I'm using the standard SLES OS 1.9.4 packages. I may get time, but it's unlikely,
to build newer versions.
The nesting is shallow:
Group1 contains group2, group3 group4, user1, user2, user3
Group2 contains user4, user5, user6
Group3 contains user7, user8, user9
Group4 contains user10,user11,user12
So what is happening is that sometimes, getent group1 is returning just user1,user2,user3
and other times it returns all 12 users.
Cheers,
Greg
-----Original Message-----
From: sssd-devel-bounces(a)lists.fedorahosted.org [mailto:sssd-devel-
bounces(a)lists.fedorahosted.org] On Behalf Of Jakub Hrozek
Sent: Tuesday, 3 December 2013 7:24 PM
To: sssd-devel(a)lists.fedorahosted.org
Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann(a)csiro.au wrote:
> I've noticed under 1.9.4 that starting with an empty cache, doing a
getent group does not return all members of the group, sometimes.
>
> The actual group in AD contains some users and some subgroups of
users. Not nested deeply, but multiple subgroups...
>
> If I do a
> getent group group1
>
> when the cache is fresh it does not return all members. If I do a
getent passwd on one of my accounts as a member of group1 and then
follow that with a getent group group1 it will return all the members
of the group. If I getent passwd account2 (also a member of group1) it
does not help getent group return all members.
>
> Any ideas?
>
> Cheers,
>
> Greg Lehmann
If you're running upstream tarballs, can you try 1.9.6 ?
There's been a number of fixes between .4 and .6 that might be
relevant.
btw is the member deeply nested? Please note that the default member
nesting limit is 2 (see ldap_group_nesting_level).
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel