freeipa

#8566 Subordinate suffixes aren't treated as subordinate in trust to Active Directory (crash part)
Closed: fixed by rcritten. Opened by abbra.

Closed: fixed
Reopen Issue

When we retrieve trust topology from a trusted Active Directory forest root, UPN suffixes are compacted by AD DC into a list of top level names (TLNs) in a such way that only the most superior one is left in the topology list.

E.g. for UPN suffixes ad.test, temporary.ad.test, some.ad.test, trust topology will advertise only ad.test. The advertised TLN must be considered a superior to any UPN suffix ending with with and thus any principal that use subordinate suffix would need to be routed to a domain associated with that TLN.

This logic has been fixed in FreeIPA with commit 8b6d1ab854387840f7526d6d59ddc7102231957f but the patchset contained a bug where a domain with associated UPN suffixes may crash a KDC if the number of UPN suffixes is greater than a total number of trusted domains known to FreeIPA.

PR: https://github.com/freeipa/freeipa/pull/5232

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5232
- Issue assigned to abbra

master:

  • 81cbee4e3ff2e667946e0d41097b402257608b7e ipa-kdb: fix crash in MS-PAC cache init code

ipa-4-8:

  • 1648576fb9d5dfcfdcb9b2a0cb830e214285e208 ipa-kdb: fix crash in MS-PAC cache init code

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/5232
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.