Simo Sorce <simo(a)redhat.com> wrote:
On Thu, 2011-05-19 at 16:21 +0200, Jakub Hrozek wrote:
> On 05/19/2011 04:07 PM, Simo Sorce wrote:
> > The filter is an OR
> > filter it will always match
>
> Actually, it's an AND filter, something along the lines of:
>
> (&(cn=name)(objectclass=posixGroup)(cn=*)(gidNumber=*))
I guess I was looking at the wrong part of the patch,
this is what I was referring to:
+ if (gid) {
+ /* Search for users that are members of this group, or
+ * that have this group as their primary GID
+ */
+ subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%lu))",
+ SYSDB_MEMBEROF, dn,
+ SYSDB_GIDNUM, (long unsigned)
gid);
+ } else {
+ subfilter = talloc_asprintf(tmpctx, "(%s=%s)",
+ SYSDB_MEMBEROF, dn);
}
I don't really see the need for the if/else here.
You are right, this way it makes no sense. I remember exactly the idea behind
this, but this is poor implementation on my side. Thanks for catching it.
The other change to the filter that removes the gid part looks ok to
me.
Both GIDs and Names are unique for groups so filtering for both or for
one of them should yield the same results and perhaps be even slightly
faster as one less index is pulled up during the search.
Simo.
Jan