URL: https://github.com/SSSD/sssd/pull/239 Author: jhrozek Title: #239: HBAC: Use memberof ASQ search instead of originalMemberOf Action: opened PR body: """ This PR should fix the bug we were seeing in the HBAC evaluation of users from a trusted AD domain where the originalMemberOf didn't match the memberOf attributes. Because maintaining the originalMemberOf attributes is fragile, let's instead dereference the memberOf attribute and look at the names of the groups this way. To make sure we only consider IPA groups and not groups from trusted domains, we construct a base DN of the IPA domain sysdb group container and pop the RDN from the DN of the object examined and compare the two. If other developers think it's too much of a hack, we can just search the IPA domain with a BASE search and the group DN. A BASE search is just a direct lookup on the LDB level, so it wouldn't be too slow either. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/239/head:pr239 git checkout pr239