On POSIX and non-POSIX groups
by Jakub Hrozek
Hi,
We had a question from one of our users about the proper behaviour of POSIX
and non-POSIX groups, where a POSIX group is one with a gidNumber and a
non-POSIX group is one that lacks the gidNumber.
I did a bit of testing and I think what I'm seeing is a bug, but some of
the code is quite old and the old commits lack proper commit messages and
links to upstream tickets, so I'd like to check with the other developers.
The question is -- should the complete hierarchy of mixed POSIX and
non-POSIX groups be saved to cache and resolved? I think it should.
As an example, consider this hierarchy:
user ----- posix_group1
\
-- non_posix_group
\
--- posix_group2
I would expect that "id user" would return both "posix_group1" and
"posix_group2", but I only see "posix_group1".
Conversely, I think SSSD should also support expanding group hierarchy
for getgrnam/getgrgid requests, it seems that we even have code (git
show 00142aba00a2adcf32f0741b8ea8a31c5a461675) that should support this
case, but it wasn't working for me either.
The behaviour sounds like a bug to me.
8 years, 2 months
[PATCH] DEBUG macro refactoring - 1.11 backport
by Nikolai Kondrashov
Hi everyone,
Here is my backport of the DEBUG macro refactoring patchset to sssd-1-11
branch.
Patches are mostly identical to master, with the exception of the changes
generated by scripts (which were re-run), some commit messages and one commit
being moved into a more logical place in history.
All patches that should work passed "make check" both on RHEL7 and Fedora 20
(verified by CI).
I've left the original Reviewed-by tags for the commits with unchanged
content, but I can remove them, if necessary.
Sincerely,
Nick
8 years, 2 months
[PATCHES][ding-libs] Bump versions for 0.4.0 release
by Lukas Slebodnik
ehlo,
release blocked by:
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-April/019043.html
Two patches are attachd.
My notes:
basicobject no ABI change
new function added simplebuffer_get_vbuf
libref_array no ABI change
function ref_array_debug added to public header ref_array.h
libcollection
version-info should be 4:0:0, but there would be big jump in soname
libcollection.so.2.1.0 -> libcollection.so.4.0.0
-function removed from ABI: col_allocate_item (declared in collection_priv.h)
libini_config
version-info should be 5:0:0, but there would be big jump in soname
libini_config.so.3.1.0 -> libini_config.so.5.0.0
-functions removed from ABI:collect_metadata, empty_section,
ini_boundary_cb, ini_cleanup_cb,
ini_comment_cb, ini_get_error_str,is_allowed_spaces.
is_just_spaces, parser_run, prepare_metadata,
print_grammar_errors, print_validation_errors, read_line,
valid_collision_flags
//were declared in internal ini_metadata.h or ini_config_priv.h
LS
8 years, 3 months
[PATCH] Extend the LDAP attribute map with custom options
by Jakub Hrozek
Hi,
the attached patches implement ticket #2073 -- the possibility to extend
the LDAP attribute map with custom attributes.
All attributes are saved to sysdb with the 'extra_' prefix so that the
custom attributes can be distinguished from the sysdb schema.
The first patch fixes a mostly unrelated bug, which I found when writing
unit tests.
[PATCH 1/3] LDAP: Fix one-by-one bug in sdap_copy_opts
The sdap_copy_opts function copied all the arguments except for the
sentinel.
[PATCH 2/3] LDAP: Make it possible to extend an attribute map
https://fedorahosted.org/sssd/ticket/2073
This commit adds a new option ldap_user_extra_attrs that is unset by
default. When set, the option contains a list of LDAP attributes the
LDAP provider would download and store in addition to the usual set.
The attributes are fetched in sysdb with the 'extra_' prefix to not
conflict with the sssd sdap maps.
[PATCH 3/3] Make LDAP extra attributes available to IPA and AD
https://fedorahosted.org/sssd/ticket/2073
8 years, 3 months
Re: [SSSD] [PATCH] Extend the LDAP attribute map with custom options
by Jakub Hrozek
On Fri, Apr 25, 2014 at 12:05:23PM +0200, Jan Pazdziora wrote:
> On Fri, Apr 25, 2014 at 11:42:14AM +0200, Jakub Hrozek wrote:
> >
> > I don't really mind too much and appears Jan does not either. So I
> > simply swapped the order in the attached patches, now it's sysdb:LDAP.
> >
> > Man page was changed accordingly.
> >
> > Jan, could you check if the man page change (src/man/sssd-ldap.5.xml in
> > the second patch) reads good to you?
>
> [...]
>
> > ldap_user_uid_number = str, None, false
> > diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
> > index f93b418c45d9bcd32499860a858c3f829bb245ca..6426fe4fca5dc9bb9bc84fcbf633404144052d01 100644
> > --- a/src/man/sssd-ldap.5.xml
> > +++ b/src/man/sssd-ldap.5.xml
> > @@ -616,6 +616,54 @@
> > </listitem>
> > </varlistentry>
> >
> > + <varlistentry>
> > + <term>ldap_user_extra_attrs (string)</term>
> > + <listitem>
> > + <para>
> > + Comma-separated list of LDAP attributes that SSSD
> > + would fetch along with the usual set of user
> > + attributes.
> > + </para>
> > + <para>
> > + The list can either contain LDAP attribute names
> > + only, or colon-separated tuples of SSSD cache
> > + attribute name and LDAP attribute name. In
> > + case only LDAP attribute name is specified,
> > + the attribute is saved to the cache verbatim.
> > + Using a custom SSSD attribute name might be
> > + required by environments that configure several
> > + SSSD domains with different LDAP schemas.
> > + </para>
> > + <para>
> > + Please note that several attribute names are
> > + reserved by SSSD, notably the <quote>name</quote>
> > + attribute. SSSD would report an error if any of
> > + the reserved attribute names is used as an extra
> > + attribute name.
> > + </para>
> > + <para>
> > + Examples:
> > + </para>
> > + <para>
> > + ldap_user_extra_attrs = telephoneNumber
> > + </para>
> > + <para>
> > + Save the <quote>telephoneNumber</quote> attribute from LDAP
> > + as <quote>telephoneNumber</quote> to the cache.
> > + </para>
> > + <para>
> > + ldap_user_extra_attrs = phone:telephoneNumber
> > + </para>
> > + <para>
> > + Save the <quote>telephoneNumber</quote> attribute from LDAP
> > + as <quote>phone</quote> to the cache.
> > + </para>
> > + <para>
> > + Default: not set
> > + </para>
> > + </listitem>
> > + </varlistentry>
>
> It reads very well.
>
> Once I have stable .src.rpm, I'll test if the behaviour matches the
> man page as well.
Hi,
can I get a final ACK (or a non-file NACK :-)) on the patches?
8 years, 3 months