URL:
https://github.com/SSSD/sssd/pull/202
Title: #202: T3315 infopipe group users master
jhrozek commented:
"""
The ghost attribute is an optimization. Normally, when you are asked for a group (which,
if you follow the getgr* interface) also includes a list of group members, you would
create a user object for every member of the group and link the user object with
member/memberof links in the cache.
But that's very slow, so instead, if we are only interested in the member name, we
store the member name in the special 'ghost' attribute. When the user info is
later requested (e.g. getent group developers returns fabiano, later someone asks for
getent passwd fabiano), we remove the ghost attribute and instead store the full user
entry and the proper links.
(I haven't checked the patch, just saying what the ghost is about).
And in general it's OK if there are no ghost attributes for a group. it just means
that the group either has no members or all members have been previously fully resolved.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/202#issuecomment-318923831