[rpms/freeipa] f45: Fix cross-forest trust identity confusion

[rpms/freeipa] f45: Fix cross-forest trust identity confusion

[Alexander Bokovoy]

            A new commit has been pushed.

            Repo   : rpms/freeipa
            Branch : f45
            Commit : cc488a0f42bfff6c9813a4bc8a0794371c099620
            Author : Alexander Bokovoy <abokovoy@redhat.com>
            Date   : 2026-09-07T14:20:27+03:00
            Stats  : +66/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/freeipa/c/cc488a0f42bfff6c9813a4bc8a0794371c099620?branch=f45

            Log:
            Fix cross-forest trust identity confusion

Upstream PR: https://github.com/freeipa/freeipa/pull/8557

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>

---
diff --git a/freeipa-pr-8557.patch b/freeipa-pr-8557.patch
new file mode 100644
index 0000000..a3208d5
--- /dev/null
+++ b/freeipa-pr-8557.patch
@@ -0,0 +1,60 @@
+From 483ec603a06d284fd52ea27830ea412bb379165d Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 7 Sep 2026 11:16:09 +0200
+Subject: [PATCH 1/2] kdb: use "ipaOriginalUid" attr consistantly in PAC trust
+ check
+
+a9e3fe97336ff942ea21af13a8b8d9adf2a89d37 added a process to cross-check
+AD client principal names against ID override based on SID. But it used
+the POSIX "uid" attribute instead of the "ipaOriginalUid" one.
+
+f80e9667f6f6d426cfcdb287c3392e71fbd3e14c intended to fix this problem,
+but only changed the attribute name to be extrated from the fetched ID
+override LDAP entry, not the searched attribute, which results in a
+systematic failure for AD users.
+
+The present commit uses "ipaOriginalUid" for both LDAP search and entry
+attribute queries.
+
+Signed-off-by: Julien Rische <jrische@redhat.com>
+---
+ daemons/ipa-kdb/ipa_kdb.h             | 1 +
+ daemons/ipa-kdb/ipa_kdb_mspac_trust.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/daemons/ipa-kdb/ipa_kdb.h b/daemons/ipa-kdb/ipa_kdb.h
+index cbac54fecc9..1c6647b7d25 100644
+--- a/daemons/ipa-kdb/ipa_kdb.h
++++ b/daemons/ipa-kdb/ipa_kdb.h
+@@ -93,6 +93,7 @@
+ 
+ #define IPA_KRB_AUTHZ_DATA_ATTR "ipaKrbAuthzData"
+ #define IPA_USER_AUTH_TYPE "ipaUserAuthType"
++#define IPA_ORIGINAL_UID_ATTR "ipaOriginalUid"
+ 
+ /* Virtual managed ticket flags like "-allow_tix", are always controlled by the
+  * "nsAccountLock" attribute, such flags should never be set in the database.
+diff --git a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
+index a09dc2dfbda..32dca0edbaf 100644
+--- a/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
++++ b/daemons/ipa-kdb/ipa_kdb_mspac_trust.c
+@@ -417,7 +417,8 @@ ipadb_check_trust_view_override(krb5_context context,
+ {
+     struct ipadb_context *ipactx = NULL;
+     krb5_error_code kerr = EINVAL;
+-    char *basedn = NULL, *filter = NULL, *attrs[] = {"uid", NULL};
++    char *basedn = NULL, *filter = NULL;
++    char *attrs[] = {IPA_ORIGINAL_UID_ATTR, NULL};
+     LDAPMessage *res = NULL, *entry = NULL;
+     struct berval **uid_values = NULL;
+     char *ticket_cname = NULL;
+@@ -478,7 +479,8 @@ ipadb_check_trust_view_override(krb5_context context,
+         goto end;
+     }
+ 
+-    uid_values = ldap_get_values_len(ipactx->lcontext, entry, "ipaOriginalUid");
++    uid_values = ldap_get_values_len(ipactx->lcontext, entry,
++                                     IPA_ORIGINAL_UID_ATTR);
+     if (!uid_values || !uid_values[0]) {
+         *status = "TRUST_OVERRIDE_UID_UNDEFINED";
+         kerr = EINVAL;

diff --git a/freeipa.spec b/freeipa.spec
index 4aa7b75..8eb23f9 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -211,7 +211,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        1%{?rc_version:.%rc_version}%{?dist}
+Release:        1.1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
@@ -235,6 +235,8 @@ Source2:        gpgkey-B40A78FBA576C4A3FC7D7BBC359FAF777296F653.asc
 %endif
 
 Patch0:         freeipa-version-upgrade-fedora-only.patch
+Patch1:         freeipa-pr-8557.patch
+
 # RHEL spec file only: START: Change branding to IPA and Identity Management
 # Moved branding logos and background to redhat-logos-ipa-80.4:
 # header-logo.png, login-screen-background.jpg, login-screen-logo.png,
@@ -1971,6 +1973,9 @@ fi
 %endif
 
 %changelog
+* Mon Sep 07 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.4-1.1
+- Fix cross-forest trust identity confusion protection (upstream PR 8557)
+
 * Mon Sep 07 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.4-1
 - FreeIPA 4.13.4
 - Resolves: CVE-2026-79678, CVE-2026-76578