Hello list,
I have worked on ticket #3222 [1]. The reproducer mentioned on this
ticket doesn't work for 100%. After some investigation and discussion
with SSSD team I recognized that the issue is caused by memory cache
(fast cache).
This memcache saves users and groups. Default timeout is 300 seconds.
I prepare simple patch which shows important debug msg. for
investigation of mem cache (in this case). And two reproducers, one with
memcache and without one.
If we compiled SSSD with 'debug' patch and we run
'group_member_with_memcache.sh' we could see i.e.:
[root@mirach sssd]# group_member_with_memcache.sh && grep '>>>'
*.log
---------------------
Added user "testuser"
---------------------
[...]
-----------------------
Added group "testgroup"
-----------------------
Group name: testgroup
GID: 1703800630
Mon Oct 24 15:20:05 CEST 2016
>> [A] record not found
>> [B] record not found
testgroup:*:1703800630:
Group name: testgroup
GID: 1703800630
Member users: testuser
-------------------------
Number of members added 1
-------------------------
ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la :
/usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header
Mon Oct 24 15:20:09 CEST 2016
>> [A] record not found
>> [B] record not found
testgroup:*:1703800630:testuser
Group name: testgroup
GID: 1703800630
---------------------------
Number of members removed 1
---------------------------
ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la :
/usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header
Mon Oct 24 15:20:13 CEST 2016
>> mc record expires at [1477315509] | now [1477315213]
>> [A] MC used
testgroup:*:1703800630:testuser
-------------------------
Deleted group "testgroup"
-------------------------
-----------------------
Deleted user "testuser"
-----------------------
sssd_nss.log:(Mon Oct 24 15:20:05 2016) [sssd[nss]]
[sss_mmap_set_rec_header] (0x0010): >>> MC STORE expiration [1477315505]
| now [1477315205]
sssd_nss.log:(Mon Oct 24 15:20:05 2016) [sssd[nss]]
[sss_mmap_cache_gr_store] (0x0010): >>> MC STORE [testgroup] [300]
members [0]
sssd_nss.log:(Mon Oct 24 15:20:09 2016) [sssd[nss]]
[sss_mmap_set_rec_header] (0x0010): >>> MC STORE expiration [1477315509]
| now [1477315209]
sssd_nss.log:(Mon Oct 24 15:20:09 2016) [sssd[nss]]
[sss_mmap_cache_gr_store] (0x0010): >>> MC STORE [testgroup] [300]
members [1]
How we can see the wrong result is just taken from memory cache. If you
run 'group_member_without_memcache' it works right. So I suppose that
the solution for ticket is simple just adjusting memcache_timeout option
on problematic deployments.
If everybody agree I will close ticket as not a bug and write comment
about memcache_timeout option.
Regards
[1]
https://fedorahosted.org/sssd/ticket/3222
--
Petr^4 Čech