On Mon, 2011-09-26 at 10:22 +0200, Jakub Hrozek wrote:
On Sun, Sep 25, 2011 at 10:27:23AM -0400, Stephen Gallagher wrote:
> This patch I'm not 100% sure of. It may need more processing. With
> RFC2307, it was safe to have duplicate groups in the list, because only
> the group name is important (and we guarantee that the name list has
> only unique values before saving it). With RFC2307bis, I'm not sure if
> it's safe to add two groups that may have the same name. Comments
> welcome.
I don't think it is safe to add two groups with the same name. At least
the nss provider would choke on that during sysdb_getgrnam()
After a discussion with Simo and Nalin on #sssd today, we determined
that the multiple search base code will not (really, cannot) support
"overrides". If the same group appears in more than one base, we're
going to have to consider it a misconfiguration. We'll do our best to
handle it, but there are no guarantees.
So I'm going to add details about this to the manpage and resubmit these
patches.