URL:
https://github.com/SSSD/sssd/pull/57
Author: sumit-bose
Title: #57: LDAP/AD: resolve domain local groups for remote users
Action: opened
PR body:
"""
This set of patches should solve
https://fedorahosted.org/sssd/ticket/3206. To
test this you have to join SSSD into an AD forest with at least two domains.
Assuming the domain SSSD is joined to is called A and there is another domain
in the forest called B you have to create a domain local group in domain A,
e.g. A\dom_loc. Then create e.g. a universal group in domain B, e.g. B\uni and
make B\uni a member of A\dom_loc. Any user from domain B which is a member of
B\uni should now be a member of A\dom_loc as well because SSSD is joined to
domain A and any domain local group from domain A is valid in this case.
If SSSD is joined to domain B A\dom_loc is not a valid group in this domain and
any user which is a member of B\uni should _not_ be a member of A\dom_loc.
The lookup to the domain local groups is added as a second step after the
initial initgroups lookup and should work with and without the tokenGroups
request.
There is one issue I currently do not have a solution for. It is possible to
add the user from domain B to A\dom_loc directly. It this user is an indirect
member of A\dom_loc as well, e.g. via B\uni, and this direct membership is
removed the initgroups request will not return A\dom_loc. This is due to the
nature of SSSD's cache. The memberOf attribute will be removed from the user
entry during the initial lookup because this lookup is not aware of the domain
local groups and will remove the missing direct parent. During the domain local
lookup no changes are detected, because the direct membership is already
removed and there are no changes in the objects related to the indirect
membership. Even adding all nested memberships again won't help because the
sysdb code will detect that the membership is already present and skip it. And
unconditionally removing and adding all nested membership again sounds too
costly to me for this special case especially since the plan to use the PAC to
determine the memberships in the next release even for user which are not
already logged in.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/57/head:pr57
git checkout pr57