On Fri, Sep 04, 2015 at 03:28:09PM +0200, Petr Cech wrote:
On 09/04/2015 03:24 PM, Petr Cech wrote:
>On 09/03/2015 03:45 PM, Sumit Bose wrote:
>>>I tried both case. I used only originalMemberOf and I had right
>>>hostgroups,
>>>>no user groups. Then I used only memberOf and I had no hostgroups,
>>>right
>>>>user groups.
>>>>
>>>>So I did little hack, we could use both memberOf. The patch is
>>>attached and
>>>>it works for me.
>>Hi Petr,
>>
>>thank you for the patch I haven't tested it yet. But I think I now
>>understand the issue better. Currently we store the originalMemberOf
>>attribute for users and hosts but not for POSIX/user groups (we do not
>>even read it from LDAP). So an alternative fix might be to add memberOf
>>attribute to the list of attribute read from LDAP for POSIX groups and
>>save the result in originalMemberOf in the cache. The using only
>>originalMemberOf should be sufficient for the netgroups lookup.
>>
>>Would you mind to try this? For a test is shoult de sufficient to add a
>>line like
>>
>> { "ldap_group_member_of", "memberOf", SYSDB_MEMBEROF,
NULL }
>>
>>to all 'struct sdap_attr_map *_group_map[]' lists and a corresponding
>>entry to 'enum sdap_group_attrs'.
>>
>>bye,
>>Sumit
>>
>
>Hello Sumit,
>
>I tried your alternative way (thanks for it). Patch is attached.
>I added some lines like:
># { "ldap_user_member_of", "memberOf", SYSDB_ORIG_MEMBEROF, NULL
}
>and it works for me.
>
>I hope that meaning of this patch is saving user/POSIX group memberOf
>attribute to originalMemberOf attribute.
>
>Regards,
>
>Petr
And there is version with ticket number.
>
>
>_______________________________________________
>sssd-devel mailing list
>sssd-devel(a)lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
Hi Petr,
thank you for your patience. Both versions of your patches work as
expected and fixes the issues with group and nested group memberships.
After testing a reading the current sources I think the best solution
might be a slight variant of your first patch where you check for both
memberOf and originalMemberOf but instead of always checking both I
would suggest to pass down the attribute to check by adding a new member
to struct extract_state and set it with the help of a new attribute to
extract_members(). Since extract_members() is called individually for
users and hosts in ipa_netgr_process_all() you can always pass the right
attribute. Btw. instead of using SYSDB_ORIG_MEMBEROF and
SYSDB_MEMBEROF explicitly you might want to use the configured mapping
which e.g. is available in ipa_netgr_process_all() as
state->ipa_opts->id->user_map[SDAP_AT_USER_MEMBEROF].sys_name
bye,
Sumit