On Mon, Jan 10, 2011 at 01:34:31PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/10/2011 09:00 AM, Simo Sorce wrote:
> On Fri, 07 Jan 2011 15:03:42 -0500
> Stephen Gallagher <sgallagh(a)redhat.com> wrote:
>
>> This should be safe, because during an enumeration, all users
>> should now be in the sysdb, so we won't need to go back to the
>> LDAP server for missing members.
>
> This is not necessarily true. Both bad information (non existing users
> listed as members) or filters on users (by uid) on our side can cause
> groups to have members we can't resolve locally.
>
> I suggest we pass down a "on_enumeration" flag to these functions so
> that they will skip contactig the ldap server for any user not found
> locally.
Further investigation found that Simo was right about RFC2307bis; we
would have been wasting trips back to the LDAP server. However, on
RFC2307, we just write dummy entries locally to the sysdb. This is
actually good behavior, as it is expected (if esoteric) behavior that
RFC2307 groups can contain users that do not exist on the LDAP server.
New patch attached to address RFC2307bis.
ok, the extra LDAP search for a not existing user is gone
ACK
bye,
Sumit
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0rUTcACgkQeiVVYja6o6PjAACgm45ShTPpohxxa9DNPE94jzgQ
B80An2e1Z+i8iJT1M2spTbKEScKVOsot
=lNtH
-----END PGP SIGNATURE-----