On 09/04/2015 03:24 PM, Petr Cech wrote:
On 09/03/2015 03:45 PM, Sumit Bose wrote:
>> I tried both case. I used only originalMemberOf and I had right
>> hostgroups,
>> >no user groups. Then I used only memberOf and I had no hostgroups,
>> right
>> >user groups.
>> >
>> >So I did little hack, we could use both memberOf. The patch is
>> attached and
>> >it works for me.
> Hi Petr,
>
> thank you for the patch I haven't tested it yet. But I think I now
> understand the issue better. Currently we store the originalMemberOf
> attribute for users and hosts but not for POSIX/user groups (we do not
> even read it from LDAP). So an alternative fix might be to add memberOf
> attribute to the list of attribute read from LDAP for POSIX groups and
> save the result in originalMemberOf in the cache. The using only
> originalMemberOf should be sufficient for the netgroups lookup.
>
> Would you mind to try this? For a test is shoult de sufficient to add a
> line like
>
> { "ldap_group_member_of", "memberOf", SYSDB_MEMBEROF, NULL
}
>
> to all 'struct sdap_attr_map *_group_map[]' lists and a corresponding
> entry to 'enum sdap_group_attrs'.
>
> bye,
> Sumit
>
Hello Sumit,
I tried your alternative way (thanks for it). Patch is attached.
I added some lines like:
# { "ldap_user_member_of", "memberOf", SYSDB_ORIG_MEMBEROF, NULL }
and it works for me.
I hope that meaning of this patch is saving user/POSIX group memberOf
attribute to originalMemberOf attribute.
Regards,
Petr
And there is version with ticket number.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel