Hi,
this patch is a follow-up for the recent HBAC fixes. It turned out that
the originalMemberOf attributes of AD users for IPA groups can be
removed by some user lookups. To reproduce call
# sss_cache -E
# id aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof
originalMemberOf
here originalMemberOf should be available for all AD and IPA groups.
# sss_cache -E
# getent passwd aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof
originalMemberOf
now originalMemberOf only show AD groups.
bye,
Sumit