On Wed, Apr 11, 2012 at 09:24:40PM -0400, Scott Seago wrote:
On 03/30/2012 09:50 AM, Scott Seago wrote:
>Rather than paste in the entire text, I'm just linking to the wiki
>writeup. Please read the whole thing first and if you want to
>comment on anything specific, quote it and comment on this thread.
Another couple rounds of revisions after discussion with Simo in
#ipa. The doc is updated -- a brief summary of the changes follows
Essentially we're dropping the notion of keeping the LDAP group
membership lists in sync with a cached copy in our database. Instead,
we'll pull a list of a user's LDAP groups at login (along with
membership in any local non-LDAP groups) and store these in a list of
ActiveMembership objects, each of which will track (User, Group,
Session). For each permission check we'll add the ActiveMembership
association into the existing permission query joins to pull in
permission grants to groups that the user belongs to.
For what it's worth, I've since flip-flopped on this. I was initially
opposed to the idea of any sort of caching. Talking with Simo has since
changed my mind. He raised the interesting point that, in addition to
the above plan greatly simplifying matters, it's actually more
consistent with how other applications, including things like the OS,
handle external group memberships. Your groups are set at log-in, and
last until your session ends.
So just wanted to go on-record as being someone who initially opposed
this idea and is now convinced it's a good plan.