Hi,
it seems like
https://fedorahosted.org/sssd/ticket/2492 was not fixed
completely. Attached are two patches that do the trick for me -- they
are not polished (at the very least, the first one needs a test..) but I
would like to get another opinion if they at least aim in the right
direction.
So my groups on IPA server are set like this:
[jhrozek@unidirect] sssd $ [(ext_mem)] ipa group-show topgr --all --raw
dn: cn=topgr,cn=groups,cn=accounts,dc=ipa,dc=test
cn: topgr
gidnumber: 240000024
member: cn=ext_ipa_gr,cn=groups,cn=accounts,dc=ipa,dc=test
ipaUniqueID: 193b7c04-91e9-11e5-bc59-5254005f7b59
objectClass: ipaobject
objectClass: top
objectClass: ipausergroup
objectClass: posixgroup
objectClass: groupofnames
objectClass: nestedgroup
[jhrozek@unidirect] sssd $ [(ext_mem)] ipa group-show ext_ipa_gr --all --raw
dn: cn=ext_ipa_gr,cn=groups,cn=accounts,dc=ipa,dc=test
cn: ext_ipa_gr
ipaexternalmember: S-1-5-21-1897531548-1940899517-361317264-500
ipaUniqueID: ad2bd978-91e8-11e5-9d52-5254005f7b59
memberof: cn=topgr,cn=groups,cn=accounts,dc=ipa,dc=test
objectClass: ipaobject
objectClass: top
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: groupofnames
objectClass: ipaexternalgroup
The SID S-1-5-21-1897531548-1940899517-361317264-500 is an AD user
(administrator)
Now when I do:
sudo sss_cache -E
$ id -G administrator(a)win.trust.test
$ sudo sss_cache -G
$ getent group 240000024
Then the "topgr" group gets resolved and the code gets into sdap_save_grpmem:
908 /* This is a temporal solution until the IPA provider is able to
909 * resolve external group membership.
910 *
https://fedorahosted.org/sssd/ticket/2522
911 */
912 if (opts->schema_type == SDAP_SCHEMA_IPA_V1) {
913 ret = sysdb_attrs_get_string(attrs, SYSDB_SID_STR, &group_sid);
914 if (ret != EOK) {
915 DEBUG(SSSDBG_TRACE_FUNC, "Failed to get group sid\n");
916 group_sid = NULL;
Here we set the group_sid variable to NULL, because topgr, being an IPA
group, doesn't have a SID...
917 }
918
919 if (group_sid != NULL) {
920 ret = retain_extern_members(memctx, dom, group_name, group_sid,
921 &userdns, &nuserdns);
Which means we don't call retain_extern_members at all.
922 if (ret != EOK) {
923 DEBUG(SSSDBG_TRACE_INTERNAL,
924 "retain_extern_members failed: %d:[%s].\n",
925 ret, sss_strerror(ret));
926 }
927 }
928 }
But since the whole block of code was added in the same commit, I guess
it must have some purpose..so is going on without a SID the right thing
to do? What was the use-case of the original code?