On Tue, Jul 16, 2013 at 03:01:31PM +0200, Lukas Slebodnik wrote:
ehlo,
Group structure is described in ticket
https://fedorahosted.org/sssd/ticket/1846
Please ensure that sysdb cache is empty.
call command "getent group cyclegroup1"
sssd_be will call following function:
a) sdap_store_group_with_gid (name:cyclegroup1)
--added attributes [ ghost: user1, origMember: user1, ... ]
b) sdap_store_group_with_gid (name:cyclegroup2)
--added attributes [ ghost: user2, origMember: user2, ... ]
c) sdap_save_grpmem (name:cyclegroup1)
--added attributes [ member:cyclegroup2, ... ]
d) sdap_save_grpmem (name:cyclegroup2)
--added attributes [ member:cyclegroup1, ... ]
Subtransaction "d)" will fail and log file contains:
[ldb] (0x4000): will add 2 ghost users to 1 parents
... snip ...
[ldb] (0x4000): cancel ldb transaction (nesting: 2)
[sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists]
[sysdb_set_entry_attr] (0x0400): Error: 17 (File exists)
[sysdb_store_group] (0x0400): Error: 17 (File exists)
[sdap_save_grpmem] (0x0040): Failed to save user cyclegroup2
[sdap_save_groups] (0x0040): Failed to store group 1 members.
[ldb] (0x4000): commit ldb transaction (nesting: 1)
[ldb] (0x4000): commit ldb transaction (nesting: 0)
Attached patch should fix this bug.
LS
I personally don't have a problem with the patch. It *might* hide
legitimate bugs but on the other hand the call was issued so that the
attribute is added and if it was added already during processing of a
cycle, then fine.
But the memberof plugin is delicate code, so I would also like to get
Simo's opinion. Simo, are you OK with this approach or would you prefer
do detect the cycle instead?
Please note that the function that Lukas added the permissive control to
is called to distribute both ghost and memberuid attributes.
From d266b1c412731d6cbca18228a32f48017efbf3aa Mon Sep 17 00:00:00
2001
From: Lukas Slebodnik <lslebodn(a)redhat.com>
Date: Mon, 15 Jul 2013 11:00:04 +0200
Subject: [PATCH] Every time use permissive control in function memberof_mod.
Storing cyclic groups into sysdb can cause adding ghost members,
which has already been stored. Function ldb_modify will fail
with error [Attribute or value exists].
With permisive control, duplicated attributes will be skipped
as if it was never added.
https://fedorahosted.org/sssd/ticket/1846
---
src/ldb_modules/memberof.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
index 4a9328482b1d3999ea0f57051249dfe5415b995f..79b33137b5ac45bda4bb5fc7efce4553f7227fe3
100644
--- a/src/ldb_modules/memberof.c
+++ b/src/ldb_modules/memberof.c
@@ -1135,6 +1135,13 @@ static int mbof_add_muop(struct mbof_add_ctx *add_ctx)
return ret;
}
+ ret = ldb_request_add_control(mod_req, LDB_CONTROL_PERMISSIVE_MODIFY_OID,
+ false, NULL);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(mod_req);
+ return ret;
+ }
+
return ldb_next_request(ctx->module, mod_req);
}
--
1.8.3.1
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel