[sssd-bot]

This is an automatic backport of PR#9408 certmap: check that SID exists in certificate to branch sssd-2-13, created by @thalman.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr9408-to-sssd-2-13
git checkout SSSD-sssd-backport-pr9408-to-sssd-2-13
git push sssd-bot SSSD-sssd-backport-pr9408-to-sssd-2-13 --force

---

Original commits
db521e9 - certmap: check that SID exists in certificate

Backported commits

• 88254d5 - certmap: check that SID exists in certificate

---

Original Pull Request Body

We have to check that SID is not NULL before using it in mapping rule.

:fixes: CVE-2026-104038

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🔴 Build / freebsd (failure)
🟢 Build / make-distcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🔴 ci / intgcheck (fedora-44) (failure)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-44) (success)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / files-changed (success)
🟢 Static code analysis / pre-commit (success)
➖ Static code analysis / python-system-tests (skipped)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.