URL: https://github.com/SSSD/sssd/pull/309 Author: jhrozek Title: #309: HBAC: Do not rely on originalMemberOf, use the sysdb memberof links instead (sssd-1-13 backprot) Action: opened PR body: """ This is a backport of the same fix we merged earlier. The IPA HBAC code used to read the group members from the originalMemberOf attribute value for performance reasons. However, especially on IPA clients trusting an AD domain, the originalMemberOf attribute value is often not synchronized correctly. Instead of going through the work of maintaining both member/memberOf and originalMemberOf, let's just do an ASQ search for the group names of the groups the user is a member of in the cache and read their SYSBD_NAME attribute. To avoid clashing between similarly-named groups in IPA and in AD, we look at the container of the group. Resolves: https://pagure.io/SSSD/sssd/issue/3382 (cherry picked from commit c92e49144978ad3b6c9fffa8803ebdad8f6f5b18) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/309/head:pr309 git checkout pr309