On Fri, Oct 31, 2014 at 03:55:53PM +0200, Alexander Bokovoy wrote:
On Fri, 31 Oct 2014, Jakub Hrozek wrote:
>On Fri, Oct 31, 2014 at 02:36:54PM +0100, Pavel Březina wrote:
>>https://fedorahosted.org/sssd/ticket/2471
>>
>>AFAIK all group object in IPA has ipaUserGroup object class so it should be
>>general enough to cover all type of groups but excluding roles.
>
>Are you sure, even with non-POSIX groups, POSIX groups and user private
>groups (I haven't tested all three, I'm mostly asking..)
External groups use ipaUserGroup+ipaObject+nestedGroup (and few more)
object classes. However, UPGs don't use ipaUserGroup, they are using
posixGroup+ipaObject:
Right, currently SSSD supports looking entries by "objectClass" and
"alternative ObjectClass". The latter is currently only use for UPGs.
This is how the two OCs look after Pavel's patch:
{ "ldap_group_object_class", "ipaUserGroup", SYSDB_GROUP_CLASS,
NULL },
{ "ldap_group_object_class_alt", "posixGroup", SYSDB_GROUP_CLASS,
NULL },
The filter ORs the two entries.
dn: cn=foobar2,cn=groups,cn=accounts,dc=ipacloud,dc=test
objectClass: posixgroup
objectClass: ipaobject
objectClass: mepManagedEntry
objectClass: top
cn: foobar2
gidNumber: 242800005
description: User private group for foobar2
mepManagedBy: uid=foobar2,cn=users,cn=accounts,dc=ipacloud,dc=test
ipaUniqueID: 1740bb50-6105-11e4-8e75-545200f9718b
--
/ Alexander Bokovoy
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel