[Bug 1728310] Re: libnfsidmap2 fails to obtain username which results in failed translation

[Andreas Hasenack]

*** This bug is a duplicate of bug 1819197 ***
    https://bugs.launchpad.net/bugs/1819197

I'm concentrating the discussion in bug #1819197

** This bug has been marked a duplicate of bug 1819197
   nss_getpwnam: name 'userX at xx.xx.edu@XX.XX.EDU' domain 'XX.XX.EDU': resulting localname '(null)'

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to libnfsidmap in Ubuntu.
https://bugs.launchpad.net/bugs/1728310

Title:
  libnfsidmap2 fails to obtain username which results in failed
  translation

Status in libnfsidmap package in Ubuntu:
  Confirmed
Status in libnfsidmap package in Debian:
  New

Bug description:
  [Impact]

  * In a multi-domain environment setup with LDAP or IPA, the username
  is not parsed correctly, resulting in id mapping issues.

  * As a result, NFSv4 cannot be used in a multi-domain environment at
  all if the username is of the form
  user at authentication_domain@idmap_domain

  * The attached patch fixes an almost 10 year old bug in the
  libnfsidmap library. The patch is included already in a similar form
  in current RHEL releases.

  * Affects at least libnfsidmap2 0.25-5 on Ubuntu 16.04, 16.10, 17.04,
  17.10.

  [Test Case]

  * IPA with 2 different user domains. For example: user1 at domain1 and
  user2 at domain2.

  * NFSv4 server enrolled into IPA.

  * NFS client enrolled into IPA. User and group names coming from IPA
  have an '@' in them.

  [Regression Potential]

  * The attached patch has been in production in a major organisation
  with more than 500 Ubuntu clients for more than a year now and has not
  shown any issues.

  [Other Info]

  Environment: IPA + NFSv4 (sec=krb5)

  nss.c uses wrong '@' sign to detect the NFS domain resulting in
  "nobody" ownerships and the following error messages in an IPA
  environment:

  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: key: 0x2c254c26 type: uid value: rns at localdomain@ipa.localdomain timeout 600
  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: calling nsswitch->name_to_uid
  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns at localdomain@ipa.localdomain' domain 'ipa.localdomain': resulting localname '(null)'
  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns at localdomain@ipa.localdomain' does not map into domain 'ipa.localdomain'
  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: nsswitch->name_to_uid returned -22
  Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: final return value is -22

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libnfsidmap/+bug/1728310/+subscriptions