[SSSD] [PATCH] refactor nested group processing

Pavel Březina pbrezina at redhat.com
Mon Mar 25 13:48:44 UTC 2013


On 03/22/2013 10:59 PM, Lukas Slebodnik wrote:
> On (21/03/13 16:10), Pavel Březina wrote:
>> On 03/21/2013 03:43 PM, Lukas Slebodnik wrote:
>>> On (22/02/13 13:46), Pavel Brezina wrote:
>>>> ----- Original Message -----
>>>>> From: "Pavel Březina" <pbrezina at redhat.com>
>>>>> To: sssd-devel at lists.fedorahosted.org
>>>>> Sent: Thursday, February 21, 2013 11:43:26 AM
>>>>> Subject: [SSSD] [PATCH] refactor nested group processing
>>>>>
>>>>> https://fedorahosted.org/sssd/ticket/1784
>>>>
>>>> I should have probably add that this is the final version. I will attach unit test once I get familiar with cmocka, but it does not really prevent reviewing the patch.
>>>
>>> I would like to test your patches, but the second patch no longer applies
>>> on the current master. Could you resend rebased patches?
>>
>> Thanks. Rebased patches are attached. I did not test it again though,
>> but it compiles fine and the diff looks all right. It may be
>> interesting to determine what patch broke it.
>>
>
> I had problems with you patches.
> The simplest cycle schema:
>     ________
>     |  CG1 |------------>sssduser1
>     |______|<---|
>        |        |
>        |        |
>        |     ________
>        |---->|  CG2 |--->sssduser2
>              |______|
>
> sssd client configured with ipa-client-install and two additional options
> entry_cache_timeout = 5
> memcache_timeout = 1
>
> How to reproduce.
> 1. remove cache(also logs, but it is not important)
> 2. service sssd start
> 3. run commands
>
> sh-4.2$ getent group cyclegroup1
> cyclegroup1:*:30007:sssduser1,sssduser2
> sh-4.2$ getent group cyclegroup2
> cyclegroup2:*:30008:sssduser2
>   #after second (memcache_timeout)
> sh-4.2$ getent group cyclegroup2
> cyclegroup2:*:30008:sssduser2,sssduser1
>
> -----------------------------
>
> Also sometimes with the same groups scheme one user appeared two times,
> but I could not exactly reproduce steps.

The problem is even in master. Seems to be another ghost users issue.

>
> If you could not reproduce problem, I could send you off the list
> logs, cache, any configurations, rpms or even provide access to IPA server.
>
> And last notice, commit 4709ff46db0dbe073aef061b796d2fd7adeaf18f
> with title "LDAP: If deref search fails, try again without deref"
> cause little problem with applying patches.
>
> LS

I amended my patches to keep the functionality introduced in this
commit. I.e. if deref fails with ENOTSUP, we will try again without
dereference.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-refactor-nested-group-processing-add-new-code.patch
Type: text/x-patch
Size: 69898 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130325/27165bc7/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-refactor-nested-group-processing-replace-old-code.patch
Type: text/x-patch
Size: 61387 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130325/27165bc7/attachment-0001.bin>


More information about the sssd-devel mailing list