On Tue, 2009-12-01 at 09:49 -0500, Simo Sorce wrote:
The current code use some rough heuristics to determine if an object
is
a group or a user when calculating group memberships.
That code easily breaks if you do not set a separate specific group base
dn and is generally too tied to a specific DIT configuration.
The following patches instead actively lookup entries by their original
DN so that group memberships can be translated correctly.
The patch uses a dirty trick for now, it uses a synchronous[1] search
(looping in place) to fetch the local entry. This was done to minimize
the impact of the patch.
0001 talking with nalin it turns out that rfc2307bis is supposed to
implement also nested groups, so I changed the code to do the same we do
for ipa/ad servers in this case, and resolve nested groups.
0002 a patch that makes a couple of functions available to external
callers
0003 the patch that actually fixes #264
Simo.
[1] In general operations against the local ldb are "fake asynchronous"
anyway when using the tdb backend. I am considering a future set of
patches to make the sysdb code more synchronous like we did for the
confdb code. The sysdb code was initially made asynchronous because we
were considering using also the ldb_ldap backend, but it turned up we
didn't.
I've rebased these patches on top of the other memberof fixes.
Simo.
--
Simo Sorce * Red Hat, Inc * New York