On Fri, 07 Jan 2011 15:03:42 -0500
Stephen Gallagher <sgallagh(a)redhat.com> wrote:
This should be safe, because during an enumeration, all users
should now be in the sysdb, so we won't need to go back to the
LDAP server for missing members.
This is not necessarily true. Both bad information (non existing users
listed as members) or filters on users (by uid) on our side can cause
groups to have members we can't resolve locally.
I suggest we pass down a "on_enumeration" flag to these functions so
that they will skip contactig the ldap server for any user not found
locally.
Simo.
--
Simo Sorce * Red Hat, Inc * New York