URL:
https://github.com/SSSD/sssd/pull/5404
Title: #5404: nss: check if groups are filtered during initgroups
sumit-bose commented:
"""
`filter_groups` is quite common option so I wonder why was this
reported only recently? Was it always like this or is it a regression?
I think it was always the case. The `filterUsersInGroups` was added as a side-effect
because it looks there were cases where a group was not displayed at all and we started
thinking about how to handle filtered users in the member list
(
https://pagure.io/SSSD/sssd/issue/108). The initgroup case so far was not considered and
it is only clearly visible if you carefully looks at the id output. I guess typically for
a group in `filter_groups` only `getent group` is checked and that's why it wasn't
reported earlier.
Do you think that there's is someone who's using this
behavior?
Do you mean that somebody relies on the fact that a user can still be a member of a
filtered group?
bye,
Sumit
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5404#issuecomment-732762219