On 12/03/2013 06:38 PM, Greg.Lehmann(a)csiro.au wrote:
I'm using the standard SLES OS 1.9.4 packages. I may get time,
but it's unlikely, to build newer versions.
The nesting is shallow:
Group1 contains group2, group3 group4, user1, user2, user3
Group2 contains user4, user5, user6
Group3 contains user7, user8, user9
Group4 contains user10,user11,user12
So what is happening is that sometimes, getent group1 is returning just user1,user2,user3
and other times it returns all 12 users.
Greg,
Please define "sometimes"?
Same machine or different machines? I mean does it work from some
machines and does not from others or on the same machine you run at
different times and you get different results?
What is the state of the machine in terms of cache? Was it cleaned in
between attempts?
Is the system online or offline when you observe the issue?
Since it is AD and AD requires multiple round-trips to get nested groups
I might be that in your case the follow up lookups for some reason do
not always go through.
Jakub, may be it times out and SSSD thinks that there are no sub groups?
Cheers,
Greg
> -----Original Message-----
> From: sssd-devel-bounces(a)lists.fedorahosted.org [mailto:sssd-devel-
> bounces(a)lists.fedorahosted.org] On Behalf Of Jakub Hrozek
> Sent: Tuesday, 3 December 2013 7:24 PM
> To: sssd-devel(a)lists.fedorahosted.org
> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
>
> On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann(a)csiro.au wrote:
>> I've noticed under 1.9.4 that starting with an empty cache, doing a
> getent group does not return all members of the group, sometimes.
>> The actual group in AD contains some users and some subgroups of
> users. Not nested deeply, but multiple subgroups...
>> If I do a
>> getent group group1
>>
>> when the cache is fresh it does not return all members. If I do a
> getent passwd on one of my accounts as a member of group1 and then
> follow that with a getent group group1 it will return all the members
> of the group. If I getent passwd account2 (also a member of group1) it
> does not help getent group return all members.
>> Any ideas?
>>
>> Cheers,
>>
>> Greg Lehmann
> If you're running upstream tarballs, can you try 1.9.6 ?
>
> There's been a number of fixes between .4 and .6 that might be
> relevant.
>
> btw is the member deeply nested? Please note that the default member
> nesting limit is 2 (see ldap_group_nesting_level).
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/