On Fri, Jan 23, 2015 at 01:21:36PM +0100, Sumit Bose wrote:
Hi,
this patch is a follow-up for the recent HBAC fixes. It turned out that
the originalMemberOf attributes of AD users for IPA groups can be
removed by some user lookups. To reproduce call
# sss_cache -E
# id aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof
originalMemberOf
here originalMemberOf should be available for all AD and IPA groups.
# sss_cache -E
# getent passwd aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof
originalMemberOf
now originalMemberOf only show AD groups.
bye,
Sumit
CI passed:
http://sssd-ci.duckdns.org/logs/commit/9a/aa8c05e11e7bcc0102b2f2d2efa3851...
I have some trouble testing the patch, I'll report back later.