It was defined in the first message. Same machine. All I am doing is stopping sssd
clearing cache dbs, restarting and doing some getents on passwd and group entries.
-----Original Message-----
From: sssd-devel-bounces(a)lists.fedorahosted.org [mailto:sssd-devel-
bounces(a)lists.fedorahosted.org] On Behalf Of Dmitri Pal
Sent: Wednesday, 4 December 2013 10:04 AM
To: sssd-devel(a)lists.fedorahosted.org
Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
On 12/03/2013 06:38 PM, Greg.Lehmann(a)csiro.au wrote:
> I'm using the standard SLES OS 1.9.4 packages. I may get time, but
it's unlikely, to build newer versions.
>
> The nesting is shallow:
>
> Group1 contains group2, group3 group4, user1, user2, user3
> Group2 contains user4, user5, user6
> Group3 contains user7, user8, user9
> Group4 contains user10,user11,user12
>
> So what is happening is that sometimes, getent group1 is returning
just user1,user2,user3 and other times it returns all 12 users.
Greg,
Please define "sometimes"?
Same machine or different machines? I mean does it work from some
machines and does not from others or on the same machine you run at
different times and you get different results?
What is the state of the machine in terms of cache? Was it cleaned in
between attempts?
Is the system online or offline when you observe the issue?
Since it is AD and AD requires multiple round-trips to get nested
groups
I might be that in your case the follow up lookups for some reason do
not always go through.
Jakub, may be it times out and SSSD thinks that there are no sub
groups?
>
> Cheers,
>
> Greg
>
>> -----Original Message-----
>> From: sssd-devel-bounces(a)lists.fedorahosted.org [mailto:sssd-devel-
>> bounces(a)lists.fedorahosted.org] On Behalf Of Jakub Hrozek
>> Sent: Tuesday, 3 December 2013 7:24 PM
>> To: sssd-devel(a)lists.fedorahosted.org
>> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
>>
>> On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann(a)csiro.au
wrote:
>>> I've noticed under 1.9.4 that starting with an empty cache, doing a
>> getent group does not return all members of the group, sometimes.
>>> The actual group in AD contains some users and some subgroups of
>> users. Not nested deeply, but multiple subgroups...
>>> If I do a
>>> getent group group1
>>>
>>> when the cache is fresh it does not return all members. If I do a
>> getent passwd on one of my accounts as a member of group1 and then
>> follow that with a getent group group1 it will return all the
members
>> of the group. If I getent passwd account2 (also a member of group1)
it
>> does not help getent group return all members.
>>> Any ideas?
>>>
>>> Cheers,
>>>
>>> Greg Lehmann
>> If you're running upstream tarballs, can you try 1.9.6 ?
>>
>> There's been a number of fixes between .4 and .6 that might be
>> relevant.
>>
>> btw is the member deeply nested? Please note that the default member
>> nesting limit is 2 (see ldap_group_nesting_level).
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel