Authentication Bypass Vulnerability in SSSD IdP Provider

A vulnerability exists within the System Security Services Daemon (SSSD) IdP authentication provider, specifically located in the eval_access_token_buf() function. The flaw stems from an improper implementation of identifier validation using strncmp(). Instead of performing an exact string comparison between the OIDC subject identifier and the authenticated user's identifier, the function performs a prefix comparison.

This logic error enables an attacker to gain unauthorized access to an account if their own IdP identifier matches the initial characters of a target user's identifier. For example, an attacker with an identifier of "user" could potentially authenticate as "username". This issue poses a significant risk to organizations relying on SSSD for federated authentication, as it effectively allows for identity spoofing without requiring knowledge of a password or secondary factors, provided the attacker can control or influence their own identifier within the configured IdP.