On 08/29/2016 11:47 PM, Sumit Bose wrote:
Finally you call sysdb_initgroups_with_views() to get the list of
groups
the user is a member of and compare them with the groups form the
session_recording configuration. Since you compare the DNs I think this
can be improved a bit. sysdb_initgroups_with_views() does a dereference
search based on the memberOf attribute of the user which holds the DNs
of all the groups the user is a member of. But since you only need
the DNs of the groups for the comparison you can just add the memberOf
attribute to the attribute list in nss_cmd_getpwnam_search() and friends
to make the DNs of the groups available in
session_recording_is_enabled().
And one more question: the above basically means that we need to make
sysdb_getpwnam retrieve "memberOf" as well. Do we want to do that?
If yes, do we want to do that unconditionally, or change the interface to have
that optional (ugh)?
Do we want to change sysdb_enumpwent_filter (used in setpwent) to do that as
well?
We went through some of this in a chat a while ago, but I just want to be
sure.
Thanks!
Nick