Allow UID to be returned by the mapper script.

mod_ood_proxy/lib/ood/user_map.lua

@@ -17,6 +17,12 @@ function map(r, user_map_match, user_map_cmd, remote_user)
     handle:close()
   end
 
+  -- if sys_user is a number, then it's the uid, so convert to username
+  if tonumber(sys_user) then
+    local pwd = require "posix.pwd"
+    sys_user = pwd.getpwuid(tonumber(sys_user)).pw_name
+  end
+
   time_user_map = (r:clock() - now)/1000.0
   r:debug("Mapped '" .. remote_user .. "' => '" .. (sys_user or "") .. "' [" .. time_user_map .. " ms]")
 
@@ -25,6 +31,7 @@ function map(r, user_map_match, user_map_cmd, remote_user)
     return nil
   end
 
+
   r.subprocess_env['MAPPED_USER'] = sys_user -- set as CGI variable for later hooks (i.e., analytics)
   r.subprocess_env['OOD_TIME_USER_MAP'] = time_user_map -- set as CGI variable for later hooks (i.e., analytics)
   return sys_user

nginx_stage/lib/nginx_stage/user.rb

@@ -33,21 +33,32 @@ class User
     # @param user [String] the user name defining this object
     # @raise [ArgumentError] if user or primary group doesn't exist on local system
     def initialize(user)
-      @passwd = Etc.getpwnam user.to_s
-      @group = Etc.getgrgid gid
-      @groups = get_groups
-
-      if name.to_s != user.to_s
-        err_msg = <<~HEREDOC
-          Username '#{user}' is being mapped to '#{name}' in SSSD and they don't match.
-          Users with domain names cannot be mapped correctly. If '#{name}' still has the
-          domain in it you'll need to set SSSD's full_name_format to '%1$s'.
+      # "123user".to_i.to_s (123) != "123user".to_s
+      # "user123".to_i.to_s (0) != "user123".to_s
+      # "user".to_i.to_s (0) != "user".to_s
+      # "123".to_i.to_s (123) == "123".to_s
+      if user.to_i.to_s == user.to_s
+        # The user is composed of all numbers, (numeric string), test if it is a uid
+        @passwd = Etc.getpwuid(user.to_i) rescue nil
+      end
 
-          See https://github.com/OSC/ondemand/issues/1759 for more details.
-        HEREDOC
+      # Variable is not set, so the user is a string
+      if not @passwd
+        @passwd = Etc.getpwnam(user)
+        if name.to_s != user.to_s
+          err_msg = <<~HEREDOC
+            Username '#{user}' is being mapped to '#{name}' in SSSD and they don't match.
+            Users with domain names cannot be mapped correctly. If '#{name}' still has the
+            domain in it you'll need to set SSSD's full_name_format to '%1$s'.
+
+            See https://github.com/OSC/ondemand/issues/1759 for more details.
+          HEREDOC
 
-        raise StandardError, err_msg
+          raise StandardError, err_msg
+        end
       end
+      @group = Etc.getgrgid gid
+      @groups = get_groups
     end
 
     # User's primary group name
@@ -79,7 +90,12 @@ def to_str
       # Use `id` to get list of groups as the /etc/group file can give
       # erroneous results
       def get_groups
-        `id -nG #{name}`.split(' ')
+        # Group names can contain spaces, prevent "domain users" people from being added to the "users" group
+        # We retrieve IDs and convert to names
+        `id -G #{name}`.split(' ').map(&:to_i).map do |gid|
+            # Rescue: sometimes GID are added to user but don't "actually" exist (rare)
+            Etc.getgrgid(gid).name rescue gid
+        end
       end
   end
 end