On Thu, Sep 03, 2015 at 09:54:51AM +0200, Jakub Hrozek wrote:
On Thu, Sep 03, 2015 at 09:31:07AM +0200, Petr Cech wrote:
> On 09/03/2015 08:18 AM, Jakub Hrozek wrote:
> >On Thu, Sep 03, 2015 at 06:15:24AM +0200, Lukas Slebodnik wrote:
> >>On (02/09/15 18:06), Petr Cech wrote:
> >>>Hi,
> >>>
> >>>reverting this commit
"5e9bc89b28f1ac3ce573ecdece74fe9623580c28" fixed the
> >>>problem for me. So is the original commit no longer valid?
> >>>
> >>I'm little bit worried about reverting this patch.
> >>Did you test the bug which was fixed by this commit.
> >>@see
https://fedorahosted.org/sssd/ticket/1519
> Thanks.
>
> Tested. We need both patches (because user groups are in memberOf and host
> groups are in orig_memberOf).
> Simple, I will do it.
>
> Is it OK that freeIPA use two kind of memberOf?
It does not. In FreeIPA LDAP there should only be memberOf (check it
out with openldap). What is happening is that we internally store IPA's
memberof value as originalMemberOf and our memberof points to cached
objects.
yes and since we (so far) only store POSIX groups (user groups) in the
SSSD cache memberOf will only point to user groups. But as Jakub said
originalMemberOf should contain all memberOf attributres from the
related IPA LDAP object. Hence I would expect that originalMemberOf will
have a complete list of memberships with both user and host groups.
bye,
Sumit
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel