URL:
https://github.com/SSSD/sssd/pull/484
Title: #484: SDAP: skip builtin AD groups in sdap_save_grpmem()
fidencio commented:
"""
Okay, I've been able to reproduce it with the direct AD integration by doing:
- AD side:
- Create an AD group (its Group scope is set as "Global" and its Group type
set as "Security");
- Go to the properties of this newly created group, go to the "Member of" tab
and add any BUILTIN group (as Administrators or Users);
- Client side:
- `getent group BUILTIN_group`;
- check the cache file and you'll see something like:
```
# record 7
dn: name=Administrators(a)direct.ff,cn=groups,cn=direct.ff,cn=sysdb
createTimestamp: 1515586774
gidNumber: 0
name: Administrators(a)direct.ff
objectClass: group
distinguishedName: name=Administrators(a)direct.ff,cn=groups,cn=direct.ff,cn=sys
db
```
After the patch the entry is not stored in SSSD's cache.
Adding the "Accepted" label.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/484#issuecomment-356600616