Hi,
this patch fixes an issue with the handling of universal groups. You can
reproduce it with the following steps either with the AD provider in an
AD forest with multiple domains or with the IPA provider and trust to an
AD forest with multiple domains and a universal group:
- start with an empty cache
- getent group universal_group(a)dom1.ad
- ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad
the cached object only has ghost members because no users are resolved
- getent passwd group_member(a)dom2.ad
- ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad
if a group member from a different domain than the group itself is
resolved the ghost entry is not removed.
bye,
Sumit
Show replies by date