488d5 - CONTRIB:fedconfig: enable '--with-subid'
fcbf23d - MAN: fix missing with_subid condition
6fcf7c3 - SUBID:IPA: correct OC
9901ed3 - SUBID: deprecate ipa_subid_ranges_search_base
ae98d8e - LDAP: add subid ranges support
7a51650 - SUBID: don't require search bases to be set in advance
9014ced - man: document subid LDAP attributes
0edeb89 - DEBUG: lower debug level of several messages
79028ef - SUBID: resolve owner DN instead of guessing
f255e37 - SUBID: sanitize range owner dn
95994dd - SUBID: trusted subdomains aren't currently supported

Backported commits

  • 6ba9060 - CONFLICT! CONTRIB:fedconfig: enable '--with-subid'
  • 2f4ffb1 - CONFLICT! MAN: fix missing with_subid condition
  • 89bed84 - SUBID:IPA: correct OC
  • 2ed3ce9 - CONFLICT! SUBID: deprecate ipa_subid_ranges_search_base
  • a97ef8a - LDAP: add subid ranges support
  • dd16ab5 - SUBID: don't require search bases to be set in advance
  • 11042d1 - man: document subid LDAP attributes
  • 4ef292a - DEBUG: lower debug level of several messages
  • 209246e - SUBID: resolve owner DN instead of guessing
  • 2a3ea19 - SUBID: sanitize range owner dn
  • a4e7138 - SUBID: trusted subdomains aren't currently supported

Conflicting Files Information (check for deleted and re-added files)

  • CONFLICT! CONTRIB:fedconfig: enable '--with-subid'
On branch SSSD-sssd-backport-pr8097-to-sssd-2-9
You are currently cherry-picking commit 1d488d53c.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   contrib/fedora/bashrc_sssd

no changes added to commit (use "git add" and/or "git commit -a")```* CONFLICT! MAN: fix missing `with_subid` condition

On branch SSSD-sssd-backport-pr8097-to-sssd-2-9
You are currently cherry-picking commit fcbf23d.
(fix conflicts and run "git cherry-pick --continue")
(use "git cherry-pick --skip" to skip this patch)
(use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
(use "git add ..." to mark resolution)
both modified: src/man/Makefile.am

no changes added to commit (use "git add" and/or "git commit -a")```* CONFLICT! SUBID: deprecate ipa_subid_ranges_search_base

On branch SSSD-sssd-backport-pr8097-to-sssd-2-9
You are currently cherry-picking commit 9901ed36c.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   src/config/SSSDConfig/sssdoptions.py
	modified:   src/config/cfg_rules.ini
	modified:   src/config/etc/sssd.api.d/sssd-ldap.conf
	modified:   src/man/sssd-ipa.5.xml
	modified:   src/man/sssd-ldap.5.xml
	modified:   src/providers/ipa/ipa_common.c
	modified:   src/providers/ipa/ipa_common.h
	modified:   src/providers/ldap/ldap_options.c

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   src/providers/ad/ad_opts.c
	both modified:   src/providers/ipa/ipa_opts.c
	both modified:   src/providers/ldap/ldap_opts.c
	both modified:   src/providers/ldap/sdap.h```

---

**Original Pull Request Body**

Resolves: https://github.com/SSSD/sssd/issues/8030

Most patches could be squashed, but I kept them separate to make review easier.

@alexey-tikhonov
alexey-tikhonov force-pushed the SSSD-sssd-backport-pr8097-to-sssd-2-9 branch from a4e7138 to 08e5369 Compare December 2, 2025 11:01
@alexey-tikhonov
alexey-tikhonov marked this pull request as ready for review December 2, 2025 12:35
@alexey-tikhonov

alexey-tikhonov commented Dec 2, 2025

Copy link
Copy Markdown
Member

FAILED tests/test_access_control_simple.py::test_access_control_simple__permits_user_login_based_on_group (samba) is a known issue not introduced by this PR.

sumit-bose
sumit-bose approved these changes Dec 2, 2025
View reviewed changes

@sumit-bose sumit-bose left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,

thank you for the fixes. I verified that resolution of the conflicts corresponds to the original patches, ACK.

bye,
Sumit

@alexey-tikhonov
alexey-tikhonov removed the request for review from justin-stephenson December 2, 2025 17:29
@alexey-tikhonov alexey-tikhonov added no-backport This should go to target branch only. Accepted labels Dec 2, 2025
@alexey-tikhonov @sssd-bot
CONTRIB:fedconfig: enable '--with-subid'
88836a5 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 1d488d5)
@alexey-tikhonov @sssd-bot
MAN: fix missing with_subid condition
e5a8190 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit fcbf23d)
@alexey-tikhonov @sssd-bot
SUBID:IPA: correct OC
1dc0cc6 
Proper STRUCTURAL objectClass is 'ipaSubordinateIdEntry'.

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 6fcf7c3)
@alexey-tikhonov @sssd-bot
SUBID: deprecate ipa_subid_ranges_search_base
ae367fe 
in favor of `ldap_subid_ranges_search_base`.

:config:Option `ipa_subid_ranges_search_base` was deprecated in favor
of `ldap_subid_ranges_search_base`.

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 9901ed3)
@alexey-tikhonov @sssd-bot
LDAP: add subid ranges support
f8b9169 
Resolves: SSSD#8030
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit ae98d8e)
@alexey-tikhonov @sssd-bot
SUBID: don't require search bases to be set in advance
e1feca1 
It can be read from rootDSE upon first connection.

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 7a51650)
@alexey-tikhonov @sssd-bot
man: document subid LDAP attributes
80e9c6e 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 9014ced)
@alexey-tikhonov @sssd-bot
DEBUG: lower debug level of several messages
764c4a3 
related to attributes presence/manipulation.

Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 0edeb89)
@alexey-tikhonov @sssd-bot
SUBID: resolve owner DN instead of guessing
a3c7da2 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 79028ef)
@alexey-tikhonov @sssd-bot
SUBID: sanitize range owner dn
5294c47 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit f255e37)
@alexey-tikhonov @sssd-bot
SUBID: trusted subdomains aren't currently supported
a3a61f2 
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Sumit Bose <[email protected]>
(cherry picked from commit 95994dd)
@alexey-tikhonov @sssd-bot
Add 'libsubid-dev' to deps list on Debian
c1340fc 
Reviewed-by: Sumit Bose <[email protected]>
@sssd-bot

sssd-bot commented Dec 2, 2025

Copy link
Copy Markdown
Contributor Author

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-9-x86_64:upstream (success)
🟢 Analyze (target) / cppcheck (success)
🟢 Build / make-distcheck (success)
🟢 ci / prepare (success)
🟡 ci / system (centos-9) (in_progress)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

@sssd-bot
sssd-bot force-pushed the SSSD-sssd-backport-pr8097-to-sssd-2-9 branch from 080c29d to c1340fc Compare December 2, 2025 17:30
@alexey-tikhonov
alexey-tikhonov merged commit 8fa2233 into SSSD:sssd-2-9 Dec 2, 2025
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sumit-bose sumit-bose sumit-bose approved these changes

Assignees

@sumit-bose sumit-bose

Labels

Accepted no-backport This should go to target branch only.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sssd-bot @alexey-tikhonov @sumit-bose @justin-stephenson