parameterize entra_idp url by ezrizhu · Pull Request #8491 · SSSD/sssd

ezrizhu · 2026-03-03T22:45:08Z

gemini-code-assist

Code Review

This pull request parameterizes the Entra IDP URL, allowing it to be configured instead of being hardcoded. However, the current implementation introduces significant security risks, including the use of unencrypted HTTP which can lead to sensitive bearer token leakage, and vulnerability to OData injection due to improper escaping of user-supplied input in filter constructions. Additionally, a critical type safety issue exists where a constant string is assigned to a non-constant pointer, potentially causing a crash. These issues should be addressed by enforcing HTTPS, implementing proper sanitization for OData filters, and safely duplicating strings to resolve the type safety problem.

src/oidc_child/oidc_child_id.c

gemini-code-assist · 2026-03-03T22:48:14Z

src/oidc_child/oidc_child_id.c

+        if (*base_url == '\0' || strncasecmp(base_url, "http", 4) != 0) {
+            DEBUG(SSSDBG_OP_FAILURE, "Colon supplied in %s but no url supplied.\n",
+                    idp_type);
+            return EINVAL;
+        }


The base_url override allows the use of unencrypted HTTP (e.g., entra_id:http://...). When an HTTP URL is provided, the bearer_token (a sensitive credential) is transmitted in cleartext over the network. For a cloud service like Entra ID (Microsoft Graph), there is rarely a legitimate reason to use plain HTTP, and allowing it exposes the system to credential theft via man-in-the-middle (MITM) attacks. The code should enforce the use of HTTPS for the base URL.

gemini-code-assist · 2026-03-03T22:48:14Z

src/oidc_child/oidc_child_id.c

    case GET_USER:
    case GET_USER_GROUPS:
-        uri = talloc_asprintf(rest_ctx, "https://graph.microsoft.com/v1.0/users?$filter=%s", filter_enc);
+        uri = talloc_asprintf(rest_ctx, "%s/users?$filter=%s", base_url, filter_enc);


The input variable, which contains user-supplied data (such as a username or group name), is used to construct OData filter strings (e.g., at lines 84, 87, 95, 102, 105) without any sanitization or escaping of single quotes. Although the resulting filter is later URL-encoded, the OData logic itself remains vulnerable. An attacker can provide a crafted input containing single quotes (e.g., user') or (1 eq 1) to break out of the filter's quoting and inject arbitrary OData expressions. This could allow an attacker to manipulate identity lookups, potentially leading to unauthorized access or privilege escalation if the system relies on the lookup results for authorization decisions.

alexey-tikhonov · 2026-03-04T15:45:59Z

Is this ready for review or do you plan to work more on this?

ezrizhu · 2026-03-04T15:51:09Z

pretty much ready besides some docs additions, pending CI fixes

pbrezina

Hi, would you mind refactoring the code a bit? The keycloak and entraid functions currently take idp_type parameter that was used only in keycloak to get the base url, the same you do in entraid_lookup now.

It would be nice if you could write a separate function to parse the idp_type into base_url, call this function from oidc_get_id and provide base_url as parameter to the lookup functions (NULL means use default value (entryid) or error out (keycloak)).

pbrezina · 2026-03-10T09:59:48Z

src/oidc_child/oidc_child_id.c

-                              "https://graph.microsoft.com/v1.0/users/%s/getMemberGroups",
-                              obj_id);
+        uri = talloc_asprintf(rest_ctx, "%s/users/%s/getMemberGroups",
+                                base_url, obj_id);


Wrong indentation.

alexey-tikhonov · 2026-03-25T09:35:11Z

@ezrizhu, just a heads up: sssd-2-3 upstream release is coming, so if you need those patches there, could you please address @pbrezina comments?

ezrizhu · 2026-03-25T12:34:01Z

Sounds good, will update PR shortly today or tomorrow.

src/oidc_child/oidc_child_id.c

alexey-tikhonov · 2026-03-26T08:53:05Z

Note: Covscan is green.

sumit-bose · 2026-03-26T16:23:06Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces the parse_base_url_from_idp_type function to extract and normalize base URLs from the idp_type string, enabling configurable API endpoints for Entra ID and Keycloak. The entra_id_lookup and keycloak_lookup functions were updated to utilize these dynamic base URLs. A critical issue was identified in the logic for stripping trailing slashes, which could incorrectly truncate URLs that only contain a scheme, such as "https://".

src/oidc_child/oidc_child_id.c

pbrezina

Hi, thank you for the changes.

Can you squash it into a single commit and adhere to our commit template: https://github.com/SSSD/sssd/blob/master/.git-commit-template

Maybe even adding a :feature: release note to it (explained in the commit template).

pbrezina · 2026-03-26T21:06:32Z

src/oidc_child/oidc_child_id.c

+        if (base_url == NULL) {
+            base_url = talloc_strdup(mem_ctx, "https://graph.microsoft.com/v1.0");
+            if (base_url == NULL) {
+                ret = ENOMEM;
+                goto done;
+            }
+        }


I'd move this to entra_id_lookup.

pbrezina

Hi, thank you. See one more minor thing inline.

Additionally, we need to rewrite the release note a little:

idp_type 
:feature: `idp_type` option allows entra_idp url to be specified if user is using a
  different microsoft entra endpoint.

Can you also update manual page saying it is not needed but possible? https://github.com/SSSD/sssd/blob/master/src/man/sssd-idp.5.xml#L62

Thank you.

pbrezina · 2026-03-30T13:03:10Z

src/oidc_child/oidc_child_id.c

+        if (base_url == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, "Missing base URL in IdP type [%s].\n",
+                                     idp_type);
+            ret = EINVAL;
+            goto done;
+        }


I missed this one previously, sorry. Can you move it to keycloak_lookup?

sumit-bose

Hi,

thank you, I have no further comments, ACK.

bye,
Sumit

ezrizhu · 2026-03-31T09:27:27Z

I'll push the manpage updates sometime today aswell

edit: done

sumit-bose · 2026-04-01T06:18:16Z

Hi,

thank you for updating the man page, looks good.

bye,
Sumit

pbrezina

Thank you for your changes. Ack.

ezrizhu · 2026-04-01T16:00:38Z

Thanks for the reviews, the one CI failure appears to be unrelated(?)

Please let me know if anything else is needed on my end.

Have a good rest of your weeks

Creates a function to extract the idp url from idp_type instead of using hardcoded entra url due to GCC High Entra instances using a different url. Resolves: SSSD#8446 idp_type :feature: `idp_type` option allows entra_idp url to be specified if user is using a different microsoft entra endpoint. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>

sssd-bot · 2026-04-02T06:54:34Z

The pull request was accepted by @sumit-bose with the following PR CI status:

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

sumit-bose · 2026-04-02T14:18:01Z

Thanks for the reviews, the one CI failure appears to be unrelated(?)

Please let me know if anything else is needed on my end.

Have a good rest of your weeks

Thank you, no further steps are needed.

Have a good rest of your week as well.

bye,
Sumit

gemini-code-assist bot reviewed Mar 3, 2026

View reviewed changes

ezrizhu force-pushed the master branch from 4b39052 to 301d844 Compare March 4, 2026 15:29

ezrizhu force-pushed the master branch from 301d844 to 6eff1c3 Compare March 4, 2026 15:56

ezrizhu marked this pull request as ready for review March 4, 2026 16:13

alexey-tikhonov added Waiting for review no-backport This should go to target branch only. labels Mar 5, 2026

alexey-tikhonov requested review from pbrezina and sumit-bose March 5, 2026 13:38

alexey-tikhonov assigned sumit-bose and pbrezina Mar 5, 2026

pbrezina requested changes Mar 10, 2026

View reviewed changes

alexey-tikhonov added Changes requested and removed Waiting for review labels Mar 25, 2026

ezrizhu force-pushed the master branch from 6eff1c3 to 8c80dee Compare March 25, 2026 22:11

ezrizhu requested a review from pbrezina March 26, 2026 03:25

alexey-tikhonov added Waiting for review and removed Changes requested labels Mar 26, 2026

github-advanced-security bot found potential problems Mar 26, 2026

View reviewed changes

src/oidc_child/oidc_child_id.c Fixed Show fixed Hide fixed

ezrizhu force-pushed the master branch from 8c80dee to 42067a9 Compare March 26, 2026 08:21

alexey-tikhonov added the coverity Trigger a coverity scan label Mar 26, 2026

alexey-tikhonov removed the coverity Trigger a coverity scan label Mar 26, 2026

gemini-code-assist bot reviewed Mar 26, 2026

View reviewed changes

src/oidc_child/oidc_child_id.c Show resolved Hide resolved

pbrezina requested changes Mar 26, 2026

View reviewed changes

ezrizhu force-pushed the master branch from 42067a9 to 50f888a Compare March 26, 2026 23:36

ezrizhu force-pushed the master branch from 50f888a to 1b730f5 Compare March 26, 2026 23:38

ezrizhu requested a review from pbrezina March 26, 2026 23:50

ezrizhu force-pushed the master branch from 1b730f5 to 08c318d Compare March 28, 2026 05:47

pbrezina requested changes Mar 30, 2026

View reviewed changes

ezrizhu force-pushed the master branch 2 times, most recently from af4f7d6 to a12ebb0 Compare March 31, 2026 04:32

ezrizhu requested a review from pbrezina March 31, 2026 04:54

sumit-bose approved these changes Mar 31, 2026

View reviewed changes

ezrizhu force-pushed the master branch from a12ebb0 to 3c10e9d Compare March 31, 2026 16:56

pbrezina approved these changes Apr 1, 2026

View reviewed changes

sumit-bose added Accepted and removed Waiting for review labels Apr 2, 2026

sssd-bot force-pushed the master branch from 3c10e9d to 28d1d43 Compare April 2, 2026 06:54

sumit-bose merged commit 3bd74d9 into SSSD:master Apr 2, 2026
17 checks passed

Conversation

ezrizhu commented Mar 3, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov commented Mar 4, 2026

Uh oh!

ezrizhu commented Mar 4, 2026

Uh oh!

pbrezina left a comment

Choose a reason for hiding this comment

Uh oh!

pbrezina Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov commented Mar 25, 2026

Uh oh!

ezrizhu commented Mar 25, 2026

Uh oh!

Uh oh!

alexey-tikhonov commented Mar 26, 2026

Uh oh!

sumit-bose commented Mar 26, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

pbrezina left a comment

Choose a reason for hiding this comment

Uh oh!

pbrezina Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ezrizhu Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

pbrezina left a comment

Choose a reason for hiding this comment

Uh oh!

pbrezina Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

ezrizhu Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

sumit-bose left a comment

Choose a reason for hiding this comment

Uh oh!

ezrizhu commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sumit-bose commented Apr 1, 2026

Uh oh!

pbrezina left a comment

Choose a reason for hiding this comment

Uh oh!

ezrizhu commented Apr 1, 2026

Uh oh!

sssd-bot commented Apr 2, 2026

Uh oh!

Uh oh!

sumit-bose commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

pbrezina Mar 26, 2026 •

edited

Loading

ezrizhu commented Mar 31, 2026 •

edited

Loading