I guess because I was lazy when writing the original patch the cached
entries for users and groups from trusted domains on IPA clients had a
hardcoded lifetime of 10h. With this patch the configurable timeouts as
described in the sssd.conf man page should be respected which should fix
I've been working on a integration test for https://fedorahosted.org/sssd/ticket/2849.
This patch is WIP as I have troubles with infopipe. Unless test is run as root it fails to connect to system bus:
> Traceback (most recent call last):
> File "/home/preichl/sssd/src/tests/intg/ldap_local_override_test.py", line 1038, in test_regr_2849_override
> bus = dbus.SystemBus()
> File "/usr/lib64/python2.7/site-packages/dbus/_dbus.py", line 194, in __new__
> File "/usr/lib64/python2.7/site-packages/dbus/_dbus.py", line 100, in __new__
> bus = BusConnection.__new__(subclass, bus_type, mainloop=mainloop)
> File "/usr/lib64/python2.7/site-packages/dbus/bus.py", line 122, in __new__
> bus = cls._new_for_bus(address_or_type, mainloop=mainloop)
> DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
If I run test as root then I have to make sure that there are no other instances of SSSD running.
Any ideas how to work around this troubles?
when processing nested group memberships from multiple domains SSSD
might try to add a group to a wrong domain which will cause lookup
errors later because the group cannot be looked up in the wrong domain.
To avoid this the 2nd patch tries to determine the domain based on the
SID of the group if available. Unfortunately I wasn't able to reproduce
the issue so far but the original reported confirmed that the patch
fixes the issue for him.
The first patch is a related issue I found while debugging the group
issue. There is no error caused by this but it might cause a LDAP lookup
for the user although it is already in the cache.