On Wed, Sep 10, 2014 at 01:23:15PM +0200, Michal Židek wrote:
Hi,
this patch should solve regression on IPA server
triggered by the patches for this ticket:
https://fedorahosted.org/sssd/ticket/2343
Patches for #2343 solved the IPA side of the
problem by searching for objectclass groupOfNames
instead of posixGroup (which was not available in
non-posix groups). But (as we discovered now) not
all groups in IPA are members of the objectClass
groupOfNames (the private groups created
automatically for users are not, so as a result
we were not able to query them). So there is
no common objectclass for all groups in IPA that
would be suitable for group query filters.
So these 2 patches add the possibility to query
groups using primary and alternative objectClass
(ORed in the filter).
I tested the patches, but I would feel safer if
someone pushed them to Beaker and run QE tests
on it before pushing (I thing Jakub volunteered
for this task off-list :) ).
Thank you,
Michal
While I agree with the general approach I think the default for the
alternative objectclass should be NULL at it should only be added to the
search filter if defined. Maybe a function returning either
"(objectClass=group_oc)" or
"(|(objectClass=group_oc)(objectClass=alt_group_oc))" might help here.
I guess you did not include changes to the man page and the config API
on purpose to make it hard to change or unset the values. But
nevertheless it is a config option and should be handled as such.
I understand that we need a fix for the issue fast because it is in
already released. Hence I would agree if trac tickets are created for
the issues above for the next release.
bye,
Sumit