On Fri, Nov 09, 2012 at 08:05:02PM -0800, Paul B. Henson wrote:
I'm attaching an initial draft of the implementation of
ignore_group_members per ticket #1376. I still need to update the
documentation (and some python code in SSSDConfig it looks like), but
functionality wise this prevents ldap from requesting the member
attribute and sssd from returning any cached members that might be left
in the local db. As this is my first attempt at working with sssd, I
wanted to get early feedback in case I'm doing something silly ;).
Also, regarding the comment on the ticket:
Thank you for the contribution! I will take a look at the patch..can you
just send the patch as output of git format-patch in the future? It's
easier for us to handle that way.
As per the documentation and the configAPI -- you can either let us
worry about that part as we already know which parts need to be modified
or you can check out commit 1542b85f13d72329685bdd97aa879c36d11f81be,
for example. I think that patch added/changed all the correct pieces at
the correct places.
"The trickiest piece of this functionality would be ensuring
that we
don't delete existing member/memberOf linkages from the cache during
group lookups that were put there by previous initgroups() requests.
Thus, when this option is in play, member/memberOf should only be
managed by initgroups() calls."
My understanding of this is that an initgroups call will set up some
state in the cache regarding members of groups, and a getgrnam or
getgrgid call that skips retrieving the member attribute will wipe these
out of the cache.
Yes, that's my understanding, too. I think the way the code is built now
would treat the attributes as missing and delete them during a getgrnam
or getgrgid call.
However, it's also my understanding that *every*
initgroups call hits ldap directly to make sure stale data isn't used
for authorization purposes.
If so, why do we care that the data in the
cache, which isn't going to be used, gets wiped out? When
ignore_group_members is enabled, the only thing that cares about group
members is initgroups, correct?
The SSSD always retrieves initgroups data during an authentication
request that comes through the PAM stack for exactly the reason you
cited. For lookups that only occur through the name-service-switch
module, the SSSD caches the data for entry_cache_user_timeout by
default.
So maybe the code could be modifed to read the existing group
memberships and fake the results it got from LDAP to also include these
memberships?