[PATCH] Add checks to test the memberuid handling
by Sumit Bose
Hi,
this patch adds some tests to check the memberuid generation of the
memberof ldb plugin. The first series of test creates a hierarchy of 10
nested groups, adds a user to each group and then removes a group in
the middle of the hierarchy. The second series works similar but puts the
the first group in the last one and creates a loop of nested groups.
bye,
Sumit
14 years, 5 months
[PATCH] correctly resolve nested groups (#264)
by Simo Sorce
The current code use some rough heuristics to determine if an object is
a group or a user when calculating group memberships.
That code easily breaks if you do not set a separate specific group base
dn and is generally too tied to a specific DIT configuration.
The following patches instead actively lookup entries by their original
DN so that group memberships can be translated correctly.
The patch uses a dirty trick for now, it uses a synchronous[1] search
(looping in place) to fetch the local entry. This was done to minimize
the impact of the patch.
0001 talking with nalin it turns out that rfc2307bis is supposed to
implement also nested groups, so I changed the code to do the same we do
for ipa/ad servers in this case, and resolve nested groups.
0002 a patch that makes a couple of functions available to external
callers
0003 the patch that actually fixes #264
Simo.
[1] In general operations against the local ldb are "fake asynchronous"
anyway when using the tdb backend. I am considering a future set of
patches to make the sysdb code more synchronous like we did for the
confdb code. The sysdb code was initially made asynchronous because we
were considering using also the ldb_ldap backend, but it turned up we
didn't.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
Using the -M option with sss_useradd
by David O'Brien
I'm curious about the description for this argument:
-M,--no-create-home
Do not create the user´s home directory. Overrides
configuration settings.
Don't all command-line arguments override configuration and default
settings? Is this one different somehow? Any particular reason for
specifically including this statement?
thanks
--
David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189
"The most valuable of all talents is that of never using two words when
one will do."
Thomas Jefferson
14 years, 5 months
[PATCH] fix nested groups
by Simo Sorce
When I did the enumgrent optimization patch I totally forgot about
nested groups for some reason.
Of course I broke them. The gain in performance although was just way
too substantial to just revert to the previous way of resolving nested
groups again and again at every search.
These 2 patches instead store unrolled groups by adding a new
operational attribute: memberuid
This attribute contains just the user name of any user directly or
indirectly (through a nested group) members of a group.
This way computation is done once at modify time and never again.
Fixes bug #291
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
[PATCHES] Debug log cleanups
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Patch 0001: Use human-readable timestamps instead of seconds since the
epoch.
Patch 0002: Raise the LDB_DEBUG_WARNING log level to 6. There's no
reason we should be reporting it at level 3.
Something else to note: confdb_init produces some LDB_DEBUG_WARNING
messages that don't go to a log file, because we don't know before
asking the CDB whether we need to log to files. Raising this level to 6
will mitigate this problem, as the messages won't appear on the console
unless the debug level is set pretty high.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAksX03MACgkQeiVVYja6o6PhuACeJ4ahYTZfK2/KPV2Sy3nmwPfw
jFoAn1Fqt+eeGfqswqby+r5x7Vy+wHSE
=SAsr
-----END PGP SIGNATURE-----
14 years, 5 months
[PATCH] Check the services started against a list of known services
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This should prevent monitor from starting dp (or any other unknown service)
Fixes: #241
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAksWd+UACgkQHsardTLnvCWSmQCgu1yebg7rxNS4lMNUc/3pZwlx
UHYAn08EcHfcDX4N1o6Xp+zkdEGqC+OB
=DK9o
-----END PGP SIGNATURE-----
14 years, 5 months
[PATCH] Check LDAP structure before calling ldap_unbind_ext()
by Sumit Bose
Hi,
sdap_handle_release() runs through the existing operations before
unbinding from the LDAP server. But some of the operations might have
called sdap_handle_release(), too, and the LDAP structure is not valid
anymore. To avoid an error in the LDAP libraries we check the structure
before calling ldap_unbind_ext().
bye,
Sumit
14 years, 5 months